B
    M]PJ                 @   s  d Z ddlmZmZmZmZ ddlmZ ddlm	Z	m
Z
 ddlmZmZmZmZmZmZmZmZmZmZmZmZmZ ddlmZmZ ddlmZ dd	lmZm Z m!Z!m"Z" G d
d deZ#G dd deZ$G dd deZ%G dd deZ&G dd deZ'G dd deZ(G dd deZ)G dd deZ*G dd deZ+G dd deZ,G dd deZ-G d d! d!eZ.G d"d# d#eZ/G d$d% d%eZ0G d&d' d'eZ1G d(d) d)eZ2G d*d+ d+eZ3G d,d- d-eZ4G d.d/ d/eZ5G d0d1 d1eZ6G d2d3 d3eZ7G d4d5 d5eZ8G d6d7 d7eZ9G d8d9 d9eZ:G d:d; d;eZ;G d<d= d=eZ<G d>d? d?eZ=G d@dA dAeZ>G dBdC dCeZ?G dDdE dEeZ@G dFdG dGeZAG dHdI dIeZBG dJdK dKeZCG dLdM dMeZDG dNdO dOeZEG dPdQ dQeZFG dRdS dSeZGG dTdU dUeZHdVS )Wz
ASN.1 type classes for the online certificate status protocol (OCSP). Exports
the following items:

 - OCSPRequest()
 - OCSPResponse()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function   )unwrap)DigestAlgorithmSignedDigestAlgorithm)BooleanChoice
EnumeratedGeneralizedTime	IA5StringIntegerNullObjectIdentifierOctetBitStringOctetStringParsableOctetStringSequence
SequenceOf)AuthorityInfoAccessSyntax	CRLReason)PublicKeyAlgorithm)CertificateGeneralNameGeneralNamesNamec               @   s   e Zd ZddiZdS )Versionr   v1N)__name__
__module____qualname___map r$   r$   .lib/python3.7/site-packages/asn1crypto/ocsp.pyr   (   s   r   c               @   s(   e Zd ZdefdefdefdefgZdS )CertIdZhash_algorithmZissuer_name_hashZissuer_key_hashZserial_numberN)r    r!   r"   r   r   r   _fieldsr$   r$   r$   r%   r&   .   s   r&   c               @   s   e Zd ZdefdefgZdS )ServiceLocatorZissuerZlocatorN)r    r!   r"   r   r   r'   r$   r$   r$   r%   r(   7   s   r(   c               @   s   e Zd ZddiZdS )RequestExtensionIdz1.3.6.1.5.5.7.48.1.7service_locatorN)r    r!   r"   r#   r$   r$   r$   r%   r)   >   s   r)   c               @   s4   e Zd ZdefdeddifdefgZdZdeiZ	dS )	RequestExtensionextn_idcriticaldefaultF
extn_value)r,   r/   r*   N)
r    r!   r"   r)   r
   r   r'   	_oid_pairr(   
_oid_specsr$   r$   r$   r%   r+   D   s
   
r+   c               @   s   e Zd ZeZdS )RequestExtensionsN)r    r!   r"   r+   _child_specr$   r$   r$   r%   r2   Q   s   r2   c               @   sP   e Zd ZdefdedddfgZdZdZdZdd	 Z	e
d
d Ze
dd ZdS )RequestZreq_certsingle_request_extensionsr   T)explicitoptionalFNc             C   sh   t  | _xT| d D ]H}|d j}d| }t| |rDt| ||d j |d jr| j| qW d| _dS )zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r5   r,   z	_%s_valuer/   r-   TN)set_critical_extensionsnativehasattrsetattrparsedadd_processed_extensions)self	extensionnameattribute_namer$   r$   r%   _set_extensions_   s    


zRequest._set_extensionsc             C   s   | j s|   | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r?   rD   r9   )r@   r$   r$   r%   critical_extensionsq   s    
zRequest.critical_extensionsc             C   s   | j dkr|   | jS )z
        This extension is used when communicating with an OCSP responder that
        acts as a proxy for OCSP requests

        :return:
            None or a ServiceLocator object
        F)r?   rD   _service_locator_value)r@   r$   r$   r%   service_locator_value   s    

zRequest.service_locator_value)r    r!   r"   r&   r2   r'   r?   r9   rF   rD   propertyrE   rG   r$   r$   r$   r%   r4   U   s   r4   c               @   s   e Zd ZeZdS )RequestsN)r    r!   r"   r4   r3   r$   r$   r$   r%   rI      s   rI   c               @   s   e Zd ZddiZdS )ResponseTypez1.3.6.1.5.5.7.48.1.1basic_ocsp_responseN)r    r!   r"   r#   r$   r$   r$   r%   rJ      s   rJ   c               @   s   e Zd ZeZdS )AcceptableResponsesN)r    r!   r"   rJ   r3   r$   r$   r$   r%   rL      s   rL   c               @   s"   e Zd ZdefdeddifgZdS )PreferredSignatureAlgorithmZsig_identifierZcert_identifierr7   TN)r    r!   r"   r	   r   r'   r$   r$   r$   r%   rM      s   rM   c               @   s   e Zd ZeZdS )PreferredSignatureAlgorithmsN)r    r!   r"   rM   r3   r$   r$   r$   r%   rN      s   rN   c               @   s   e Zd ZddddZdS )TBSRequestExtensionIdnonceacceptable_responsespreferred_signature_algorithms)z1.3.6.1.5.5.7.48.1.2z1.3.6.1.5.5.7.48.1.4z1.3.6.1.5.5.7.48.1.8N)r    r!   r"   r#   r$   r$   r$   r%   rO      s   rO   c               @   s8   e Zd ZdefdeddifdefgZdZee	e
dZdS )	TBSRequestExtensionr,   r-   r.   Fr/   )r,   r/   )rP   rQ   rR   N)r    r!   r"   rO   r
   r   r'   r0   r   rL   rN   r1   r$   r$   r$   r%   rS      s   
rS   c               @   s   e Zd ZeZdS )TBSRequestExtensionsN)r    r!   r"   rS   r3   r$   r$   r$   r%   rT      s   rT   c               @   s@   e Zd Zdedddfdedddfd	efd
edddfgZdS )
TBSRequestversionr   r   )r6   r.   Zrequestor_namer   T)r6   r7   Zrequest_listrequest_extensions   N)r    r!   r"   r   r   rI   rT   r'   r$   r$   r$   r%   rU      s   rU   c               @   s   e Zd ZeZdS )CertificatesN)r    r!   r"   r   r3   r$   r$   r$   r%   rY      s   rY   c               @   s*   e Zd ZdefdefdedddfgZdS )	Signaturesignature_algorithm	signaturecertsr   T)r6   r7   N)r    r!   r"   r	   r   rY   r'   r$   r$   r$   r%   rZ      s   rZ   c               @   sp   e Zd ZdefdedddfgZdZdZdZdZ	dZ
dd	 Zed
d Zedd Zedd Zedd ZdS )OCSPRequesttbs_requestZoptional_signaturer   T)r6   r7   FNc             C   sl   t  | _xX| d d D ]H}|d j}d| }t| |rHt| ||d j |d jr| j| qW d| _dS )	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r_   rW   r,   z	_%s_valuer/   r-   TN)r8   r9   r:   r;   r<   r=   r>   r?   )r@   rA   rB   rC   r$   r$   r%   rD      s    


zOCSPRequest._set_extensionsc             C   s   | j s|   | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r?   rD   r9   )r@   r$   r$   r%   rE      s    
zOCSPRequest.critical_extensionsc             C   s   | j dkr|   | jS )z
        This extension is used to prevent replay attacks by including a unique,
        random value with each request/response pair

        :return:
            None or an OctetString object
        F)r?   rD   _nonce_value)r@   r$   r$   r%   nonce_value  s    

zOCSPRequest.nonce_valuec             C   s   | j dkr|   | jS )a(  
        This extension is used to allow the client and server to communicate
        with alternative response formats other than just basic_ocsp_response,
        although no other formats are defined in the standard.

        :return:
            None or an AcceptableResponses object
        F)r?   rD   _acceptable_responses_value)r@   r$   r$   r%   acceptable_responses_value  s    
z&OCSPRequest.acceptable_responses_valuec             C   s   | j dkr|   | jS )aj  
        This extension is used by the client to define what signature algorithms
        are preferred, including both the hash algorithm and the public key
        algorithm, with a level of detail down to even the public key algorithm
        parameters, such as curve name.

        :return:
            None or a PreferredSignatureAlgorithms object
        F)r?   rD   %_preferred_signature_algorithms_value)r@   r$   r$   r%   $preferred_signature_algorithms_value   s    
z0OCSPRequest.preferred_signature_algorithms_value)r    r!   r"   rU   rZ   r'   r?   r9   r`   rb   rd   rD   rH   rE   ra   rc   re   r$   r$   r$   r%   r^      s   r^   c               @   s   e Zd ZdddddddZdS )	OCSPResponseStatusZ
successfulZmalformed_requestZinternal_errorZ	try_laterZsign_requiredZunauthorized)r   r   rX            N)r    r!   r"   r#   r$   r$   r$   r%   rf   1  s   rf   c               @   s(   e Zd ZdeddifdeddifgZdS )ResponderIdZby_namer6   r   Zby_keyrX   N)r    r!   r"   r   r   _alternativesr$   r$   r$   r%   rj   <  s   rj   c               @   s    e Zd Zdd Zedd ZdS )
StatusGoodc             C   s6   |dk	r,|dkr,t |ts,ttdt|d| _dS )z`
        Sets the value of the object

        :param value:
            None or 'good'
        NgoodzK
                value must be one of None, "good", not %s
                    )
isinstancer   
ValueErrorr   reprcontents)r@   valuer$   r$   r%   r8   E  s
    zStatusGood.setc             C   s   dS )Nrm   r$   )r@   r$   r$   r%   r:   W  s    zStatusGood.nativeN)r    r!   r"   r8   rH   r:   r$   r$   r$   r%   rl   D  s   rl   c               @   s    e Zd Zdd Zedd ZdS )StatusUnknownc             C   s6   |dk	r,|dkr,t |ts,ttdt|d| _dS )zc
        Sets the value of the object

        :param value:
            None or 'unknown'
        NunknownzN
                value must be one of None, "unknown", not %s
                rn   )ro   r   rp   r   rq   rr   )r@   rs   r$   r$   r%   r8   ^  s
    zStatusUnknown.setc             C   s   dS )Nru   r$   )r@   r$   r$   r%   r:   p  s    zStatusUnknown.nativeN)r    r!   r"   r8   rH   r:   r$   r$   r$   r%   rt   ]  s   rt   c               @   s$   e Zd ZdefdedddfgZdS )RevokedInfoZrevocation_timeZrevocation_reasonr   T)r6   r7   N)r    r!   r"   r   r   r'   r$   r$   r$   r%   rv   u  s   rv   c               @   s4   e Zd ZdeddifdeddifdeddifgZdS )	
CertStatusrm   Zimplicitr   Zrevokedr   ru   rX   N)r    r!   r"   rl   rv   rt   rk   r$   r$   r$   r%   rw   |  s   rw   c               @   s:   e Zd ZdedddfdedddfdedddfgZd	S )
CrlIdZcrl_urlr   T)r6   r7   Zcrl_numr   Zcrl_timerX   N)r    r!   r"   r   r   r   r'   r$   r$   r$   r%   rx     s   rx   c               @   s   e Zd ZdddddddZdS )	SingleResponseExtensionIdcrlarchive_cutoff
crl_reasoninvalidity_datecertificate_issuer!signed_certificate_timestamp_list)z1.3.6.1.5.5.7.48.1.3z1.3.6.1.5.5.7.48.1.6z	2.5.29.21z	2.5.29.24z	2.5.29.29z1.3.6.1.4.1.11129.2.4.5N)r    r!   r"   r#   r$   r$   r$   r%   ry     s   ry   c               @   s>   e Zd ZdefdeddifdefgZdZee	e
e	eedZdS )	SingleResponseExtensionr,   r-   r.   Fr/   )r,   r/   )rz   r{   r|   r}   r~   r   N)r    r!   r"   ry   r
   r   r'   r0   rx   r   r   r   r   r1   r$   r$   r$   r%   r     s   
r   c               @   s   e Zd ZeZdS )SingleResponseExtensionsN)r    r!   r"   r   r3   r$   r$   r$   r%   r     s   r   c            	   @   s   e Zd Zdefdefdefdedddfded	ddfgZd
ZdZ	dZ
dZdZdZdZdd Zedd Zedd Zedd Zedd Zedd Zedd ZdS )SingleResponseZcert_idZcert_statusZthis_updateZnext_updater   T)r6   r7   single_extensionsr   FNc             C   sh   t  | _xT| d D ]H}|d j}d| }t| |rDt| ||d j |d jr| j| qW d| _dS )zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r   r,   z	_%s_valuer/   r-   TN)r8   r9   r:   r;   r<   r=   r>   r?   )r@   rA   rB   rC   r$   r$   r%   rD     s    


zSingleResponse._set_extensionsc             C   s   | j s|   | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r?   rD   r9   )r@   r$   r$   r%   rE     s    
z"SingleResponse.critical_extensionsc             C   s   | j dkr|   | jS )z
        This extension is used to locate the CRL that a certificate's revocation
        is contained within.

        :return:
            None or a CrlId object
        F)r?   rD   
_crl_value)r@   r$   r$   r%   	crl_value  s    

zSingleResponse.crl_valuec             C   s   | j dkr|   | jS )z
        This extension is used to indicate the date at which an archived
        (historical) certificate status entry will no longer be available.

        :return:
            None or a GeneralizedTime object
        F)r?   rD   _archive_cutoff_value)r@   r$   r$   r%   archive_cutoff_value  s    

z#SingleResponse.archive_cutoff_valuec             C   s   | j dkr|   | jS )z
        This extension indicates the reason that a certificate was revoked.

        :return:
            None or a CRLReason object
        F)r?   rD   _crl_reason_value)r@   r$   r$   r%   crl_reason_value  s    	
zSingleResponse.crl_reason_valuec             C   s   | j dkr|   | jS )a=  
        This extension indicates the suspected date/time the private key was
        compromised or the certificate became invalid. This would usually be
        before the revocation date, which is when the CA processed the
        revocation.

        :return:
            None or a GeneralizedTime object
        F)r?   rD   _invalidity_date_value)r@   r$   r$   r%   invalidity_date_value
  s    
z$SingleResponse.invalidity_date_valuec             C   s   | j dkr|   | jS )z
        This extension indicates the issuer of the certificate in question.

        :return:
            None or an x509.GeneralNames object
        F)r?   rD   _certificate_issuer_value)r@   r$   r$   r%   certificate_issuer_value  s    	
z'SingleResponse.certificate_issuer_value)r    r!   r"   r&   rw   r   r   r'   r?   r9   r   r   r   r   r   rD   rH   rE   r   r   r   r   r   r$   r$   r$   r%   r     s&   r   c               @   s   e Zd ZeZdS )	ResponsesN)r    r!   r"   r   r3   r$   r$   r$   r%   r   (  s   r   c               @   s   e Zd ZdddZdS )ResponseDataExtensionIdrP   extended_revoke)z1.3.6.1.5.5.7.48.1.2z1.3.6.1.5.5.7.48.1.9N)r    r!   r"   r#   r$   r$   r$   r%   r   ,  s   r   c               @   s6   e Zd ZdefdeddifdefgZdZee	dZ
dS )	ResponseDataExtensionr,   r-   r.   Fr/   )r,   r/   )rP   r   N)r    r!   r"   r   r
   r   r'   r0   r   r   r1   r$   r$   r$   r%   r   3  s   
r   c               @   s   e Zd ZeZdS )ResponseDataExtensionsN)r    r!   r"   r   r3   r$   r$   r$   r%   r   A  s   r   c            	   @   s>   e Zd Zdedddfdefdefdefded	d
dfgZdS )ResponseDatarV   r   r   )r6   r.   Zresponder_idZproduced_atZ	responsesresponse_extensionsr   T)r6   r7   N)	r    r!   r"   r   rj   r   r   r   r'   r$   r$   r$   r%   r   E  s
   r   c               @   s0   e Zd ZdefdefdefdedddfgZdS )	BasicOCSPResponsetbs_response_datar[   r\   r]   r   T)r6   r7   N)r    r!   r"   r   r	   r   rY   r'   r$   r$   r$   r%   r   O  s   r   c               @   s(   e Zd ZdefdefgZdZdeiZdS )ResponseBytesresponse_typeresponse)r   r   rK   N)	r    r!   r"   rJ   r   r'   r0   r   r1   r$   r$   r$   r%   r   X  s   
r   c               @   sx   e Zd ZdefdedddfgZdZdZdZdZ	dd	 Z
ed
d Zedd Zedd Zedd Zedd ZdS )OCSPResponseZresponse_statusresponse_bytesr   T)r6   r7   FNc             C   sv   t  | _xb| d d jd d D ]H}|d j}d| }t| |rRt| ||d j |d jr | j| q W d	| _d
S )zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r   r   r   r   r,   z	_%s_valuer/   r-   TN)r8   r9   r=   r:   r;   r<   r>   r?   )r@   rA   rB   rC   r$   r$   r%   rD   o  s    


zOCSPResponse._set_extensionsc             C   s   | j s|   | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r?   rD   r9   )r@   r$   r$   r%   rE     s    
z OCSPResponse.critical_extensionsc             C   s   | j dkr|   | jS )z
        This extension is used to prevent replay attacks on the request/response
        exchange

        :return:
            None or an OctetString object
        F)r?   rD   r`   )r@   r$   r$   r%   ra     s    

zOCSPResponse.nonce_valuec             C   s   | j dkr|   | jS )z
        This extension is used to signal that the responder will return a
        "revoked" status for non-issued certificates.

        :return:
            None or a Null object (if present)
        F)r?   rD   _extended_revoke_value)r@   r$   r$   r%   extended_revoke_value  s    

z"OCSPResponse.extended_revoke_valuec             C   s   | d d j S )z
        A shortcut into the BasicOCSPResponse sequence

        :return:
            None or an asn1crypto.ocsp.BasicOCSPResponse object
        r   r   )r=   )r@   r$   r$   r%   rK     s    	z OCSPResponse.basic_ocsp_responsec             C   s   | d d j d S )z
        A shortcut into the parsed, ResponseData sequence

        :return:
            None or an asn1crypto.ocsp.ResponseData object
        r   r   r   )r=   )r@   r$   r$   r%   response_data  s    	zOCSPResponse.response_data)r    r!   r"   rf   r   r'   r?   r9   r`   r   rD   rH   rE   ra   r   rK   r   r$   r$   r$   r%   r   d  s   r   N)I__doc__Z
__future__r   r   r   r   Z_errorsr   Zalgosr   r	   Zcorer
   r   r   r   r   r   r   r   r   r   r   r   r   rz   r   r   keysr   Zx509r   r   r   r   r   r&   r(   r)   r+   r2   r4   rI   rJ   rL   rM   rN   rO   rS   rT   rU   rY   rZ   r^   rf   rj   rl   rt   rv   rw   rx   ry   r   r   r   r   r   r   r   r   r   r   r   r$   r$   r$   r%   <module>   sZ   <	9	Zx
	