B f]3@sddlmZmZmZddlZddlZddlmZddlZddl m Z ddl m Z ddl mZmZddlmZmZmZe e e e e dZGd d d eZGd d d eZed deDZe je je je je jfZddZGdddeZ edde DZ!ddZ"ddZ#Gddde$Z%Gddde$Z&Gddde$Z'e(ej)Gddde$Z*e(ej)Gd d!d!e$Z+dS)")absolute_importdivisionprint_functionN)Enum)x509)hashes)ed25519ed448)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extension)z 1.3.14.3.2.26z2.16.840.1.101.3.4.2.4z2.16.840.1.101.3.4.2.1z2.16.840.1.101.3.4.2.2z2.16.840.1.101.3.4.2.3c@seZdZdZdZdS)OCSPResponderEncodingzBy HashzBy NameN)__name__ __module__ __qualname__ZHASHNAMErr5lib/python3.7/site-packages/cryptography/x509/ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)OCSPResponseStatusrN) rrr SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIREDZ UNAUTHORIZEDrrrrr#s rccs|]}|j|fVqdS)N)value).0xrrr ,srcCst|tstddS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512) isinstance_ALLOWED_HASHES ValueError) algorithmrrr_verify_algorithm3s r#c@seZdZdZdZdZdS)OCSPCertStatusrrrN)rrrZGOODREVOKEDZUNKNOWNrrrrr$:sr$ccs|]}|j|fVqdS)N)r)rrrrrr@scCsddlm}||S)Nr)backend),cryptography.hazmat.backends.openssl.backendr&load_der_ocsp_request)datar&rrrr(Cs r(cCsddlm}||S)Nr)r&)r'r&load_der_ocsp_response)r)r&rrrr*Hs r*c@s2eZdZdgfddZddZddZdd ZdS) OCSPRequestBuilderNcCs||_||_dS)N)_request _extensions)selfZrequest extensionsrrr__init__NszOCSPRequestBuilder.__init__cCsL|jdk rtdt|t|tjr2t|tjs:tdt|||f|jS)Nz.Only one certificate can be added to a requestz%cert and issuer must be a Certificate) r,r!r#rr Certificate TypeErrorr+r-)r.certissuerr"rrradd_certificateRs   z"OCSPRequestBuilder.add_certificatecCsDt|tjstdt|j||}t||jt|j |j|gS)Nz"extension must be an ExtensionType) rr ExtensionTyper2 Extensionoidr r-r+r,)r. extensioncriticalrrr add_extension_s   z OCSPRequestBuilder.add_extensioncCs(ddlm}|jdkrtd||S)Nr)r&z*You must add a certificate before building)r'r&r,r!Zcreate_ocsp_request)r.r&rrrbuildjs  zOCSPRequestBuilder.build)rrrr0r5r;r<rrrrr+Ms  r+c@seZdZddZdS)_SingleResponsec Cst|tjrt|tjs tdt|t|tjs.z$certs must be a list of Certificates) rGr!listlenallr2rDrErFr-)r.rIrrr certificatess  z OCSPResponseBuilder.certificatescCsLt|tjstdt|j||}t||jt|j |j |j |j|gS)Nz"extension must be an ExtensionType) rrr6r2r7r8r r-rDrErFrG)r.r9r:rrrr;s  z!OCSPResponseBuilder.add_extensioncCszddlm}|jdkrtd|jdkr0tdt|tjtj frT|dk rhtdnt|t j sht d| tj|||S)Nr)r&z&You must add a response before signingz*You must add a responder_id before signingz8algorithm must be None when signing via ed25519 or ed448z.Algorithm must be a registered hash algorithm.)r'r&rEr!rFrrZEd25519PrivateKeyr ZEd448PrivateKeyrZ HashAlgorithmr2create_ocsp_responserr)r.Z private_keyr"r&rrrsigns    zOCSPResponseBuilder.signcCs@ddlm}t|tstd|tjkr0td||dddS)Nr)r&z7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r'r&rrr2rr!rP)clsresponse_statusr&rrrbuild_unsuccessfuls   z&OCSPResponseBuilder.build_unsuccessful) rrrr0rJrHrOr;rQ classmethodrTrrrrrDs   rDc@s`eZdZejddZejddZejddZejddZej d d Z ejd d Z d S) OCSPRequestcCsdS)z3 The hash of the issuer public key Nr)r.rrrissuer_key_hashszOCSPRequest.issuer_key_hashcCsdS)z- The hash of the issuer name Nr)r.rrrissuer_name_hashszOCSPRequest.issuer_name_hashcCsdS)zK The hash algorithm used in the issuer name and key hashes Nr)r.rrrhash_algorithmszOCSPRequest.hash_algorithmcCsdS)zM The serial number of the cert whose status is being checked Nr)r.rrr serial_number#szOCSPRequest.serial_numbercCsdS)z/ Serializes the request to DER Nr)r.rKrrr public_bytes(szOCSPRequest.public_bytescCsdS)zP The list of request extensions. Not single request extensions. Nr)r.rrrr/.szOCSPRequest.extensionsN) rrrabcabstractpropertyrWrXrYrZabstractmethodr[r/rrrrrVs rVc@seZdZejddZejddZejddZejddZejd d Z ejd d Z ejd dZ ejddZ ejddZ ejddZejddZejddZejddZejddZejddZejdd Zejd!d"Zejd#d$Zejd%d&Zd'S)( OCSPResponsecCsdS)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nr)r.rrrrS7szOCSPResponse.response_statuscCsdS)zA The ObjectIdentifier of the signature algorithm Nr)r.rrrsignature_algorithm_oid>sz$OCSPResponse.signature_algorithm_oidcCsdS)zX Returns a HashAlgorithm corresponding to the type of the digest signed Nr)r.rrrsignature_hash_algorithmDsz%OCSPResponse.signature_hash_algorithmcCsdS)z% The signature bytes Nr)r.rrr signatureJszOCSPResponse.signaturecCsdS)z+ The tbsResponseData bytes Nr)r.rrrtbs_response_bytesPszOCSPResponse.tbs_response_bytescCsdS)z A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nr)r.rrrrOVszOCSPResponse.certificatescCsdS)z2 The responder's key hash or None Nr)r.rrrresponder_key_hash^szOCSPResponse.responder_key_hashcCsdS)z. The responder's Name or None Nr)r.rrrresponder_namedszOCSPResponse.responder_namecCsdS)z4 The time the response was produced Nr)r.rrr produced_atjszOCSPResponse.produced_atcCsdS)zY The status of the certificate (an element from the OCSPCertStatus enum) Nr)r.rrrcertificate_statuspszOCSPResponse.certificate_statuscCsdS)z^ The date of when the certificate was revoked or None if not revoked. Nr)r.rrrrBvszOCSPResponse.revocation_timecCsdS)zi The reason the certificate was revoked or None if not specified or not revoked. Nr)r.rrrrC}szOCSPResponse.revocation_reasoncCsdS)z The most recent time at which the status being indicated is known by the responder to have been correct Nr)r.rrrr@szOCSPResponse.this_updatecCsdS)zC The time when newer information will be available Nr)r.rrrrAszOCSPResponse.next_updatecCsdS)z3 The hash of the issuer public key Nr)r.rrrrWszOCSPResponse.issuer_key_hashcCsdS)z- The hash of the issuer name Nr)r.rrrrXszOCSPResponse.issuer_name_hashcCsdS)zK The hash algorithm used in the issuer name and key hashes Nr)r.rrrrYszOCSPResponse.hash_algorithmcCsdS)zM The serial number of the cert whose status is being checked Nr)r.rrrrZszOCSPResponse.serial_numbercCsdS)zR The list of response extensions. Not single response extensions. Nr)r.rrrr/szOCSPResponse.extensionsN)rrrr\r]rSr`rarbrcrOrdrerfrgrBrCr@rArWrXrYrZr/rrrrr_5s&r_),Z __future__rrrr\r>enumrZsixZ cryptographyrZcryptography.hazmat.primitivesrZ)cryptography.hazmat.primitives.asymmetricrr Zcryptography.x509.baser r r ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512Z _OIDS_TO_HASHr rdictZ_RESPONSE_STATUS_TO_ENUMr r#r$Z_CERT_STATUS_TO_ENUMr(r*objectr+r=rDZ add_metaclassABCMetarVr_rrrrs<       %>_%