o h1@sxddlmZmZmZddlZddlZddlmZddlZddl m Z ddl m Z ddl mZmZmZe e e e e dZGdd d eZGd d d eZed d eDZe je je je je jfZddZGdddeZedd eDZddZddZ Gddde!Z"Gddde!Z#Gddde!Z$e%ej&Gddde!Z'e%ej&Gdd d e!Z(dS)!)absolute_importdivisionprint_functionN)Enum)x509)hashes) _UNIX_EPOCH_convert_to_naive_utc_time_reject_duplicate_extension)z 1.3.14.3.2.26z2.16.840.1.101.3.4.2.4z2.16.840.1.101.3.4.2.1z2.16.840.1.101.3.4.2.2z2.16.840.1.101.3.4.2.3c@seZdZdZdZdS)OCSPResponderEncodingzBy HashzBy NameN)__name__ __module__ __qualname__HASHNAMErrH/var/www/html/env/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)OCSPResponseStatusrN) r r r SUCCESSFULMALFORMED_REQUESTINTERNAL_ERROR TRY_LATER SIG_REQUIRED UNAUTHORIZEDrrrrr"srcc|]}|j|fVqdSNvalue.0xrrr +r&cCst|ts tddS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512) isinstance_ALLOWED_HASHES ValueError) algorithmrrr_verify_algorithm2s r,c@seZdZdZdZdZdS)OCSPCertStatusrrrN)r r rGOODREVOKEDUNKNOWNrrrrr-9sr-ccrr r!r#rrrr&?r'cCddlm}||SNrbackend),cryptography.hazmat.backends.openssl.backendr4load_der_ocsp_requestdatar4rrrr6B  r6cCr1r2)r5r4load_der_ocsp_responser7rrrr:Gr9r:c@s2eZdZdgfddZddZddZdd ZdS) OCSPRequestBuilderNcCs||_||_dSr )_request _extensions)selfrequest extensionsrrr__init__Ms zOCSPRequestBuilder.__init__cCsL|jdur tdt|t|tjrt|tjstdt|||f|jS)Nz.Only one certificate can be added to a request%cert and issuer must be a Certificate) r<r*r,r(r Certificate TypeErrorr;r=)r>certissuerr+rrradd_certificateQs   z"OCSPRequestBuilder.add_certificatecCsDt|tjs tdt|j||}t||jt|j |j|gSNz"extension must be an ExtensionType) r(r ExtensionTyperD Extensionoidr r=r;r<r> extensioncriticalrrr add_extension^s  z OCSPRequestBuilder.add_extensioncCs(ddlm}|jdurtd||S)Nrr3z*You must add a certificate before building)r5r4r<r*create_ocsp_request)r>r4rrrbuildis   zOCSPRequestBuilder.build)r r rrArGrOrQrrrrr;Ls  r;c@seZdZddZdS)_SingleResponsec Cst|tjr t|tjstdt|t|tjstd|dur,t|tjs,td||_||_||_||_ ||_ t|t sDtd|t j urZ|durQt d|durYt dn$t|tjsdtdt|}|tkrpt d|dur~t|tjs~td ||_||_||_dS) NrBz%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectzBThe revocation_time must be after the unix epoch (1970 January 1).zCrevocation_reason must be an item from the ReasonFlags enum or None)r(rrCrDr,datetime_cert_issuer _algorithm _this_update _next_updater-r/r*r r ReasonFlags _cert_status_revocation_time_revocation_reason) r>rErFr+ cert_status this_update next_updaterevocation_timerevocation_reasonrrrrArsZ         z_SingleResponse.__init__N)r r rrArrrrrRqs rRc@sReZdZdddgfddZddZddZdd Zd d Zd d Ze ddZ dS)OCSPResponseBuilderNcCs||_||_||_||_dSr ) _response _responder_id_certsr=)r>response responder_idcertsr@rrrrAs zOCSPResponseBuilder.__init__c Cs<|jdur tdt||||||||} t| |j|j|jS)Nz#Only one response per OCSPResponse.)rcr*rRrbrdrer=) r>rErFr+r]r^r_r`ra singleresprrr add_responses  z OCSPResponseBuilder.add_responsecCsP|jdur tdt|tjstdt|tstdt|j||f|j |j S)Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) rdr*r(rrCrDr rbrcrer=)r>encodingresponder_certrrrrgs    z OCSPResponseBuilder.responder_idcCs\|jdur tdt|}t|dkrtdtdd|Ds$tdt|j|j||j S)Nz!certificates may only be set oncerzcerts must not be an empty listcss|] }t|tjVqdSr )r(rrCr#rrrr&sz3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates) rer*listlenallrDrbrcrdr=)r>rhrrr certificatess  z OCSPResponseBuilder.certificatescCsLt|tjs tdt|j||}t||jt|j |j |j |j|gSrH) r(rrIrDrJrKr r=rbrcrdrerLrrrrOs  z!OCSPResponseBuilder.add_extensioncCsVddlm}|jdurtd|jdurtdt|tjs"td| t j |||S)Nrr3z&You must add a response before signingz*You must add a responder_id before signingz.Algorithm must be a registered hash algorithm.) r5r4rcr*rdr(r HashAlgorithmrDcreate_ocsp_responserr)r> private_keyr+r4rrrsigns     zOCSPResponseBuilder.signcCs@ddlm}t|tstd|tjurtd||dddS)Nrr3z7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r5r4r(rrDrr*rr)clsresponse_statusr4rrrbuild_unsuccessfuls   z&OCSPResponseBuilder.build_unsuccessful) r r rrArjrgrprOrt classmethodrwrrrrrbs   rbc@s`eZdZejddZejddZejddZejddZej d d Z ejd d Z d S) OCSPRequestcCdSz3 The hash of the issuer public key Nrr>rrrissuer_key_hash zOCSPRequest.issuer_key_hashcCrzz- The hash of the issuer name Nrr|rrrissuer_name_hashr~zOCSPRequest.issuer_name_hashcCrzzK The hash algorithm used in the issuer name and key hashes Nrr|rrrhash_algorithmr~zOCSPRequest.hash_algorithmcCrzzM The serial number of the cert whose status is being checked Nrr|rrr serial_numberr~zOCSPRequest.serial_numbercCrz)z/ Serializes the request to DER Nr)r>rkrrr public_bytes!r~zOCSPRequest.public_bytescCrz)zP The list of request extensions. Not single request extensions. Nrr|rrrr@'r~zOCSPRequest.extensionsN) r r rabcabstractpropertyr}rrrabstractmethodrr@rrrrrys     ryc@seZdZejddZejddZejddZejddZejd d Z ejd d Z ejd dZ ejddZ ejddZ ejddZejddZejddZejddZejddZejddZejdd Zejd!d"Zejd#d$Zd%S)& OCSPResponsecCrz)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nrr|rrrrv0r~zOCSPResponse.response_statuscCrz)zA The ObjectIdentifier of the signature algorithm Nrr|rrrsignature_algorithm_oid7r~z$OCSPResponse.signature_algorithm_oidcCrz)z% The signature bytes Nrr|rrr signature=r~zOCSPResponse.signaturecCrz)z+ The tbsResponseData bytes Nrr|rrrtbs_response_bytesCr~zOCSPResponse.tbs_response_bytescCrz)z A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nrr|rrrrpIr~zOCSPResponse.certificatescCrz)z2 The responder's key hash or None Nrr|rrrresponder_key_hashQr~zOCSPResponse.responder_key_hashcCrz)z. The responder's Name or None Nrr|rrrresponder_nameWr~zOCSPResponse.responder_namecCrz)z4 The time the response was produced Nrr|rrr produced_at]r~zOCSPResponse.produced_atcCrz)zY The status of the certificate (an element from the OCSPCertStatus enum) Nrr|rrrcertificate_statuscr~zOCSPResponse.certificate_statuscCrz)z^ The date of when the certificate was revoked or None if not revoked. Nrr|rrrr`ir~zOCSPResponse.revocation_timecCrz)zi The reason the certificate was revoked or None if not specified or not revoked. Nrr|rrrrapr~zOCSPResponse.revocation_reasoncCrz)z The most recent time at which the status being indicated is known by the responder to have been correct Nrr|rrrr^wr~zOCSPResponse.this_updatecCrz)zC The time when newer information will be available Nrr|rrrr_~r~zOCSPResponse.next_updatecCrzr{rr|rrrr}r~zOCSPResponse.issuer_key_hashcCrzrrr|rrrrr~zOCSPResponse.issuer_name_hashcCrzrrr|rrrrr~zOCSPResponse.hash_algorithmcCrzrrr|rrrrr~zOCSPResponse.serial_numbercCrz)zR The list of response extensions. Not single response extensions. Nrr|rrrr@r~zOCSPResponse.extensionsN)r r rrrrvrrrrprrrrr`rar^r_r}rrrr@rrrrr.sJ                 r)) __future__rrrrrSenumrsix cryptographyrcryptography.hazmat.primitivesrcryptography.x509.baserr r SHA1SHA224SHA256SHA384SHA512 _OIDS_TO_HASHr rdict_RESPONSE_STATUS_TO_ENUMr)r,r-_CERT_STATUS_TO_ENUMr6r:objectr;rRrb add_metaclassABCMetaryrrrrrs@     %> Y %