o 5WcZC@s\ddlZddlZddlZddlmZddlmZddlmZddlm Z m Z ddl m Z ddl mZmZmZGdd d ejZGd d d ejZe je je je je jfZd e jd dfddZGdddejZGdddZGdddejdZGdddejdZ GdddejdZ!GdddZ"GdddZ#de$d efd d!Z%de$d e!fd"d#Z&dS)$N)utils)x509)ocsp)hashes serialization)CERTIFICATE_PRIVATE_KEY_TYPES)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc@seZdZdZdZdS)OCSPResponderEncodingzBy HashzBy NameN)__name__ __module__ __qualname__HASHNAMErr8D:\Flask\env\Lib\site-packages\cryptography/x509/ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)OCSPResponseStatusrN) r r r SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIRED UNAUTHORIZEDrrrrrsr algorithmreturncCst|ts tddS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512) isinstance_ALLOWED_HASHES ValueError)rrrr_verify_algorithm/s r!c@seZdZdZdZdZdS)OCSPCertStatusrrrN)r r rZGOODREVOKEDUNKNOWNrrrrr"6sr"c@sVeZdZdejdejdejdedejde j ejde j ejde j ej fd d Z d S) _SingleResponsecertissuerr cert_status this_update next_updaterevocation_timerevocation_reasonc Cst|tjr t|tjstdt|t|tjstd|dur,t|tjs,td||_||_||_||_ ||_ t|t sDtd|t j urZ|durQt d|durYt dn$t|tjsdtdt|}|tkrpt d|dur~t|tjs~td ||_||_||_dS) N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)rr Certificate TypeErrorr!datetimeZ_certZ_issuer _algorithmZ _this_updateZ _next_updater"r#r r r ReasonFlagsZ _cert_statusZ_revocation_timeZ_revocation_reason) selfr&r'rr(r)r*r+r,rrr__init__=s\        z_SingleResponse.__init__N) r r rrr.r HashAlgorithmr"r0typingOptionalr2r4rrrrr%<s$   r%c@seZdZejdefddZejdefddZejdej fddZ ejde fdd Z ej d ejdefd d Zejdejfd dZdS) OCSPRequestrcCdSz3 The hash of the issuer public key Nrr3rrrissuer_key_hashzOCSPRequest.issuer_key_hashcCr9z- The hash of the issuer name Nrr;rrrissuer_name_hashr=zOCSPRequest.issuer_name_hashcCr9zK The hash algorithm used in the issuer name and key hashes Nrr;rrrhash_algorithmr=zOCSPRequest.hash_algorithmcCr9zM The serial number of the cert whose status is being checked Nrr;rrr serial_numberr=zOCSPRequest.serial_numberencodingcCr9)z/ Serializes the request to DER Nrr3rDrrr public_bytesr=zOCSPRequest.public_bytescCr9)zP The list of request extensions. Not single request extensions. Nrr;rrr extensionsr=zOCSPRequest.extensionsN)r r rabcabstractpropertybytesr<r?rr5rAintrCabstractmethodrEncodingrFr ExtensionsrGrrrrr8sr8) metaclassc@seZdZejdefddZejdeje j fddZ ejdeje j fddZ ejde j fdd Zejdeje j fd d Zejdefd d ZejdefddZejdejfddZejdefddZdS)OCSPSingleResponsercCr9zY The status of the certificate (an element from the OCSPCertStatus enum) Nrr;rrrcertificate_statusr=z%OCSPSingleResponse.certificate_statuscCr9z^ The date of when the certificate was revoked or None if not revoked. Nrr;rrrr+r=z"OCSPSingleResponse.revocation_timecCr9zi The reason the certificate was revoked or None if not specified or not revoked. Nrr;rrrr,r=z$OCSPSingleResponse.revocation_reasoncCr9z The most recent time at which the status being indicated is known by the responder to have been correct Nrr;rrrr)r=zOCSPSingleResponse.this_updatecCr9zC The time when newer information will be available Nrr;rrrr*r=zOCSPSingleResponse.next_updatecCr9r:rr;rrrr<r=z"OCSPSingleResponse.issuer_key_hashcCr9r>rr;rrrr?r=z#OCSPSingleResponse.issuer_name_hashcCr9r@rr;rrrrAr=z!OCSPSingleResponse.hash_algorithmcCr9rBrr;rrrrCr=z OCSPSingleResponse.serial_numberN)r r rrHrIr"rRr6r7r0r+rr2r,r)r*rJr<r?rr5rArKrCrrrrrPs&rPc@seZdZejdejefddZejde fddZ ejde j fddZ ejdejejfdd Zejdefd d Zejdefd d Zejdeje jfddZejdejefddZejdeje jfddZejdejfddZejdefddZejdejejfddZejdeje j fddZ!ejdejfddZ"ejdejejfddZ#ejdefd d!Z$ejdefd"d#Z%ejdejfd$d%Z&ejde'fd&d'Z(ejde j)fd(d)Z*ejde j)fd*d+Z+ej,d,e-j.defd-d.Z/d/S)0 OCSPResponsercCr9)z_ An iterator over the individual SINGLERESP structures in the response Nrr;rrr responsesr=zOCSPResponse.responsescCr9)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nrr;rrrresponse_statusr=zOCSPResponse.response_statuscCr9)zA The ObjectIdentifier of the signature algorithm Nrr;rrrsignature_algorithm_oidr=z$OCSPResponse.signature_algorithm_oidcCr9)zX Returns a HashAlgorithm corresponding to the type of the digest signed Nrr;rrrsignature_hash_algorithmr=z%OCSPResponse.signature_hash_algorithmcCr9)z% The signature bytes Nrr;rrr signaturer=zOCSPResponse.signaturecCr9)z+ The tbsResponseData bytes Nrr;rrrtbs_response_bytesr=zOCSPResponse.tbs_response_bytescCr9)z A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nrr;rrr certificates r=zOCSPResponse.certificatescCr9)z2 The responder's key hash or None Nrr;rrrresponder_key_hashr=zOCSPResponse.responder_key_hashcCr9)z. The responder's Name or None Nrr;rrrresponder_namer=zOCSPResponse.responder_namecCr9)z4 The time the response was produced Nrr;rrr produced_at r=zOCSPResponse.produced_atcCr9rQrr;rrrrR&r=zOCSPResponse.certificate_statuscCr9rSrr;rrrr+,r=zOCSPResponse.revocation_timecCr9rTrr;rrrr,3r=zOCSPResponse.revocation_reasoncCr9rUrr;rrrr):r=zOCSPResponse.this_updatecCr9rVrr;rrrr*Ar=zOCSPResponse.next_updatecCr9r:rr;rrrr<Gr=zOCSPResponse.issuer_key_hashcCr9r>rr;rrrr?Mr=zOCSPResponse.issuer_name_hashcCr9r@rr;rrrrASr=zOCSPResponse.hash_algorithmcCr9rBrr;rrrrCYr=zOCSPResponse.serial_numbercCr9)zR The list of response extensions. Not single response extensions. Nrr;rrrrG_r=zOCSPResponse.extensionscCr9)zR The list of single response extensions. Not response extensions. Nrr;rrrsingle_extensionser=zOCSPResponse.single_extensionsrDcCr9)z0 Serializes the response to DER NrrErrrrFkr=zOCSPResponse.public_bytesN)0r r rrHrIr6IteratorrPrXrrYrZObjectIdentifierrZr7rr5r[rJr\r]Listr.r^r_Namer`r0rar"rRr+r2r,r)r*r<r?rArKrCrNrGrbrLrrMrFrrrrrWs^  rWc@seZdZdgfdejejejejej fdej ej ej ddfddZ dejdejd ej ddfd d Zd ej d eddfddZdefddZdS)OCSPRequestBuilderNrequestrGrcCs||_||_dSN)_request _extensions)r3rgrGrrrr4ss zOCSPRequestBuilder.__init__r&r'rcCsL|jdur tdt|t|tjrt|tjstdt|||f|jS)Nz.Only one certificate can be added to a requestr-) rir r!rrr.r/rfrj)r3r&r'rrrradd_certificates z"OCSPRequestBuilder.add_certificateextvalcriticalcCsDt|tjs tdt|j||}t||jt|j |j|gSNz"extension must be an ExtensionType) rr ExtensionTyper/ Extensionoidr rjrfrir3rlrm extensionrrr add_extensions  z OCSPRequestBuilder.add_extensioncCs|jdur tdt|S)Nz*You must add a certificate before building)rir rZcreate_ocsp_requestr;rrrbuilds  zOCSPRequestBuilder.build)r r rr6r7Tuplerr.rr5rdrpror4rkboolrtr8rurrrrrfrs>     rfc@s0eZdZdddgfdejedejejeje fdejej ejdej ej ej fddZ dejd ejd ejd ed ejd ejejdejejdejejddfddZde dejddfddZdejejddfddZdej deddfddZded ejejdefddZed edefd!d"ZdS)#OCSPResponseBuilderNresponse responder_idcertsrGcCs||_||_||_||_dSrh) _response _responder_id_certsrj)r3ryrzr{rGrrrr4s  zOCSPResponseBuilder.__init__r&r'rr(r)r*r+r,rc Cs<|jdur tdt||||||||} t| |j|j|jS)Nz#Only one response per OCSPResponse.)r|r r%rxr}r~rj) r3r&r'rr(r)r*r+r,Z singleresprrr add_responses$  z OCSPResponseBuilder.add_responserDresponder_certcCsP|jdur tdt|tjstdt|tstdt|j||f|j |j S)Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) r}r rrr.r/r rxr|r~rj)r3rDrrrrrzs   z OCSPResponseBuilder.responder_idcCs\|jdur tdt|}t|dkrtdtdd|Ds$tdt|j|j||j S)Nz!certificates may only be set oncerzcerts must not be an empty listcss|] }t|tjVqdSrh)rrr.).0xrrr sz3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates) r~r listlenallr/rxr|r}rj)r3r{rrrr^s  z OCSPResponseBuilder.certificatesrlrmcCsLt|tjs tdt|j||}t||jt|j |j |j |j|gSrn) rrror/rprqr rjrxr|r}r~rrrrrrts   z!OCSPResponseBuilder.add_extension private_keycCs6|jdur td|jdurtdttj|||S)Nz&You must add a response before signingz*You must add a responder_id before signing)r|r r}rcreate_ocsp_responserr)r3rrrrrsigns   zOCSPResponseBuilder.signrYcCs4t|ts td|tjurtdt|dddS)Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)rrr/rr rr)clsrYrrrbuild_unsuccessfuls  z&OCSPResponseBuilder.build_unsuccessful)r r rr6r7r%rvrr.r rdrpror4rr5r"r0r2rrzIterabler^rwrtrrWr classmethodrrrrrrrxs           rxdatacC t|Srh)rload_der_ocsp_requestrrrrr" rcCrrh)rload_der_ocsp_responserrrrr&rr)'rHr0r6Z cryptographyrrZ"cryptography.hazmat.bindings._rustrZcryptography.hazmat.primitivesrrZ/cryptography.hazmat.primitives.asymmetric.typesrZcryptography.x509.baserr r Enumr rSHA1SHA224SHA256SHA384SHA512rr5r!r"r%ABCMetar8rPrWrfrxrJrrrrrrs8      F&;2~