3 deQH@sNddlZddlZddlZddlmZmZddlmZddlm Z m Z ddl m Z ddl mZmZmZGdddejZGd d d ejZe je je je je jfZe jdd d d ZGdddejZGdddZGdddejdZGdddejdZ GdddejdZ!GdddZ"GdddZ#e$edddZ%e$e!dd d!Z&dS)"N)utilsx509)ocsp)hashes serialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc@seZdZdZdZdS)OCSPResponderEncodingzBy HashzBy NameN)__name__ __module__ __qualname__HASHNAMErrM/var/www/agendate/envp3/lib/python3.6/site-packages/cryptography/x509/ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)OCSPResponseStatusrN) r r r SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIRED UNAUTHORIZEDrrrrrs r) algorithmreturncCst|tstddS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512) isinstance_ALLOWED_HASHES ValueError)rrrr_verify_algorithm.s r!c@seZdZdZdZdZdS)OCSPCertStatusrrrN)r r rZGOODREVOKEDUNKNOWNrrrrr"5sr"c @sHeZdZejejejeeje j eje j eje j ej dddZ dS)_SingleResponse)certissuerr cert_status this_update next_updaterevocation_timerevocation_reasonc Cst|tj st|tj r$tdt|t|tjs@td|dk r^t|tj r^td||_||_||_||_ ||_ t|t std|t j k r|dk rt d|dk rt dnNt|tjstdt|}|tkrt d|dk rt|tj rtd ||_||_||_dS) Nz%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)rr Certificate TypeErrorr!datetimeZ_certZ_issuer _algorithmZ _this_updateZ _next_updater"r#r r r ReasonFlagsZ _cert_statusZ_revocation_timeZ_revocation_reason) selfr&r'rr(r)r*r+r,rrr__init__<sJ         z_SingleResponse.__init__N) r r rrr-r HashAlgorithmr"r/typingOptionalr1r3rrrrr%;s  r%c@seZdZeejedddZeejedddZeeje j dddZ eeje ddd Z ejejed d d Zeejejdd dZdS) OCSPRequest)rcCsdS)z3 The hash of the issuer public key Nr)r2rrrissuer_key_hashszOCSPRequest.issuer_key_hashcCsdS)z- The hash of the issuer name Nr)r2rrrissuer_name_hashszOCSPRequest.issuer_name_hashcCsdS)zK The hash algorithm used in the issuer name and key hashes Nr)r2rrrhash_algorithmszOCSPRequest.hash_algorithmcCsdS)zM The serial number of the cert whose status is being checked Nr)r2rrr serial_numberszOCSPRequest.serial_number)encodingrcCsdS)z/ Serializes the request to DER Nr)r2r<rrr public_bytesszOCSPRequest.public_bytescCsdS)zP The list of request extensions. Not single request extensions. Nr)r2rrr extensionsszOCSPRequest.extensionsN)r r rpropertyabcabstractmethodbytesr8r9rr4r:intr;rEncodingr=r Extensionsr>rrrrr7s"r7) metaclassc@seZdZeejedddZeejej e j dddZ eejej e j dddZeeje j ddd Zeejej e j dd d Zeejedd d ZeejedddZeejejdddZeejedddZdS)OCSPSingleResponse)rcCsdS)zY The status of the certificate (an element from the OCSPCertStatus enum) Nr)r2rrrcertificate_statussz%OCSPSingleResponse.certificate_statuscCsdS)z^ The date of when the certificate was revoked or None if not revoked. Nr)r2rrrr+sz"OCSPSingleResponse.revocation_timecCsdS)zi The reason the certificate was revoked or None if not specified or not revoked. Nr)r2rrrr,sz$OCSPSingleResponse.revocation_reasoncCsdS)z The most recent time at which the status being indicated is known by the responder to have been correct Nr)r2rrrr)szOCSPSingleResponse.this_updatecCsdS)zC The time when newer information will be available Nr)r2rrrr*szOCSPSingleResponse.next_updatecCsdS)z3 The hash of the issuer public key Nr)r2rrrr8sz"OCSPSingleResponse.issuer_key_hashcCsdS)z- The hash of the issuer name Nr)r2rrrr9sz#OCSPSingleResponse.issuer_name_hashcCsdS)zK The hash algorithm used in the issuer name and key hashes Nr)r2rrrr:sz!OCSPSingleResponse.hash_algorithmcCsdS)zM The serial number of the cert whose status is being checked Nr)r2rrrr;sz OCSPSingleResponse.serial_numberN)r r rr?r@rAr"rHr5r6r/r+rr1r,r)r*rBr8r9rr4r:rCr;rrrrrGs6rGc@sdeZdZeejejedddZ eeje dddZ eeje j dddZeejejejddd Zeejedd d Zeejedd d Zeejeje jdddZeejejedddZeejeje jdddZeejejdddZeejedddZeejejejdddZ eejeje j!dddZ"eejejdddZ#eejejejdddZ$eejedd d!Z%eejedd"d#Z&eejejdd$d%Z'eeje(dd&d'Z)eeje j*dd(d)Z+eeje j*dd*d+Z,eje-j.ed,d-d.Z/d/S)0 OCSPResponse)rcCsdS)z_ An iterator over the individual SINGLERESP structures in the response Nr)r2rrr responsesszOCSPResponse.responsescCsdS)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nr)r2rrrresponse_statusszOCSPResponse.response_statuscCsdS)zA The ObjectIdentifier of the signature algorithm Nr)r2rrrsignature_algorithm_oidsz$OCSPResponse.signature_algorithm_oidcCsdS)zX Returns a HashAlgorithm corresponding to the type of the digest signed Nr)r2rrrsignature_hash_algorithmsz%OCSPResponse.signature_hash_algorithmcCsdS)z% The signature bytes Nr)r2rrr signatureszOCSPResponse.signaturecCsdS)z+ The tbsResponseData bytes Nr)r2rrrtbs_response_bytesszOCSPResponse.tbs_response_bytescCsdS)z A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nr)r2rrr certificatesszOCSPResponse.certificatescCsdS)z2 The responder's key hash or None Nr)r2rrrresponder_key_hash(szOCSPResponse.responder_key_hashcCsdS)z. The responder's Name or None Nr)r2rrrresponder_name/szOCSPResponse.responder_namecCsdS)z4 The time the response was produced Nr)r2rrr produced_at6szOCSPResponse.produced_atcCsdS)zY The status of the certificate (an element from the OCSPCertStatus enum) Nr)r2rrrrH=szOCSPResponse.certificate_statuscCsdS)z^ The date of when the certificate was revoked or None if not revoked. Nr)r2rrrr+DszOCSPResponse.revocation_timecCsdS)zi The reason the certificate was revoked or None if not specified or not revoked. Nr)r2rrrr,LszOCSPResponse.revocation_reasoncCsdS)z The most recent time at which the status being indicated is known by the responder to have been correct Nr)r2rrrr)TszOCSPResponse.this_updatecCsdS)zC The time when newer information will be available Nr)r2rrrr*\szOCSPResponse.next_updatecCsdS)z3 The hash of the issuer public key Nr)r2rrrr8cszOCSPResponse.issuer_key_hashcCsdS)z- The hash of the issuer name Nr)r2rrrr9jszOCSPResponse.issuer_name_hashcCsdS)zK The hash algorithm used in the issuer name and key hashes Nr)r2rrrr:qszOCSPResponse.hash_algorithmcCsdS)zM The serial number of the cert whose status is being checked Nr)r2rrrr;xszOCSPResponse.serial_numbercCsdS)zR The list of response extensions. Not single response extensions. Nr)r2rrrr>szOCSPResponse.extensionscCsdS)zR The list of single response extensions. Not response extensions. Nr)r2rrrsingle_extensionsszOCSPResponse.single_extensions)r<rcCsdS)z0 Serializes the response to DER Nr)r2r<rrrr=szOCSPResponse.public_bytesN)0r r rr?r@rAr5IteratorrGrJrrKrZObjectIdentifierrLr6rr4rMrBrNrOListr-rPrQNamerRr/rSr"rHr+r1r,r)r*r8r9r:rCr;rEr>rTrrDr=rrrrrIsrIc@seZdZddgfejejejejej fejeje e e ej fej ej ejddddZejejej ddddZe e e ej ddd d Zejedd d d ZedddZdS)OCSPRequestBuilderN)request request_hashr>rcCs||_||_||_dS)N)_request _request_hash _extensions)r2rYrZr>rrrr3s zOCSPRequestBuilder.__init__)r&r'rrcCs^|jdk s|jdk rtdt|t|tj s@t|tj rHtdt|||f|j|j S)Nz.Only one certificate can be added to a requestz%cert and issuer must be a Certificate) r[r\r r!rrr-r.rXr])r2r&r'rrrradd_certificates z"OCSPRequestBuilder.add_certificate)r9r8r;rrcCs|jdk s|jdk rtdt|ts.tdt|tjd|tjd||j t |ksj|j t |krrtdt |j||||f|j S)Nz.Only one certificate can be added to a requestz serial_number must be an integerr9r8z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm) r[r\r rrCr.r!r _check_bytes digest_sizelenrXr])r2r9r8r;rrrradd_certificate_by_hashs     z*OCSPRequestBuilder.add_certificate_by_hash)extvalcriticalrcCsHt|tjstdtj|j||}t||jt|j |j |j|gS)Nz"extension must be an ExtensionType) rr ExtensionTyper. Extensionoidr r]rXr[r\)r2rcrd extensionrrr add_extensions   z OCSPRequestBuilder.add_extension)rcCs&|jdkr|jdkrtdtj|S)Nz*You must add a certificate before building)r[r\r rZcreate_ocsp_request)r2rrrbuildszOCSPRequestBuilder.build)r r rr5r6Tuplerr-rr4rBrCrVrfrer3r^rbboolrir7rjrrrrrXs F rXc @s eZdZdddgfejeejejeje fejej ejej ej ej dddZ ejejejeejejejejejejejdd ddZe ejddd d Zejejdd d d Zej eddddZeejejedddZeeedddZdS)OCSPResponseBuilderN)response responder_idcertsr>cCs||_||_||_||_dS)N) _response _responder_id_certsr])r2rnrorpr>rrrr3s zOCSPResponseBuilder.__init__) r&r'rr(r)r*r+r,rc Cs<|jdk rtdt||||||||} t| |j|j|jS)Nz#Only one response per OCSPResponse.)rqr r%rmrrrsr]) r2r&r'rr(r)r*r+r,Z singleresprrr add_responses z OCSPResponseBuilder.add_response)r<responder_certrcCsP|jdk rtdt|tjs&tdt|ts8tdt|j||f|j |j S)Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) rrr rrr-r.r rmrqrsr])r2r<rurrrros   z OCSPResponseBuilder.responder_id)rprcCs\|jdk rtdt|}t|dkr.tdtdd|DsHtdt|j|j||j S)Nz!certificates may only be set oncerzcerts must not be an empty listcss|]}t|tjVqdS)N)rrr-).0xrrr 3sz3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates) rsr listraallr.rmrqrrr])r2rprrrrP+s  z OCSPResponseBuilder.certificates)rcrdrcCsLt|tjstdtj|j||}t||jt|j |j |j |j|gS)Nz"extension must be an ExtensionType) rrrer.rfrgr r]rmrqrrrs)r2rcrdrhrrrri<s  z!OCSPResponseBuilder.add_extension) private_keyrrcCs6|jdkrtd|jdkr$tdtjtj|||S)Nz&You must add a response before signingz*You must add a responder_id before signing)rqr rrrcreate_ocsp_responserr)r2r{rrrrsignLs   zOCSPResponseBuilder.sign)rKrcCs4t|tstd|tjkr$tdtj|dddS)Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)rrr.rr rr|)clsrKrrrbuild_unsuccessfulZs   z&OCSPResponseBuilder.build_unsuccessful)r r rr5r6r%rkrr-r rVrfrer3rr4r"r/r1rtroIterablerPrlrirrIr} classmethodrrrrrrrms2L       rm)datarcCs tj|S)N)rload_der_ocsp_request)rrrrrhsrcCs tj|S)N)rload_der_ocsp_response)rrrrrlsr)'r@r/r5Z cryptographyrrZ"cryptography.hazmat.bindings._rustrZcryptography.hazmat.primitivesrrZ/cryptography.hazmat.primitives.asymmetric.typesrZcryptography.x509.baserr r Enumr rSHA1SHA224SHA256SHA384SHA512rr4r!r"r%ABCMetar7rGrIrXrmrBrrrrrrs2   F+D%V~