o b9@s:ddlZddlZddlZddlmZddlmZddlmZddlm Z m Z ddl m Z m Z mZmZGdddejZGd d d ejZe je je je je jfZd d ZGd ddejZGdddeZGdddejdZGdddejdZGdddeZ GdddeZ!de"defddZ#de"defddZ$dS) N)utils)x509)ocsp)hashes serialization)PRIVATE_KEY_TYPES_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc@seZdZdZdZdS)OCSPResponderEncodingzBy HashzBy NameN)__name__ __module__ __qualname__HASHNAMErrU/var/www/secure340b-portal/env/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)OCSPResponseStatusrN) r r r SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIRED UNAUTHORIZEDrrrrrsrcCst|ts tddS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512) isinstance_ALLOWED_HASHES ValueError) algorithmrrr_verify_algorithm-s r c@seZdZdZdZdZdS)OCSPCertStatusrrrN)r r rZGOODREVOKEDUNKNOWNrrrrr!4sr!c@seZdZddZdS)_SingleResponsec Cst|tjr t|tjstdt|t|tjstd|dur,t|tjs,td||_||_||_||_ ||_ t|t sDtd|t j urZ|durQt d|durYt dn$t|tjsdtdt|}|tkrpt d|dur~t|tjs~td ||_||_||_dS) N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)rr Certificate TypeErrorr datetimeZ_certZ_issuer _algorithmZ _this_updateZ _next_updater!r"rr r ReasonFlagsZ _cert_statusZ_revocation_timeZ_revocation_reason) selfcertissuerr cert_status this_update next_updaterevocation_timerevocation_reasonrrr__init__;s\        z_SingleResponse.__init__N)r r rr3rrrrr$:s r$c@seZdZejdefddZejdefddZejdej fddZ ejde fdd Z ej d ejdefd d Zejdejfd dZdS) OCSPRequestreturncCdSz3 The hash of the issuer public key Nrr+rrrissuer_key_hashzOCSPRequest.issuer_key_hashcCr6z- The hash of the issuer name Nrr8rrrissuer_name_hashr:zOCSPRequest.issuer_name_hashcCr6zK The hash algorithm used in the issuer name and key hashes Nrr8rrrhash_algorithmr:zOCSPRequest.hash_algorithmcCr6zM The serial number of the cert whose status is being checked Nrr8rrr serial_numberr:zOCSPRequest.serial_numberencodingcCr6)z/ Serializes the request to DER Nrr+rArrr public_bytesr:zOCSPRequest.public_bytescCr6)zP The list of request extensions. Not single request extensions. Nrr8rrr extensionsr:zOCSPRequest.extensionsN)r r rabcabstractpropertybytesr9r<r HashAlgorithmr>intr@abstractmethodrEncodingrCr ExtensionsrDrrrrr4sr4) metaclassc@seZdZejdefddZejdejfddZ ejde j e j fddZejdefdd Zejdefd d Zejde jejfd d Zejde j efddZejde j ejfddZejdejfddZejdefddZejde j ejfddZejde j ejfddZejdejfddZejde j ejfddZ ejdefddZ!ejdefd d!Z"ejde j fd"d#Z#ejde$fd$d%Z%ejdej&fd&d'Z'ejdej&fd(d)Z(ej)d*e*j+defd+d,Z,d-S). OCSPResponser5cCr6)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nrr8rrrresponse_statusr:zOCSPResponse.response_statuscCr6)zA The ObjectIdentifier of the signature algorithm Nrr8rrrsignature_algorithm_oidr:z$OCSPResponse.signature_algorithm_oidcCr6)zX Returns a HashAlgorithm corresponding to the type of the digest signed Nrr8rrrsignature_hash_algorithmr:z%OCSPResponse.signature_hash_algorithmcCr6)z% The signature bytes Nrr8rrr signaturer:zOCSPResponse.signaturecCr6)z+ The tbsResponseData bytes Nrr8rrrtbs_response_bytesr:zOCSPResponse.tbs_response_bytescCr6)z A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nrr8rrr certificatesr:zOCSPResponse.certificatescCr6)z2 The responder's key hash or None Nrr8rrrresponder_key_hashr:zOCSPResponse.responder_key_hashcCr6)z. The responder's Name or None Nrr8rrrresponder_namer:zOCSPResponse.responder_namecCr6)z4 The time the response was produced Nrr8rrr produced_atr:zOCSPResponse.produced_atcCr6)zY The status of the certificate (an element from the OCSPCertStatus enum) Nrr8rrrcertificate_statusr:zOCSPResponse.certificate_statuscCr6)z^ The date of when the certificate was revoked or None if not revoked. Nrr8rrrr1r:zOCSPResponse.revocation_timecCr6)zi The reason the certificate was revoked or None if not specified or not revoked. Nrr8rrrr2r:zOCSPResponse.revocation_reasoncCr6)z The most recent time at which the status being indicated is known by the responder to have been correct Nrr8rrrr/r:zOCSPResponse.this_updatecCr6)zC The time when newer information will be available Nrr8rrrr0r:zOCSPResponse.next_updatecCr6r7rr8rrrr9r:zOCSPResponse.issuer_key_hashcCr6r;rr8rrrr< r:zOCSPResponse.issuer_name_hashcCr6r=rr8rrrr>r:zOCSPResponse.hash_algorithmcCr6r?rr8rrrr@r:zOCSPResponse.serial_numbercCr6)zR The list of response extensions. Not single response extensions. Nrr8rrrrDr:zOCSPResponse.extensionscCr6)zR The list of single response extensions. Not response extensions. Nrr8rrrsingle_extensions!r:zOCSPResponse.single_extensionsrAcCr6)z0 Serializes the response to DER NrrBrrrrC'r:zOCSPResponse.public_bytesN)-r r rrErFrrOrZObjectIdentifierrPtypingOptionalrrHrQrGrRrSListr&rTrUNamerVr(rWr!rXr1r*r2r/r0r9r<r>rIr@rLrDrYrJrrKrCrrrrrNsZ  rNc@seZdZdgfdejejejejej fdej ej ej ddfddZ dejdejd ej ddfd d Zd ej d eddfddZdefddZdS)OCSPRequestBuilderNrequestrDr5cCs||_||_dSN)_request _extensions)r+r_rDrrrr3/s zOCSPRequestBuilder.__init__r,r-rcCsL|jdur tdt|t|tjrt|tjstdt|||f|jS)Nz.Only one certificate can be added to a requestr%) rarr rrr&r'r^rb)r+r,r-rrrradd_certificate;s z"OCSPRequestBuilder.add_certificateextvalcriticalcCsDt|tjs tdt|j||}t||jt|j |j|gSNz"extension must be an ExtensionType) rr ExtensionTyper' Extensionoidr rbr^rar+rdre extensionrrr add_extensionLs  z OCSPRequestBuilder.add_extensioncCs(ddlm}|jdurtd||S)Nrbackendz*You must add a certificate before building),cryptography.hazmat.backends.openssl.backendrnrarZcreate_ocsp_request)r+rnrrrbuildYs   zOCSPRequestBuilder.build)r r rrZr[Tuplerr&rrHr\rhrgr3rcboolrlr4rprrrrr^.s>     r^c@s0eZdZdddgfdejedejejeje fdejej ejdej ej ej fddZ dejd ejd ejd ed ejd ejejdejejdejejddfddZde dejddfddZdejejddfddZdej deddfddZded ejejdefddZed edefd!d"ZdS)#OCSPResponseBuilderNresponse responder_idcertsrDcCs||_||_||_||_dSr`) _response _responder_id_certsrb)r+rtrurvrDrrrr3cs  zOCSPResponseBuilder.__init__r,r-rr.r/r0r1r2r5c Cs<|jdur tdt||||||||} t| |j|j|jS)Nz#Only one response per OCSPResponse.)rwrr$rsrxryrb) r+r,r-rr.r/r0r1r2Z singleresprrr add_responseqs$  z OCSPResponseBuilder.add_responserAresponder_certcCsP|jdur tdt|tjstdt|tstdt|j||f|j |j S)Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) rxrrrr&r'r rsrwryrb)r+rAr{rrrrus   z OCSPResponseBuilder.responder_idcCs\|jdur tdt|}t|dkrtdtdd|Ds$tdt|j|j||j S)Nz!certificates may only be set oncerzcerts must not be an empty listcss|] }t|tjVqdSr`)rrr&).0xrrr sz3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates) ryrlistlenallr'rsrwrxrb)r+rvrrrrTs  z OCSPResponseBuilder.certificatesrdrecCsLt|tjs tdt|j||}t||jt|j |j |j |j|gSrf) rrrgr'rhrir rbrsrwrxryrjrrrrls   z!OCSPResponseBuilder.add_extension private_keycCsBddlm}|jdurtd|jdurtd|tj|||S)Nrrmz&You must add a response before signingz*You must add a responder_id before signing)rornrwrrxcreate_ocsp_responserr)r+rrrnrrrsigns    zOCSPResponseBuilder.signrOcCs@ddlm}t|tstd|tjurtd||dddS)Nrrmz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)rornrrr'rrr)clsrOrnrrrbuild_unsuccessfuls   z&OCSPResponseBuilder.build_unsuccessful)r r rrZr[r$rqrr&r r\rhrgr3rrHr!r(r*rzruIterablerTrrrlrrNr classmethodrrrrrrrsbs           rsdatar5cC t|Sr`)rload_der_ocsp_requestrrrrr rcCrr`)rload_der_ocsp_responserrrrrrr)%rEr(rZZ cryptographyrrZ"cryptography.hazmat.bindings._rustrZcryptography.hazmat.primitivesrrZcryptography.x509.baserrr r Enumr rSHA1SHA224SHA256SHA384SHA512rr r!objectr$ABCMetar4rNr^rsrGrrrrrrs6     F& 4