CasperSecurity
o
�R�i�9 � @ sn d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZmZ d dl m
Z
m Z m Z m
Z
e�� e�� e�� e�� e�� d�ZG dd� dej�ZG d d
� d
ej�Zd d � eD �ZejejejejejfZd
d� ZG dd� dej�Zdd � eD �ZG dd� de �Z G dd� de j d�Z G dd� de j d�Z G dd� de �Z!G dd � d e �Z"d e#d e fd d �Z$d e#d e fd!d"�Z%dS )#� N)�utils)�x509)�hashes�
serialization)�_EARLIEST_UTC_TIME�_PRIVATE_KEY_TYPES�_convert_to_naive_utc_time�_reject_duplicate_extension)z
1.3.14.3.2.26z2.16.840.1.101.3.4.2.4z2.16.840.1.101.3.4.2.1z2.16.840.1.101.3.4.2.2z2.16.840.1.101.3.4.2.3c @ s e Zd ZdZdZdS )�OCSPResponderEncodingzBy HashzBy NameN)�__name__�
__module__� __qualname__�HASH�NAME� r r �8/usr/lib/python3/dist-packages/cryptography/x509/ocsp.pyr
s r
c @ s$ e Zd ZdZdZdZdZdZdZdS )�OCSPResponseStatusr � � � � � N) r r r
�
SUCCESSFUL�MALFORMED_REQUEST�INTERNAL_ERROR� TRY_LATER� SIG_REQUIRED� UNAUTHORIZEDr r r r r # s r c C � i | ]}|j |�qS r ��value��.0�xr r r �
<dictcomp>, � r$ c C s t | t�s td��d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)�
isinstance�_ALLOWED_HASHES�
ValueError)� algorithmr r r �_verify_algorithm6 s
��r* c @ s e Zd ZdZdZdZdS )�OCSPCertStatusr r r N)r r r
�GOOD�REVOKED�UNKNOWNr r r r r+ = s r+ c C r r r r! r r r r$ C r% c @ s e Zd Zdd� ZdS )�_SingleResponsec C s t |tj�r t |tj�std��t|� t |tj�s td��|d ur,t |tj�s,td��|| _|| _|| _|| _ || _
t |t �sDtd��|t j urZ|d urQt
d��|d urYt
d��n$t |tj�sdtd��t|�}|tk rpt
d��|d ur~t |tj�s~td ��|| _|| _|| _d S )
N�%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r& r � Certificate� TypeErrorr* �datetime�_cert�_issuer�
_algorithm� _this_update� _next_updater+ r- r( r r � ReasonFlags� _cert_status�_revocation_time�_revocation_reason) �self�cert�issuerr) � cert_status� this_update� next_update�revocation_time�revocation_reasonr r r �__init__G s\ �
�
�
��� �
��
z_SingleResponse.__init__N)r r r
rE r r r r r/ F s r/ c @ s� e Zd Zejdefdd��Zejdefdd��Zejdej fdd��Z
ejde fdd ��Z ej
d
ejdefd d ��Zejdejfd
d��ZdS )� OCSPRequest�returnc C � dS �z3
The hash of the issuer public key
Nr �r= r r r �issuer_key_hash� � zOCSPRequest.issuer_key_hashc C rH �z-
The hash of the issuer name
Nr rJ r r r �issuer_name_hash� rL z OCSPRequest.issuer_name_hashc C rH �zK
The hash algorithm used in the issuer name and key hashes
Nr rJ r r r �hash_algorithm� rL zOCSPRequest.hash_algorithmc C rH �zM
The serial number of the cert whose status is being checked
Nr rJ r r r �
serial_number� rL zOCSPRequest.serial_number�encodingc C rH )z/
Serializes the request to DER
Nr �r= rS r r r � public_bytes� rL zOCSPRequest.public_bytesc C rH )zP
The list of request extensions. Not single request extensions.
Nr rJ r r r �
extensions� rL zOCSPRequest.extensionsN)r r r
�abc�abstractproperty�bytesrK rN r �
HashAlgorithmrP �intrR �abstractmethodr �EncodingrU r �
ExtensionsrV r r r r rF � s rF )� metaclassc @ s� e Zd Zejdefdd��Zejdejfdd��Z ejde
j e j
fdd��Zejdefdd ��Zejdefd
d ��Zejde
jej fd d
��Zejde
j e fdd��Zejde
j ej fdd��Zejdejfdd��Zejdefdd��Zejde
j ej fdd��Z ejde
j ej fdd��Z ejdejfdd��Z ejde
j ej fd d ��Z ejdefd d ��Z!ejdefd d!��Z"ejde j
fd"d#��Z#ejde$fd$d%��Z%ejdej&fd&d'��Z'ejdej&fd(d)��Z(ej)d*e*j+defd+d,��Z,d-S ).� OCSPResponserG c C rH )zm
The status of the response. This is a value from the OCSPResponseStatus
enumeration
Nr rJ r r r �response_status� rL z OCSPResponse.response_statusc C rH )zA
The ObjectIdentifier of the signature algorithm
Nr rJ r r r �signature_algorithm_oid� rL z$OCSPResponse.signature_algorithm_oidc C rH )zX
Returns a HashAlgorithm corresponding to the type of the digest signed
Nr rJ r r r �signature_hash_algorithm� rL z%OCSPResponse.signature_hash_algorithmc C rH )z%
The signature bytes
Nr rJ r r r � signature� rL zOCSPResponse.signaturec C rH )z+
The tbsResponseData bytes
Nr rJ r r r �tbs_response_bytes� rL z OCSPResponse.tbs_response_bytesc C rH )z�
A list of certificates used to help build a chain to verify the OCSP
response. This situation occurs when the OCSP responder uses a delegate
certificate.
Nr rJ r r r � certificates� rL zOCSPResponse.certificatesc C rH )z2
The responder's key hash or None
Nr rJ r r r �responder_key_hash� rL z OCSPResponse.responder_key_hashc C rH )z.
The responder's Name or None
Nr rJ r r r �responder_name� rL zOCSPResponse.responder_namec C rH )z4
The time the response was produced
Nr rJ r r r � produced_at� rL zOCSPResponse.produced_atc C rH )zY
The status of the certificate (an element from the OCSPCertStatus enum)
Nr rJ r r r �certificate_status� rL z OCSPResponse.certificate_statusc C rH )z^
The date of when the certificate was revoked or None if not
revoked.
Nr rJ r r r rC � rL z OCSPResponse.revocation_timec C rH )zi
The reason the certificate was revoked or None if not specified or
not revoked.
Nr rJ r r r rD � rL z OCSPResponse.revocation_reasonc C rH )z�
The most recent time at which the status being indicated is known by
the responder to have been correct
Nr rJ r r r rA rL zOCSPResponse.this_updatec C rH )zC
The time when newer information will be available
Nr rJ r r r rB rL zOCSPResponse.next_updatec C rH rI r rJ r r r rK rL z OCSPResponse.issuer_key_hashc C rH rM r rJ r r r rN rL z OCSPResponse.issuer_name_hashc C rH rO r rJ r r r rP rL zOCSPResponse.hash_algorithmc C rH rQ r rJ r r r rR ! rL zOCSPResponse.serial_numberc C rH )zR
The list of response extensions. Not single response extensions.
Nr rJ r r r rV ' rL zOCSPResponse.extensionsc C rH )zR
The list of single response extensions. Not response extensions.
Nr rJ r r r �single_extensions- rL z OCSPResponse.single_extensionsrS c C rH )z0
Serializes the response to DER
Nr rT r r r rU 3 rL zOCSPResponse.public_bytesN)-r r r
rW rX r ra r �ObjectIdentifierrb �typing�Optionalr rZ rc rY rd re �Listr1 rf rg �Namerh r3 ri r+ rj rC r9 rD rA rB rK rN rP r[ rR r^ rV rk r\ r r] rU r r r r r` � sZ
�r` c @ s` e Zd Zdg fdd�Zdejdejdejdd fdd �Zd
ej d e
dd fd d
�Z de fdd�Z
dS )�OCSPRequestBuilderNc C s || _ || _d S �N)�_request� _extensions)r= �requestrV r r r rE ; s
zOCSPRequestBuilder.__init__r> r? r) rG c C sL | j d ur td��t|� t|tj�rt|tj�s td��t|||f| j�S )Nz.Only one certificate can be added to a requestr0 ) rs r( r* r& r r1 r2 rq rt )r= r> r? r) r r r �add_certificate? s
�z"OCSPRequestBuilder.add_certificate�extval�criticalc C sD t |tj�s
td��t�|j||�}t|| j� t| j | j|g �S �Nz"extension must be an ExtensionType)
r& r �
ExtensionTyper2 � Extension�oidr rt rq rs �r= rw rx � extensionr r r �
add_extensionP s �z OCSPRequestBuilder.add_extensionc C s( ddl m} | jd u rtd��|�| �S )Nr ��backendz*You must add a certificate before building)�,cryptography.hazmat.backends.openssl.backendr� rs r( �create_ocsp_request)r= r� r r r �build] s
zOCSPRequestBuilder.build)r r r
rE r r1 r rZ rv rz �boolr rF r� r r r r rq : s& ���
���
�
rq c @ s� e Zd Zdddg fdd�Zdejdejdejdede j d e
j e j d
e
j e j d e
j ej d d fd
d�Z
dedejd d fdd�Zde
jej d d fdd�Zdejded d fdd�Zdede
j ej d efdd �Zed ed efd d ��ZdS ) �OCSPResponseBuilderNc C s || _ || _|| _|| _d S rr )� _response�
_responder_id�_certsrt )r= �response� responder_id�certsrV r r r rE g s
z OCSPResponseBuilder.__init__r> r? r) r@ rA rB rC rD rG c
C s< | j d ur td��t||||||||�} t| | j| j| j�S )Nz#Only one response per OCSPResponse.)r� r( r/ r� r� r� rt )
r= r> r? r) r@ rA rB rC rD �
singlerespr r r � add_responseo s$
�
�z OCSPResponseBuilder.add_responserS �responder_certc C sP | j d ur td��t|tj�std��t|t�s td��t| j||f| j | j
�S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) r� r( r& r r1 r2 r
r� r� r� rt )r= rS r� r r r r� � s
��z OCSPResponseBuilder.responder_idr� c C s\ | j d ur td��t|�}t|�dkrtd��tdd� |D ��s$td��t| j| j|| j �S )Nz!certificates may only be set oncer z certs must not be an empty listc s s � | ] }t |tj�V qd S rr )r& r r1 r! r r r � <genexpr>� s � z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r� r( �list�len�allr2 r� r� r� rt )r= r� r r r rf � s
�z OCSPResponseBuilder.certificatesrw rx c C sL t |tj�s
td��t�|j||�}t|| j� t| j | j
| j | j|g �S ry ) r& r rz r2 r{ r| r rt r� r� r� r� r} r r r r � s
�z!OCSPResponseBuilder.add_extension� private_keyc C sB ddl m} | jd u rtd��| jd u rtd��|�tj| ||�S )Nr r� z&You must add a response before signingz*You must add a responder_id before signing)r� r� r� r( r� �create_ocsp_responser r )r= r� r) r� r r r �sign� s
�zOCSPResponseBuilder.signra c C s@ ddl m} t|t�std��|tju rtd��|�|d d d �S )Nr r� z7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r� r� r& r r2 r r( r� )�clsra r� r r r �build_unsuccessful� s
�
z&OCSPResponseBuilder.build_unsuccessful)r r r
rE r r1 r rZ r+ r3 rm rn r9 r� r
r� �Iterablerf rz r� r r r` r� � classmethodr r� r r r r r� f sl
������
�
�
�
� ��
�
�
���
��
�
���r� �datarG c C � ddl m} |�| �S �Nr r� )r� r� �load_der_ocsp_request�r� r� r r r r� � �
r� c C r� r� )r� r� �load_der_ocsp_responser� r r r r� � r� r� )&rW r3 rm � cryptographyr r � cryptography.hazmat.primitivesr r �cryptography.x509.baser r r r �SHA1�SHA224�SHA256�SHA384�SHA512�
_OIDS_TO_HASH�Enumr
r �_RESPONSE_STATUS_TO_ENUMr' r* r+ �_CERT_STATUS_TO_ENUM�objectr/ �ABCMetarF r` rq r� rY r� r� r r r r �<module> sB � � F& ,|