File: //snap/core20/2669/usr/lib/python3/dist-packages/cryptography/x509/__pycache__/ocsp.cpython-38.pyc
U
�e�]�3 � @ s� d dl mZmZmZ d dlZd dlZd dlmZ d dlZd dl m
Z
d dl m Z d dl
mZmZ d dlmZmZmZ e �� e �� e �� e �� e �� d�ZG d d
� d
e�ZG d d � d e�Ze d
d� eD ��Z e je je je je jfZ dd� Z G dd� de�Z e dd� e D ��Z!dd� Z"dd� Z#G dd� de$�Z%G dd� de$�Z&G d d � d e$�Z'e�(ej)�G d d � d e$��Z*e�(ej)�G d d!� d!e$��Z+dS )"� )�absolute_import�division�print_functionN)�Enum)�x509)�hashes)�ed25519�ed448)�_EARLIEST_UTC_TIME�_convert_to_naive_utc_time�_reject_duplicate_extension)z
1.3.14.3.2.26z2.16.840.1.101.3.4.2.4z2.16.840.1.101.3.4.2.1z2.16.840.1.101.3.4.2.2z2.16.840.1.101.3.4.2.3c @ s e Zd ZdZdZdS )�OCSPResponderEncodingzBy HashzBy NameN)�__name__�
__module__� __qualname__ZHASH�NAME� r r �8/usr/lib/python3/dist-packages/cryptography/x509/ocsp.pyr
s r
c @ s$ e Zd ZdZdZdZdZdZdZdS )�OCSPResponseStatusr � � � � � N) r r r �
SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIREDZ UNAUTHORIZEDr r r r r # s r c c s | ]}|j |fV qd S �N��value��.0�xr r r � <genexpr>, s r! c C s t | t�std��d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)�
isinstance�_ALLOWED_HASHES�
ValueError)� algorithmr r r �_verify_algorithm3 s
�r& c @ s e Zd ZdZdZdZdS )�OCSPCertStatusr r r N)r r r ZGOOD�REVOKEDZUNKNOWNr r r r r' : s r' c c s | ]}|j |fV qd S r r r r r r r! @ s c C s ddl m} |�| �S �Nr ��backend)�,cryptography.hazmat.backends.openssl.backendr+ �load_der_ocsp_request��datar+ r r r r- C s r- c C s ddl m} |�| �S r) )r, r+ �load_der_ocsp_responser. r r r r0 H s r0 c @ s2 e Zd Zdg fdd�Zdd� Zdd� Zdd � ZdS )
�OCSPRequestBuilderNc C s || _ || _d S r )�_request� _extensions)�selfZrequest�
extensionsr r r �__init__N s zOCSPRequestBuilder.__init__c C sL | j d k rtd��t|� t|tj�r2t|tj�s:td��t|||f| j�S )Nz.Only one certificate can be added to a request�%cert and issuer must be a Certificate) r2 r$ r& r" r � Certificate� TypeErrorr1 r3 )r4 �cert�issuerr% r r r �add_certificateR s
�
�z"OCSPRequestBuilder.add_certificatec C sD t |tj�std��t�|j||�}t|| j� t| j | j|g �S �Nz"extension must be an ExtensionType)
r" r �
ExtensionTyper9 � Extension�oidr r3 r1 r2 �r4 � extensionZcriticalr r r �
add_extension_ s
�z OCSPRequestBuilder.add_extensionc C s( ddl m} | jd kr td��|�| �S )Nr r* z*You must add a certificate before building)r, r+ r2 r$ Zcreate_ocsp_request)r4 r+ r r r �buildj s
zOCSPRequestBuilder.build)r r r r6 r< rC rD r r r r r1 M s
r1 c @ s e Zd Zdd� ZdS )�_SingleResponsec C s t |tj�rt |tj�s td��t|� t |tj�s<td��|d k rXt |tj�sXtd��|| _|| _|| _|| _ || _
t |t �s�td��|t j k r�|d k r�t
d��|d k r�t
d��nHt |tj�s�td��t|�}|tk r�t
d��|d k r�t |tj�s�td ��|| _|| _|| _d S )
Nr7 z%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r" r r8 r9 r& �datetimeZ_certZ_issuerZ
_algorithmZ _this_updateZ _next_updater' r( r$ r r
Z ReasonFlagsZ _cert_statusZ_revocation_timeZ_revocation_reason) r4 r: r; r% � cert_status� this_update� next_update�revocation_time�revocation_reasonr r r r6 s s\
�
� �
�
�
�� �
��z_SingleResponse.__init__N)r r r r6 r r r r rE r s rE c @ sR e Zd Zdddg fdd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Ze dd� �Z
dS )�OCSPResponseBuilderNc C s || _ || _|| _|| _d S r )� _response�
_responder_id�_certsr3 )r4 Zresponse� responder_id�certsr5 r r r r6 � s z OCSPResponseBuilder.__init__c
C s< | j d k rtd��t||||||||�} t| | j| j| j�S )Nz#Only one response per OCSPResponse.)rM r$ rE rL rN rO r3 )
r4 r: r; r% rG rH rI rJ rK Z
singlerespr r r � add_response� s$
� �z OCSPResponseBuilder.add_responsec C sP | j d k rtd��t|tj�s&td��t|t�s8td��t| j||f| j | j
�S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) rN r$ r" r r8 r9 r
rL rM rO r3 )r4 �encodingZresponder_certr r r rP � s
� �z OCSPResponseBuilder.responder_idc C s\ | j d k rtd��t|�}t|�dkr.td��tdd� |D ��sHtd��t| j| j|| j �S )Nz!certificates may only be set oncer z certs must not be an empty listc s s | ]}t |tj�V qd S r )r" r r8 r r r r r! � s z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rO r$ �list�len�allr9 rL rM rN r3 )r4 rQ r r r � certificates� s
�z OCSPResponseBuilder.certificatesc C sL t |tj�std��t�|j||�}t|| j� t| j | j
| j | j|g �S r= ) r" r r> r9 r? r@ r r3 rL rM rN rO rA r r r rC � s
�z!OCSPResponseBuilder.add_extensionc C sz ddl m} | jd kr td��| jd kr0td��t|tjtj f�rT|d k rhtd��nt|t
j �sht d��|�
tj| ||�S )Nr r* z&You must add a response before signingz*You must add a responder_id before signingz8algorithm must be None when signing via ed25519 or ed448z.Algorithm must be a registered hash algorithm.)r, r+ rM r$ rN r" r ZEd25519PrivateKeyr ZEd448PrivateKeyr Z
HashAlgorithmr9 �create_ocsp_responser r )r4 Z private_keyr% r+ r r r �sign� s(
�� �zOCSPResponseBuilder.signc C s@ ddl m} t|t�s td��|tjkr0td��|�|d d d �S )Nr r* z7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r, r+ r" r r9 r r$ rX )�cls�response_statusr+ r r r �build_unsuccessful s
�
z&OCSPResponseBuilder.build_unsuccessful) r r r r6 rR rP rW rC rY � classmethodr\ r r r r rL � s �
rL c @ s` e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zej d d
� �Z
ejd d � �Z d
S )� OCSPRequestc C s dS �z3
The hash of the issuer public key
Nr �r4 r r r �issuer_key_hash s zOCSPRequest.issuer_key_hashc C s dS �z-
The hash of the issuer name
Nr r` r r r �issuer_name_hash s z OCSPRequest.issuer_name_hashc C s dS �zK
The hash algorithm used in the issuer name and key hashes
Nr r` r r r �hash_algorithm s zOCSPRequest.hash_algorithmc C s dS �zM
The serial number of the cert whose status is being checked
Nr r` r r r �
serial_number# s zOCSPRequest.serial_numberc C s dS )z/
Serializes the request to DER
Nr )r4 rS r r r � public_bytes( s zOCSPRequest.public_bytesc C s dS )zP
The list of request extensions. Not single request extensions.
Nr r` r r r r5 . s zOCSPRequest.extensionsN) r r r �abc�abstractpropertyra rc re rg �abstractmethodrh r5 r r r r r^ s
r^ c @ s e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zejd d
� �Z ejd d � �Z
ejd
d� �Z ejdd� �Z ejdd� �Z
ejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd � �Zejd d � �Zejd d � �Zejd!d"� �Zejd#d$� �Zejd%d&� �Zd'S )(� OCSPResponsec C s dS )zm
The status of the response. This is a value from the OCSPResponseStatus
enumeration
Nr r` r r r r[ 7 s z OCSPResponse.response_statusc C s dS )zA
The ObjectIdentifier of the signature algorithm
Nr r` r r r �signature_algorithm_oid> s z$OCSPResponse.signature_algorithm_oidc C s dS )zX
Returns a HashAlgorithm corresponding to the type of the digest signed
Nr r` r r r �signature_hash_algorithmD s z%OCSPResponse.signature_hash_algorithmc C s dS )z%
The signature bytes
Nr r` r r r � signatureJ s zOCSPResponse.signaturec C s dS )z+
The tbsResponseData bytes
Nr r` r r r �tbs_response_bytesP s z OCSPResponse.tbs_response_bytesc C s dS )z�
A list of certificates used to help build a chain to verify the OCSP
response. This situation occurs when the OCSP responder uses a delegate
certificate.
Nr r` r r r rW V s zOCSPResponse.certificatesc C s dS )z2
The responder's key hash or None
Nr r` r r r �responder_key_hash^ s z OCSPResponse.responder_key_hashc C s dS )z.
The responder's Name or None
Nr r` r r r �responder_named s zOCSPResponse.responder_namec C s dS )z4
The time the response was produced
Nr r` r r r � produced_atj s zOCSPResponse.produced_atc C s dS )zY
The status of the certificate (an element from the OCSPCertStatus enum)
Nr r` r r r �certificate_statusp s z OCSPResponse.certificate_statusc C s dS )z^
The date of when the certificate was revoked or None if not
revoked.
Nr r` r r r rJ v s z OCSPResponse.revocation_timec C s dS )zi
The reason the certificate was revoked or None if not specified or
not revoked.
Nr r` r r r rK } s z OCSPResponse.revocation_reasonc C s dS )z�
The most recent time at which the status being indicated is known by
the responder to have been correct
Nr r` r r r rH � s zOCSPResponse.this_updatec C s dS )zC
The time when newer information will be available
Nr r` r r r rI � s zOCSPResponse.next_updatec C s dS r_ r r` r r r ra � s z OCSPResponse.issuer_key_hashc C s dS rb r r` r r r rc � s z OCSPResponse.issuer_name_hashc C s dS rd r r` r r r re � s zOCSPResponse.hash_algorithmc C s dS rf r r` r r r rg � s zOCSPResponse.serial_numberc C s dS )zR
The list of response extensions. Not single response extensions.
Nr r` r r r r5 � s zOCSPResponse.extensionsN)r r r ri rj r[ rm rn ro rp rW rq rr rs rt rJ rK rH rI ra rc re rg r5 r r r r rl 5 sL
rl ),Z
__future__r r r ri rF �enumr ZsixZ cryptographyr Z cryptography.hazmat.primitivesr Z)cryptography.hazmat.primitives.asymmetricr r Zcryptography.x509.baser
r r ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512Z
_OIDS_TO_HASHr
r �dictZ_RESPONSE_STATUS_TO_ENUMr# r& r' Z_CERT_STATUS_TO_ENUMr- r0 �objectr1 rE rL Z
add_metaclass�ABCMetar^ rl r r r r �<module> sF � �%>_
%