a ‚oefHã@sXddlmZddlZddlZddlZddlmZmZddlm Z ddl m Z m Z ddl mZddlmZmZmZGdd „d ejƒZGd d „d ejƒZe je je je je jfZd d dœdd„ZGdd„dejƒZGdd„dƒZGdd„dejd�Z Gdd„dejd�Z!Gdd„dejd�Z"Gdd„dƒZ#Gdd„dƒZ$d dd!œd"d#„Z%d dd!œd$d%„Z&dS)&é)Ú annotationsN)ÚutilsÚx509)Úocsp)ÚhashesÚ serialization)Ú CertificateIssuerPrivateKeyTypes)Ú_EARLIEST_UTC_TIMEÚ_convert_to_naive_utc_timeÚ_reject_duplicate_extensionc@seZdZdZdZdS)ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú __module__Ú __qualname__ZHASHÚNAME©rrú7C:\Program Files\Certbot\pkgs\cryptography\x509\ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)ÚOCSPResponseStatusréééééN) r rrÚ SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIREDZ UNAUTHORIZEDrrrrrs rúhashes.HashAlgorithmÚNone)Ú algorithmÚreturncCst|tƒstdƒ‚dS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú isinstanceÚ_ALLOWED_HASHESÚ ValueError)rrrrÚ_verify_algorithm/s ÿr!c@seZdZdZdZdZdS)ÚOCSPCertStatusrrrN)r rrZGOODÚREVOKEDZUNKNOWNrrrrr"6sr"c @s(eZdZdddddddddœdd „Zd S) Ú_SingleResponseúx509.Certificaterr"údatetime.datetimeú"typing.Optional[datetime.datetime]ú!typing.Optional[x509.ReasonFlags])ÚcertÚissuerrÚ cert_statusÚ this_updateÚ next_updateÚrevocation_timeÚrevocation_reasonc Cst|tjƒrt|tjƒs tdƒ‚t|ƒt|tjƒsrr:rrrr?âsz!OCSPSingleResponse.hash_algorithmr@cCsdSrArr:rrrrBész OCSPSingleResponse.serial_numberN)r rrrJrKrLrPr.r/r,r-r;r=r?rBrrrrrN­s6rNc@seZdZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœd d „ƒƒZeejd dœd d „ƒƒZ eejddœdd„ƒƒZ eejddœdd„ƒƒZ eejddœdd„ƒƒZ eejddœdd„ƒƒZ eejddœdd„ƒƒZeejddœdd„ƒƒZeejddœd d!„ƒƒZeejd"dœd#d$„ƒƒZeejd%dœd&d'„ƒƒZeejddœd(d)„ƒƒZeejd"dœd*d+„ƒƒZeejddœd,d-„ƒƒZeejddœd.d/„ƒƒZeejd0dœd1d2„ƒƒZeejd3dœd4d5„ƒƒZeejd6dœd7d8„ƒƒZeejd6dœd9d:„ƒƒZejd;dd<œd=d>„ƒZd?S)@Ú OCSPResponsez#typing.Iterator[OCSPSingleResponse]r8cCsdS)z_ An iterator over the individual SINGLERESP structures in the response Nrr:rrrÚ responsesòszOCSPResponse.responsesrcCsdS)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nrr:rrrÚresponse_statusúszOCSPResponse.response_statuszx509.ObjectIdentifiercCsdS)zA The ObjectIdentifier of the signature algorithm Nrr:rrrÚsignature_algorithm_oidsz$OCSPResponse.signature_algorithm_oidú%typing.Optional[hashes.HashAlgorithm]cCsdS)zX Returns a HashAlgorithm corresponding to the type of the digest signed Nrr:rrrÚsignature_hash_algorithm sz%OCSPResponse.signature_hash_algorithmr7cCsdS)z% The signature bytes Nrr:rrrÚ signatureszOCSPResponse.signaturecCsdS)z+ The tbsResponseData bytes Nrr:rrrÚtbs_response_bytesszOCSPResponse.tbs_response_bytesztyping.List[x509.Certificate]cCsdS)z» A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nrr:rrrÚ certificates szOCSPResponse.certificatesztyping.Optional[bytes]cCsdS)z2 The responder's key hash or None Nrr:rrrÚresponder_key_hash)szOCSPResponse.responder_key_hashztyping.Optional[x509.Name]cCsdS)z. The responder's Name or None Nrr:rrrÚresponder_name0szOCSPResponse.responder_namer&cCsdS)z4 The time the response was produced Nrr:rrrÚ produced_at7szOCSPResponse.produced_atr"cCsdSrOrr:rrrrP>szOCSPResponse.certificate_statusr'cCsdSrQrr:rrrr.EszOCSPResponse.revocation_timer(cCsdSrRrr:rrrr/MszOCSPResponse.revocation_reasoncCsdSrSrr:rrrr,UszOCSPResponse.this_updatecCsdSrTrr:rrrr-]szOCSPResponse.next_updatecCsdSr9rr:rrrr;dszOCSPResponse.issuer_key_hashcCsdSr<rr:rrrr=kszOCSPResponse.issuer_name_hashrcCsdSr>rr:rrrr?rszOCSPResponse.hash_algorithmr@cCsdSrArr:rrrrByszOCSPResponse.serial_numberrHcCsdS)zR The list of response extensions. Not single response extensions. Nrr:rrrrI€szOCSPResponse.extensionscCsdS)zR The list of single response extensions. Not response extensions. Nrr:rrrÚsingle_extensions‡szOCSPResponse.single_extensionsrCrDcCsdS)z0 Serializes the response to DER NrrFrrrrGŽszOCSPResponse.public_bytesN)r rrrJrKrLrVrWrXrZr[r\r]r^r_r`rPr.r/r,r-r;r=r?rBrIrarGrrrrrUñs‚rUc@sreZdZddgfdddddœdd„Zd d d dd œd d „Zdddd ddœdd„Zddddœdd„Zddœdd„ZdS)ÚOCSPRequestBuilderNzWtyping.Optional[typing.Tuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm]]zFtyping.Optional[typing.Tuple[bytes, bytes, int, hashes.HashAlgorithm]]ú/typing.List[x509.Extension[x509.ExtensionType]]r)ÚrequestÚ request_hashrIrcCs||_||_||_dS©N)Ú_requestÚ _request_hashÚ _extensions)r4rdrerIrrrr5–s zOCSPRequestBuilder.__init__r%r)r)r*rrcCsZ|jdus|jdurtdƒ‚t|ƒt|tjƒr4óz3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates) r�r ÚlistrlÚallr2r{rr€ri)r4r~rrrr],s  üz OCSPResponseBuilder.certificatesrnrorpcCsLt|tjƒstdƒ‚t |j||¡}t||jƒt|j |j |j |j|gƒSrs) rrrtr2rurvr rir{rr€r�rwrrrry=s   üz!OCSPResponseBuilder.add_extensionrrYrU)Ú private_keyrrcCs6|jdurtdƒ‚|jdur$tdƒ‚t tj|||¡S)Nz&You must add a response before signingz*You must add a responder_id before signing)rr r€rÚcreate_ocsp_responserr)r4rŠrrrrÚsignMs   ÿzOCSPResponseBuilder.signr)rWrcCs4t|tƒstdƒ‚|tjur$tdƒ‚t |ddd¡S)Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)rrr2rr rr‹)ÚclsrWrrrÚbuild_unsuccessful[s ÿ z&OCSPResponseBuilder.build_unsuccessful) r rrr5r‚r}r]ryrŒÚ classmethodrŽrrrrr{ësùr{r7)ÚdatarcCs t |¡Srf)rÚload_der_ocsp_request©r�rrrr‘isr‘cCs t |¡Srf)rÚload_der_ocsp_responser’rrrr“msr“)'Z __future__rrKr3ÚtypingZ cryptographyrrZ"cryptography.hazmat.bindings._rustrZcryptography.hazmat.primitivesrrZ/cryptography.hazmat.primitives.asymmetric.typesrZcryptography.x509.baser r r ÚEnumr rZSHA1ZSHA224ZSHA256ZSHA384ZSHA512rr!r"r$ÚABCMetar6rNrUrbr{r‘r“rrrrÚs6    û F+D%V~