< d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm Z d dl
m Z m Z d dl
mZ d dlmZmZmZ G d d ej Z G d
d ej Ze j e j e j e j e j fZd dZ G d dej Z G d d Z G d dej Z G d dej Z! G d dej Z"e # e j e"# e j" e!# e j! G d d Z$ G d d Z%e j& Z&e j' Z'dS )! ) annotationsN)utilsx509)ocsp)hashes
serialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module__ __qualname__HASHNAME x/builddir/build/BUILD/imunify360-venv-2.6.2/opt/imunify360/venv/lib64/python3.11/site-packages/cryptography/x509/ocsp.pyr r s D DDDr r c & e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr N) r r r
SUCCESSFULMALFORMED_REQUESTINTERNAL_ERROR TRY_LATER SIG_REQUIRED UNAUTHORIZEDr r r r r s- JNILLLLr r algorithmhashes.HashAlgorithmreturnNonec N t | t st d d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r$ s r _verify_algorithmr, / s3 i 1 1
G
r c e Zd ZdZdZdZdS )OCSPCertStatusr r r N)r r r GOODREVOKEDUNKNOWNr r r r. r. 6 s DGGGGr r. c e Zd ZddZdS )_SingleResponsecertx509.Certificateissuerr$ r% cert_statusr. this_updatedatetime.datetime next_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec f t |t j rt |t j st d t | t |t
j st d |)t |t
j st d || _ || _ || _ || _ || _
t |t st d |t j ur#|t d |t d n}t |t
j st d t | }|t k rt d |)t |t j st d || _ || _ || _ d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r) r Certificate TypeErrorr, datetime_cert_issuer
_algorithm _this_update _next_updater. r0 r+ r r
ReasonFlags _cert_status_revocation_time_revocation_reason) selfr4 r6 r$ r7 r8 r: r< r= s r __init__z_SingleResponse.__init__= s $ 011 E D$:
:
E CDD D)$$$+x'899 E CDD D ": *,
,
" KLL L
# ' '+~66 J
n 4 4 4 * ! !, " - ox/@AA
M KLLL 8 I IO !333 '
!,Z!4#36 6, #
( / "3 r N)r4 r5 r6 r5 r$ r% r7 r. r8 r9 r: r; r< r; r= r> )r r r rN r r r r3 r3 < s. B4 B4 B4 B4 B4 B4r r3 c * e Zd Zeej dd Zeej dd Zeej dd Zeej dd Z ej dd Z
eej dd
Z dS ) OCSPRequestr& bytesc dS z3
The hash of the issuer public key
Nr rM s r issuer_key_hashzOCSPRequest.issuer_key_hash r c dS z-
The hash of the issuer name
Nr rT s r issuer_name_hashz OCSPRequest.issuer_name_hash rV r r% c dS zK
The hash algorithm used in the issuer name and key hashes
Nr rT s r hash_algorithmzOCSPRequest.hash_algorithm rV r intc dS zM
The serial number of the cert whose status is being checked
Nr rT s r
serial_numberzOCSPRequest.serial_number rV r encodingserialization.Encodingc dS )z/
Serializes the request to DER
Nr rM ra s r public_byteszOCSPRequest.public_bytes rV r x509.Extensionsc dS )zP
The list of request extensions. Not single request extensions.
Nr rT s r
extensionszOCSPRequest.extensions rV r Nr& rQ r& r% r& r] ra rb r& rQ r& rf ) r r r propertyabcabstractmethodrU rY r\ r` re rh r r r rP rP s
X
X
X
X
X r rP ) metaclassc f e Zd Zeej dd Zeej dd Zeej dd Zeej dd Z eej dd
Z
eej dd Z eej dd Z eej dd
Z
eej dd Zeej dd Zeej dd Zeej d d ZdS ) OCSPSingleResponser& r. c dS zY
The status of the certificate (an element from the OCSPCertStatus enum)
Nr rT s r certificate_statusz%OCSPSingleResponse.certificate_status rV r r; c dS z^
The date of when the certificate was revoked or None if not
revoked.
Nr rT s r r< z"OCSPSingleResponse.revocation_time rV r c dS z
The date of when the certificate was revoked or None if not
revoked. Represented as a non-naive UTC datetime.
Nr rT s r revocation_time_utcz&OCSPSingleResponse.revocation_time_utc rV r r> c dS zi
The reason the certificate was revoked or None if not specified or
not revoked.
Nr rT s r r= z$OCSPSingleResponse.revocation_reason rV r r9 c dS z
The most recent time at which the status being indicated is known by
the responder to have been correct
Nr rT s r r8 z OCSPSingleResponse.this_update rV r c dS z
The most recent time at which the status being indicated is known by
the responder to have been correct. Represented as a non-naive UTC
datetime.
Nr rT s r this_update_utcz"OCSPSingleResponse.this_update_utc rV r c dS zC
The time when newer information will be available
Nr rT s r r: z OCSPSingleResponse.next_update rV r c dS zu
The time when newer information will be available. Represented as a
non-naive UTC datetime.
Nr rT s r next_update_utcz"OCSPSingleResponse.next_update_utc rV r rQ c dS rS r rT s r rU z"OCSPSingleResponse.issuer_key_hash rV r c dS rX r rT s r rY z#OCSPSingleResponse.issuer_name_hash rV r r% c dS r[ r rT s r r\ z!OCSPSingleResponse.hash_algorithm rV r r] c dS r_ r rT s r r` z OCSPSingleResponse.serial_number rV r Nr& r. r& r; r& r> r& r9 ri rj rk )r r r rn ro rp rv r< r{ r= r8 r r: r rU rY r\ r` r r r rs rs s:
X
X X X X X X
X X
X
X
X r rs c e Zd Zeej d.d Zeej d/d Zeej d0d Zeej d1d Z eej d2d Z
eej d2d Z eej d3d Z eej d4d Z
eej d5d Zeej d6d Zeej d6d Zeej d7d Zeej d8d Zeej d8d Zeej d9d Zeej d6d Zeej d6d Zeej d8d Zeej d8d Zeej d2d! Zeej d2d" Zeej d:d$ Zeej d;d& Z eej d OCSPResponser& #typing.Iterator[OCSPSingleResponse]c dS )z_
An iterator over the individual SINGLERESP structures in the
response
Nr rT s r responseszOCSPResponse.responses rV r r c dS )zm
The status of the response. This is a value from the OCSPResponseStatus
enumeration
Nr rT s r response_statusz OCSPResponse.response_status rV r x509.ObjectIdentifierc dS )zA
The ObjectIdentifier of the signature algorithm
Nr rT s r signature_algorithm_oidz$OCSPResponse.signature_algorithm_oid rV r hashes.HashAlgorithm | Nonec dS )zX
Returns a HashAlgorithm corresponding to the type of the digest signed
Nr rT s r signature_hash_algorithmz%OCSPResponse.signature_hash_algorithm" rV r rQ c dS )z%
The signature bytes
Nr rT s r signaturezOCSPResponse.signature+ rV r c dS )z+
The tbsResponseData bytes
Nr rT s r tbs_response_bytesz OCSPResponse.tbs_response_bytes2 rV r list[x509.Certificate]c dS )z
A list of certificates used to help build a chain to verify the OCSP
response. This situation occurs when the OCSP responder uses a delegate
certificate.
Nr rT s r certificateszOCSPResponse.certificates9 rV r bytes | Nonec dS )z2
The responder's key hash or None
Nr rT s r responder_key_hashz OCSPResponse.responder_key_hashB rV r x509.Name | Nonec dS )z.
The responder's Name or None
Nr rT s r responder_namezOCSPResponse.responder_nameI rV r r9 c dS )z4
The time the response was produced
Nr rT s r produced_atzOCSPResponse.produced_atP rV r c dS )zf
The time the response was produced. Represented as a non-naive UTC
datetime.
Nr rT s r produced_at_utcz OCSPResponse.produced_at_utcW rV r r. c dS ru r rT s r rv z OCSPResponse.certificate_status_ rV r r; c dS rx r rT s r r< z OCSPResponse.revocation_timef rV r c dS rz r rT s r r{ z OCSPResponse.revocation_time_utcn rV r r> c dS r} r rT s r r= z OCSPResponse.revocation_reasonv rV r c dS r r rT s r r8 zOCSPResponse.this_update~ rV r c dS r r rT s r r z OCSPResponse.this_update_utc rV r c dS r r rT s r r: zOCSPResponse.next_update rV r c dS r r rT s r r z OCSPResponse.next_update_utc rV r c dS rS r rT s r rU z OCSPResponse.issuer_key_hash rV r c dS rX r rT s r rY z OCSPResponse.issuer_name_hash rV r r% c dS r[ r rT s r r\ zOCSPResponse.hash_algorithm rV r r] c dS r_ r rT s r r` zOCSPResponse.serial_number rV r rf c dS )zR
The list of response extensions. Not single response extensions.
Nr rT s r rh zOCSPResponse.extensions rV r c dS )zR
The list of single response extensions. Not response extensions.
Nr rT s r single_extensionsz OCSPResponse.single_extensions rV r ra rb c dS )z0
Serializes the response to DER
Nr rd s r re zOCSPResponse.public_bytes rV r N)r& r )r& r )r& r )r& r ri )r& r )r& r )r& r r r r r rj rk rm rl ) r r r rn ro rp r r r r r r r r r r r rv r< r{ r= r8 r r: r rU rY r\ r` rh r re r r r r r
s
X X X
X X
X
X X
X
X
X X
X X X X X X
X X
X
X
X
X
X
r r c > e Zd Zddg fd d
Zd dZd dZd!dZd"d ZdS )#OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | None request_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | Nonerh (list[x509.Extension[x509.ExtensionType]]r& r' c 0 || _ || _ || _ d S N)_request
_request_hash _extensions)rM r r rh s r rN zOCSPRequestBuilder.__init__ s!
)%r r4 r5 r6 r$ r% c | j | j t d t | t |t
j rt |t
j st d t |||f| j | j S )N.Only one certificate can be added to a requestr@ )
r r r+ r, r) r rA rB r r )rM r4 r6 r$ s r add_certificatez"OCSPRequestBuilder.add_certificate s = $(:(F MNN N)$$$$ 011 E D$:
:
E CDD D!
69 %t'94;K
r rY rQ rU r` r] c | j | j t d t |t st d t
| t j d| t j d| |j t | k s|j t | k rt d t | j ||||f| j S )Nr z serial_number must be an integerrY rU z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)
r r r+ r) r] rB r, r _check_bytes digest_sizelenr r )rM rY rU r` r$ s r add_certificate_by_hashz*OCSPRequestBuilder.add_certificate_by_hash s = $(:(F MNN N--- @ >?? ?)$$$
-/?@@@
,o>>> C %
%
"c/&:&:
:
: 6
" M
y I
r extvalx509.ExtensionTypecriticalboolc t |t j st d t j |j || }t
|| j t | j | j
g | j | S Nz"extension must be an ExtensionType) r) r
ExtensionTyperB Extensionoidr r r r r rM r r extensions r
add_extensionz OCSPRequestBuilder.add_extension s} &$"455 B @AA AN6:x@@ #It/?@@@! M4-/M1A/M9/M
r rP c d | j | j t d t j | S )Nz*You must add a certificate before building)r r r+ r create_ocsp_requestrT s r buildzOCSPRequestBuilder.build! s2 = T%7%? IJJ J'---r )r r r r rh r r& r' )r4 r5 r6 r5 r$ r% r& r )
rY rQ rU rQ r` r] r$ r% r& r )r r r r r& r )r& rP )r r r rN r r r r r r r r r s ?A & & & & &
&
<
. . . . . .r r c ` e Zd Zdddg fd.d
Zd/dZd0d Zd1d Zd2d%Zd3d*Ze d4d- Z
dS )5OCSPResponseBuilderNresponse_SingleResponse | None responder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecerts list[x509.Certificate] | Nonerh r c > || _ || _ || _ || _ d S r ) _response
_responder_id_certsr )rM r r r rh s r rN z OCSPResponseBuilder.__init__) s( " ) %r r4 r5 r6 r$ r% r7 r. r8 r9 r: r; r< r= r> r& c
| j t d t |||||||| } t | | j | j | j S )Nz#Only one response per OCSPResponse.)r r+ r3 r r r r )
rM r4 r6 r$ r7 r8 r: r< r=
singleresps
r add_responsez OCSPResponseBuilder.add_response6 sj > % BCC C$
# K
r ra r responder_certc | j t d t |t j st d t |t st d t | j ||f| j | j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) r r+ r) r rA rB r r r r r )rM ra r s r r z OCSPResponseBuilder.responder_idU s ) @AA A.$*:;; D BCC C($9:: H
# N
X & K
r !typing.Iterable[x509.Certificate]c " | j t d t | }t | dk rt d t d |D st d t
| j | j || j S )Nz!certificates may only be set oncer z certs must not be an empty listc 3 J K | ] }t |t j V d S r )r) r rA ).0xs r z3OCSPResponseBuilder.certificates..p s/ BBq:a!122BBBBBBr z$certs must be a list of Certificates)
r r+ listr allrB r r r r )rM r s r r z OCSPResponseBuilder.certificatesh s ; " @AA AU u::?? >?? ?BBEBBBBB D BCC C" N
r r r r r c t |t j st d t j |j || }t
|| j t | j | j
| j g | j | S r ) r) r r rB r r r r r r r r r s r r z!OCSPResponseBuilder.add_extensiony s &$"455 B @AA AN6:x@@ #It/?@@@" N K *d * *
r private_keyr r r c | j t d | j t d t j t
j | || S )Nz&You must add a response before signingz*You must add a responder_id before signing)r r+ r r create_ocsp_responser r )rM r r$ s r signzOCSPResponseBuilder.sign sT
> ! EFF F % IJJ J( )4i
r r r c t |t st d |t j u rt d t j |d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r) r rB r r+ r r )clsr s r build_unsuccessfulz&OCSPResponseBuilder.build_unsuccessful sc /+=>> I
0 ; ; ; CDD D( $dKKKr )r r r r r r rh r )r4 r5 r6 r5 r$ r% r7 r. r8 r9 r: r; r< r; r= r> r& r )ra r r r5 r& r )r r r& r )r r r r r& r )r r r$ r r& r )r r r& r ) r r r rN r r r r r classmethodr r r r r r ( s ,0/3?A
& & & & &
>
&
"
L
L
L [
L
L
Lr r )r$ r% r& r' )(
__future__r ro rC typing cryptographyr r "cryptography.hazmat.bindings._rustr cryptography.hazmat.primitivesr r /cryptography.hazmat.primitives.asymmetric.typesr cryptography.x509.baser
r r Enumr r SHA1SHA224SHA256SHA384SHA512r* r, r. r3 ABCMetarP rs r registerr r load_der_ocsp_requestload_der_ocsp_responser r r r s$
# " " " " "
$ $ $ $ $ $ $ $ 3 3 3 3 3 3 @ @ @ @ @ @ @ @ EJ
K
M
M
M
M
UZ C4 C4 C4 C4 C4 C4 C4 C4L( ( ( ( ( CK ( ( ( ( VZ Z Z Z Z 3; Z Z Z Z zB B B B B S[ B B B B J T% & & & d' ( ( ( D 3 4 4 4Q. Q. Q. Q. Q. Q. Q. Q.hzL zL zL zL zL zL zL zLz 2 4 r