a oefH@sXddlmZddlZddlZddlZddlmZmZddlm Z ddl m Z m Z ddl mZddlmZmZmZGdd d ejZGd d d ejZe je je je je jfZd d dddZGdddejZGdddZGdddejdZ GdddejdZ!GdddejdZ"GdddZ#GdddZ$d dd!d"d#Z%d dd!d$d%Z&dS)&) annotationsN)utilsx509)ocsp)hashes serialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc@seZdZdZdZdS)OCSPResponderEncodingzBy HashzBy NameN)__name__ __module__ __qualname__ZHASHNAMErr7C:\Program Files\Certbot\pkgs\cryptography\x509\ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)OCSPResponseStatusrN) r rr SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIREDZ UNAUTHORIZEDrrrrrs rhashes.HashAlgorithmNone) algorithmreturncCst|tstddS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512) isinstance_ALLOWED_HASHES ValueError)rrrr_verify_algorithm/s r!c@seZdZdZdZdZdS)OCSPCertStatusrrrN)r rrZGOODREVOKEDZUNKNOWNrrrrr"6sr"c @s(eZdZddddddddddd Zd S) _SingleResponsex509.Certificaterr"datetime.datetime"typing.Optional[datetime.datetime]!typing.Optional[x509.ReasonFlags])certissuerr cert_status this_update next_updaterevocation_timerevocation_reasonc Cst|tjrt|tjs tdt|t|tjsrr:rrrr?sz!OCSPSingleResponse.hash_algorithmr@cCsdSrArr:rrrrBsz OCSPSingleResponse.serial_numberN)r rrrJrKrLrPr.r/r,r-r;r=r?rBrrrrrNs6rNc@seZdZeejddddZeejddddZeejddd d Zeejd dd d Z eejddddZ eejddddZ eejddddZ eejddddZ eejddddZeejddddZeejddd d!Zeejd"dd#d$Zeejd%dd&d'Zeejddd(d)Zeejd"dd*d+Zeejddd,d-Zeejddd.d/Zeejd0dd1d2Zeejd3dd4d5Zeejd6dd7d8Zeejd6dd9d:Zejd;dd<d=d>Zd?S)@ OCSPResponsez#typing.Iterator[OCSPSingleResponse]r8cCsdS)z_ An iterator over the individual SINGLERESP structures in the response Nrr:rrr responsesszOCSPResponse.responsesrcCsdS)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nrr:rrrresponse_statusszOCSPResponse.response_statuszx509.ObjectIdentifiercCsdS)zA The ObjectIdentifier of the signature algorithm Nrr:rrrsignature_algorithm_oidsz$OCSPResponse.signature_algorithm_oid%typing.Optional[hashes.HashAlgorithm]cCsdS)zX Returns a HashAlgorithm corresponding to the type of the digest signed Nrr:rrrsignature_hash_algorithm sz%OCSPResponse.signature_hash_algorithmr7cCsdS)z% The signature bytes Nrr:rrr signatureszOCSPResponse.signaturecCsdS)z+ The tbsResponseData bytes Nrr:rrrtbs_response_bytesszOCSPResponse.tbs_response_bytesztyping.List[x509.Certificate]cCsdS)z A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nrr:rrr certificates szOCSPResponse.certificatesztyping.Optional[bytes]cCsdS)z2 The responder's key hash or None Nrr:rrrresponder_key_hash)szOCSPResponse.responder_key_hashztyping.Optional[x509.Name]cCsdS)z. The responder's Name or None Nrr:rrrresponder_name0szOCSPResponse.responder_namer&cCsdS)z4 The time the response was produced Nrr:rrr produced_at7szOCSPResponse.produced_atr"cCsdSrOrr:rrrrP>szOCSPResponse.certificate_statusr'cCsdSrQrr:rrrr.EszOCSPResponse.revocation_timer(cCsdSrRrr:rrrr/MszOCSPResponse.revocation_reasoncCsdSrSrr:rrrr,UszOCSPResponse.this_updatecCsdSrTrr:rrrr-]szOCSPResponse.next_updatecCsdSr9rr:rrrr;dszOCSPResponse.issuer_key_hashcCsdSr<rr:rrrr=kszOCSPResponse.issuer_name_hashrcCsdSr>rr:rrrr?rszOCSPResponse.hash_algorithmr@cCsdSrArr:rrrrByszOCSPResponse.serial_numberrHcCsdS)zR The list of response extensions. Not single response extensions. Nrr:rrrrIszOCSPResponse.extensionscCsdS)zR The list of single response extensions. Not response extensions. Nrr:rrrsingle_extensionsszOCSPResponse.single_extensionsrCrDcCsdS)z0 Serializes the response to DER NrrFrrrrGszOCSPResponse.public_bytesN)r rrrJrKrLrVrWrXrZr[r\r]r^r_r`rPr.r/r,r-r;r=r?rBrIrarGrrrrrUsrUc@sreZdZddgfdddddddZd d d dd d d Zdddd ddddZddddddZddddZdS)OCSPRequestBuilderNzWtyping.Optional[typing.Tuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm]]zFtyping.Optional[typing.Tuple[bytes, bytes, int, hashes.HashAlgorithm]]/typing.List[x509.Extension[x509.ExtensionType]]r)request request_hashrIrcCs||_||_||_dSN)_request _request_hash _extensions)r4rdrerIrrrr5s zOCSPRequestBuilder.__init__r%r)r)r*rrcCsZ|jdus|jdurtdt|t|tjr4z3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates) rr listrlallr2r{rrri)r4r~rrrr],s  z OCSPResponseBuilder.certificatesrnrorpcCsLt|tjstdt|j||}t||jt|j |j |j |j|gSrs) rrrtr2rurvr rir{rrrrwrrrry=s   z!OCSPResponseBuilder.add_extensionrrYrU) private_keyrrcCs6|jdurtd|jdur$tdttj|||S)Nz&You must add a response before signingz*You must add a responder_id before signing)rr rrcreate_ocsp_responserr)r4rrrrrsignMs   zOCSPResponseBuilder.signr)rWrcCs4t|tstd|tjur$tdt|dddS)Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)rrr2rr rr)clsrWrrrbuild_unsuccessful[s  z&OCSPResponseBuilder.build_unsuccessful) r rrr5rr}r]ryr classmethodrrrrrr{sr{r7)datarcCs t|Srf)rload_der_ocsp_requestrrrrrisrcCs t|Srf)rload_der_ocsp_responserrrrrmsr)'Z __future__rrKr3typingZ cryptographyrrZ"cryptography.hazmat.bindings._rustrZcryptography.hazmat.primitivesrrZ/cryptography.hazmat.primitives.asymmetric.typesrZcryptography.x509.baser r r Enumr rZSHA1ZSHA224ZSHA256ZSHA384ZSHA512rr!r"r$ABCMetar6rNrUrbr{rrrrrrs6     F+D%V~