관리-도구
편집 파일: ocsp.cpython-39.pyc
a �a�8 � @ s6 d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm Z m Z d dl m Z m Z mZmZ G dd� dej�ZG d d � d ej�Ze je je je je jfZd d � ZG d d� dej�ZG dd� de�Z G dd� de j d�Z G dd� de j d�Z G dd� de�Z G dd� de�Z!e"e d�dd �Z#e"e d�d d �Z$dS ) � N)�utils)�x509)�ocsp)�hashes� serialization)�PRIVATE_KEY_TYPES�_EARLIEST_UTC_TIME�_convert_to_naive_utc_time�_reject_duplicate_extensionc @ s e Zd ZdZdZdS )�OCSPResponderEncodingzBy HashzBy NameN)�__name__� __module__� __qualname__�HASH�NAME� r r �</usr/lib64/python3.9/site-packages/cryptography/x509/ocsp.pyr s r c @ s$ e Zd ZdZdZdZdZdZdZdS )�OCSPResponseStatusr � � � � � N) r r r � SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIREDZ UNAUTHORIZEDr r r r r s r c C s t | t�std��d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)� isinstance�_ALLOWED_HASHES� ValueError)� algorithmr r r �_verify_algorithm- s �r c @ s e Zd ZdZdZdZdS )�OCSPCertStatusr r r N)r r r ZGOOD�REVOKEDZUNKNOWNr r r r r 4 s r c @ s e Zd Zdd� ZdS )�_SingleResponsec C s t |tj�rt |tj�s td��t|� t |tj�s<td��|d urXt |tj�sXtd��|| _|| _|| _|| _ || _ t |t �s�td��|t j ur�|d ur�t d��|d ur�t d��nHt |tj�s�td��t|�}|tk r�t d��|d ur�t |tj�s�td ��|| _|| _|| _d S ) N�%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r r � Certificate� TypeErrorr �datetimeZ_certZ_issuerZ _algorithmZ _this_updateZ _next_updater r r r r � ReasonFlagsZ _cert_statusZ_revocation_timeZ_revocation_reason) �self�cert�issuerr � cert_status� this_update� next_update�revocation_time�revocation_reasonr r r �__init__; sZ � � � �� � ��z_SingleResponse.__init__N)r r r r/ r r r r r! : s r! c @ s� e Zd Zejed�dd��Zejed�dd��Zejej d�dd��Z eje d�dd ��Z ej ejed �d d ��Zejejd�d d��ZdS )� OCSPRequest��returnc C s dS �z3 The hash of the issuer public key Nr �r' r r r �issuer_key_hash� s zOCSPRequest.issuer_key_hashc C s dS �z- The hash of the issuer name Nr r4 r r r �issuer_name_hash� s z OCSPRequest.issuer_name_hashc C s dS �zK The hash algorithm used in the issuer name and key hashes Nr r4 r r r �hash_algorithm� s zOCSPRequest.hash_algorithmc C s dS �zM The serial number of the cert whose status is being checked Nr r4 r r r � serial_number� s zOCSPRequest.serial_number��encodingr2 c C s dS )z/ Serializes the request to DER Nr �r' r= r r r � public_bytes� s zOCSPRequest.public_bytesc C s dS )zP The list of request extensions. Not single request extensions. Nr r4 r r r � extensions� s zOCSPRequest.extensionsN)r r r �abc�abstractproperty�bytesr5 r7 r � HashAlgorithmr9 �intr; �abstractmethodr �Encodingr? r � Extensionsr@ r r r r r0 � s r0 )� metaclassc @ s� e Zd Zejed�dd��Zejejd�dd��Z eje j e j d�dd��Zejed�dd ��Zejed�d d ��Zeje jej d�d d ��Zeje j e d�dd��Zeje j ej d�dd��Zejejd�dd��Zejed�dd��Zeje j ej d�dd��Z eje j ej d�dd��Z ejejd�dd��Z eje j ej d�d d ��Z ejed�d d ��Z!ejed�d d!��Z"eje j d�d"d#��Z#eje$d�d$d%��Z%ejej&d�d&d'��Z'ejej&d�d(d)��Z(ej)e*j+ed*�d+d,��Z,d-S ).� OCSPResponser1 c C s dS )zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nr r4 r r r �response_status� s z OCSPResponse.response_statusc C s dS )zA The ObjectIdentifier of the signature algorithm Nr r4 r r r �signature_algorithm_oid� s z$OCSPResponse.signature_algorithm_oidc C s dS )zX Returns a HashAlgorithm corresponding to the type of the digest signed Nr r4 r r r �signature_hash_algorithm� s z%OCSPResponse.signature_hash_algorithmc C s dS )z% The signature bytes Nr r4 r r r � signature� s zOCSPResponse.signaturec C s dS )z+ The tbsResponseData bytes Nr r4 r r r �tbs_response_bytes� s z OCSPResponse.tbs_response_bytesc C s dS )z� A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nr r4 r r r � certificates� s zOCSPResponse.certificatesc C s dS )z2 The responder's key hash or None Nr r4 r r r �responder_key_hash� s z OCSPResponse.responder_key_hashc C s dS )z. The responder's Name or None Nr r4 r r r �responder_name� s zOCSPResponse.responder_namec C s dS )z4 The time the response was produced Nr r4 r r r � produced_at� s zOCSPResponse.produced_atc C s dS )zY The status of the certificate (an element from the OCSPCertStatus enum) Nr r4 r r r �certificate_status� s z OCSPResponse.certificate_statusc C s dS )z^ The date of when the certificate was revoked or None if not revoked. Nr r4 r r r r- � s z OCSPResponse.revocation_timec C s dS )zi The reason the certificate was revoked or None if not specified or not revoked. Nr r4 r r r r. � s z OCSPResponse.revocation_reasonc C s dS )z� The most recent time at which the status being indicated is known by the responder to have been correct Nr r4 r r r r+ � s zOCSPResponse.this_updatec C s dS )zC The time when newer information will be available Nr r4 r r r r, � s zOCSPResponse.next_updatec C s dS r3 r r4 r r r r5 s z OCSPResponse.issuer_key_hashc C s dS r6 r r4 r r r r7 s z OCSPResponse.issuer_name_hashc C s dS r8 r r4 r r r r9 s zOCSPResponse.hash_algorithmc C s dS r: r r4 r r r r; s zOCSPResponse.serial_numberc C s dS )zR The list of response extensions. Not single response extensions. Nr r4 r r r r@ s zOCSPResponse.extensionsc C s dS )zR The list of single response extensions. Not response extensions. Nr r4 r r r �single_extensions! s z OCSPResponse.single_extensionsr< c C s dS )z0 Serializes the response to DER Nr r> r r r r? ' s zOCSPResponse.public_bytesN)-r r r rA rB r rK r ZObjectIdentifierrL �typing�Optionalr rD rM rC rN rO �Listr# rP rQ �NamerR r% rS r rT r- r& r. r+ r, r5 r7 r9 rE r; rH r@ rU rF r rG r? r r r r rJ � sV �rJ c @ s� e Zd Zdg fejejejejej f ej ej ej dd�dd�Z ejejej d d�dd�Zej ed d�d d �Zed �d d �ZdS )�OCSPRequestBuilderN)�requestr@ r2 c C s || _ || _d S �N)�_request� _extensions)r' r[ r@ r r r r/ / s zOCSPRequestBuilder.__init__)r( r) r r2 c C sL | j d urtd��t|� t|tj�r2t|tj�s:td��t|||f| j�S )Nz.Only one certificate can be added to a requestr" ) r] r r r r r# r$ rZ r^ )r' r( r) r r r r �add_certificate; s �z"OCSPRequestBuilder.add_certificate��extval�criticalr2 c C sD t |tj�std��t�|j||�}t|| j� t| j | j|g �S �Nz"extension must be an ExtensionType) r r � ExtensionTyper$ � Extension�oidr r^ rZ r] �r' ra rb � extensionr r r � add_extensionL s �z OCSPRequestBuilder.add_extensionr1 c C s | j d u rtd��t�| �S )Nz*You must add a certificate before building)r] r r Zcreate_ocsp_requestr4 r r r �buildY s zOCSPRequestBuilder.build)r r r rV rW �Tupler r# r rD rX re rd r/ r_ �boolri r0 rj r r r r rZ . s( ���� � � rZ c @ s e Zd Zdddg feje ejejeje f ejej ej ej ej ej d�dd�Z ejejejeejejej ejej ejej d d� dd�Ze ejd d�d d �Zejej d d �d d �Zej ed d�dd�Zeejej ed�dd�Ze e ed�dd��Z dS )�OCSPResponseBuilderN)�response� responder_id�certsr@ c C s || _ || _|| _|| _d S r\ )� _response� _responder_id�_certsr^ )r' rn ro rp r@ r r r r/ a s z OCSPResponseBuilder.__init__) r( r) r r* r+ r, r- r. r2 c C s< | j d urtd��t||||||||�} t| | j| j| j�S )Nz#Only one response per OCSPResponse.)rq r r! rm rr rs r^ ) r' r( r) r r* r+ r, r- r. Z singlerespr r r � add_responseo s$ � �z OCSPResponseBuilder.add_response)r= �responder_certr2 c C sP | j d urtd��t|tj�s&td��t|t�s8td��t| j||f| j | j �S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) rr r r r r# r$ r rm rq rs r^ )r' r= ru r r r ro � s ��z OCSPResponseBuilder.responder_id)rp r2 c C s\ | j d urtd��t|�}t|�dkr.td��tdd� |D ��sHtd��t| j| j|| j �S )Nz!certificates may only be set oncer z certs must not be an empty listc s s | ]}t |tj�V qd S r\ )r r r# )�.0�xr r r � <genexpr>� � z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates) rs r �list�len�allr$ rm rq rr r^ )r' rp r r r rP � s �z OCSPResponseBuilder.certificatesr` c C sL t |tj�std��t�|j||�}t|| j� t| j | j | j | j|g �S rc ) r r rd r$ re rf r r^ rm rq rr rs rg r r r ri � s �z!OCSPResponseBuilder.add_extension)� private_keyr r2 c C s6 | j d u rtd��| jd u r$td��t�tj| ||�S )Nz&You must add a response before signingz*You must add a responder_id before signing)rq r rr r �create_ocsp_responser r )r' r} r r r r �sign� s �zOCSPResponseBuilder.sign)rK r2 c C s4 t |t�std��|tju r$td��t�|d d d �S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r r r$ r r r r~ )�clsrK r r r �build_unsuccessful� s � z&OCSPResponseBuilder.build_unsuccessful) r r r rV rW r! rk r r# r rX re rd r/ r rD r r% r& rt ro �IterablerP rl ri r rJ r � classmethodr r� r r r r rm ` sN ��� � � � � � �rm )�datar2 c C s t �| �S r\ )r �load_der_ocsp_request�r� r r r r� � s r� c C s t �| �S r\ )r �load_der_ocsp_responser� r r r r� � s r� )%rA r% rV Z cryptographyr r Z"cryptography.hazmat.bindings._rustr Z cryptography.hazmat.primitivesr r Zcryptography.x509.baser r r r �Enumr r ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512r r r �objectr! �ABCMetar0 rJ rZ rm rC r� r� r r r r �<module> s2 � F& 2~