3
lá˜_Ì6 ã @ sô d dl mZmZmZ d dlZd dlmZmZ d dlm Z d dl
m Z m Z m
Z
mZmZmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZm Z d d
„ Z d d „ Z d
d„ Z dd„ Z dd„ Z!ej"eƒG dd„ de#ƒƒZ$ej"eƒG dd„ de#ƒƒZ%dS )é )Úabsolute_importÚdivisionÚprint_functionN)ÚutilsÚx509)ÚUnsupportedAlgorithm)Ú _CRL_ENTRY_REASON_CODE_TO_ENUMÚ_asn1_integer_to_intÚ_asn1_string_to_bytesÚ_decode_x509_nameÚ_obj2txtÚ _parse_asn1_generalized_time)Ú _Certificate)Ú
serialization)ÚOCSPCertStatusÚ OCSPRequestÚ OCSPResponseÚOCSPResponseStatusÚ_CERT_STATUS_TO_ENUMÚ
_OIDS_TO_HASHÚ_RESPONSE_STATUS_TO_ENUMc s t jˆ ƒ‡ fdd„ƒ}|S )Nc s( | j tjkrtdƒ‚nˆ | f|žŽ S d S )NzCOCSP response status is not successful so the property has no value)Úresponse_statusr Ú
SUCCESSFULÚ
ValueError)ÚselfÚargs)Úfunc© ú /usr/lib64/python3.6/ocsp.pyÚwrapper! s z._requires_successful_response..wrapper)Ú functoolsÚwraps)r r r )r r Ú _requires_successful_response s
r" c C s^ | j jdƒ}| jj| j j| j j|| j j|ƒ}| j|dkƒ | j|d | j jkƒ t| |d ƒS )NzASN1_OCTET_STRING **é r )Ú_ffiÚnewÚ_libÚOCSP_id_get0_infoÚNULLÚopenssl_assertr
)ÚbackendÚcert_idZkey_hashÚresr r r Ú_issuer_key_hash. s r- c C s^ | j jdƒ}| jj|| j j| j j| j j|ƒ}| j|dkƒ | j|d | j jkƒ t| |d ƒS )NzASN1_OCTET_STRING **r# r )r$ r% r& r' r( r) r
)r* r+ Z name_hashr, r r r Ú_issuer_name_hash< s r. c C s^ | j jdƒ}| jj| j j| j j| j j||ƒ}| j|dkƒ | j|d | j jkƒ t| |d ƒS )NzASN1_INTEGER **r# r )r$ r% r& r' r( r) r )r* r+ Únumr, r r r Ú_serial_numberJ s r0 c C sŽ | j jdƒ}| jj| j j|| j j| j j|ƒ}| j|dkƒ | j|d | j jkƒ t| |d ƒ}yt| S tk
rˆ t dj
|ƒƒ‚Y nX d S )NzASN1_OBJECT **r# r z*Signature algorithm OID: {} not recognized) r$ r% r& r' r( r) r r ÚKeyErrorr Úformat)r* r+ Zasn1objr, Úoidr r r Ú_hash_algorithmT s r4 c @ sb e Zd Zdd„ ZejdƒZeedd„ ƒƒZ eedd„ ƒƒZ
eedd „ ƒƒZ eed
d „ ƒƒZ eed d
„ ƒƒZ
eedd„ ƒƒZeedd„ ƒƒZdd„ Zeedd„ ƒƒZeedd„ ƒƒZeedd„ ƒƒZeedd„ ƒƒZeed d „ ƒƒZeed d „ ƒƒZeed d!„ ƒƒZeed"d#„ ƒƒZeed$d%„ ƒƒZeed&d'„ ƒƒZejed(d)„ ƒƒZ ejed*d+„ ƒƒZ d,d-„ Z d.S )/Ú
_OCSPResponsec C s || _ || _| j jj| jƒ}| j j|tkƒ t| | _| jtjkrü| j jj | jƒ}| j j|| j j
j kƒ | j j
j || j jj
ƒ| _| j jj| jƒ}|dkr¦tdj|ƒƒ‚| j jj| jdƒ| _| j j| j| j j
j kƒ | j jj| jƒ| _| j j| j| j j
j kƒ d S )Nr# zhOCSP response contains more than one SINGLERESP structure, which this library does not support. {} foundr )Ú_backendÚ_ocsp_responser& ZOCSP_response_statusr) r Ú_statusr r ZOCSP_response_get1_basicr$ r( ÚgcZOCSP_BASICRESP_freeÚ_basicZOCSP_resp_countr r2 ZOCSP_resp_get0Ú_singleZOCSP_SINGLERESP_get0_idÚ_cert_id)r r* Z
ocsp_responseÚstatusZbasicZnum_respr r r Ú__init__j s.
z_OCSPResponse.__init__r8 c C s> | j jj| jƒ}| j j|| j jjkƒ t| j |jƒ}t j
|ƒS )N) r6 r& ZOCSP_resp_get0_tbs_sigalgr: r) r$ r( r Ú algorithmr ZObjectIdentifier)r Zalgr3 r r r Úsignature_algorithm_oidŒ s z%_OCSPResponse.signature_algorithm_oidc C s8 | j }y
tj| S tk
r2 tdj|ƒƒ‚Y nX d S )Nz)Signature algorithm OID:{} not recognized)r@ r Z_SIG_OIDS_TO_HASHr1 r r2 )r r3 r r r Úsignature_hash_algorithm” s
z&_OCSPResponse.signature_hash_algorithmc C s2 | j jj| jƒ}| j j|| j jjkƒ t| j |ƒS )N)r6 r& ZOCSP_resp_get0_signaturer: r) r$ r( r
)r Zsigr r r Ú signatureŸ s z_OCSPResponse.signaturec s¢ ˆ j jjˆ jƒ}ˆ j j|ˆ j jjkƒ ˆ j jjdƒ}ˆ j jj||ƒ}ˆ j j|d ˆ j jjkƒ ˆ j jj |‡ fdd„ƒ}ˆ j j|dkƒ ˆ j jj
|d |ƒd d … S )Nzunsigned char **r c s ˆ j jj| d ƒS )Nr )r6 r& Z OPENSSL_free)Zpointer)r r r Ú¯ s z2_OCSPResponse.tbs_response_bytes..) r6 r& ZOCSP_resp_get0_respdatar: r) r$ r( r% Zi2d_OCSP_RESPDATAr9 Úbuffer)r ZrespdataZppr, r )r r Útbs_response_bytes¦ s z _OCSPResponse.tbs_response_bytesc C sz | j jj| jƒ}| j jj|ƒ}g }xRt|ƒD ]F}| j jj||ƒ}| j j|| j jj kƒ t
| j |ƒ}| |_ |j |ƒ q,W |S )N)
r6 r& ZOCSP_resp_get0_certsr: Z sk_X509_numÚrangeZ
sk_X509_valuer) r$ r( r Z
_ocsp_respÚappend)r Zsk_x509r/ ZcertsÚir Zcertr r r Ú certificates´ s z_OCSPResponse.certificatesc C s. | j ƒ \}}|| jjjkr d S t| j|ƒS d S )N)Ú_responder_key_namer6 r$ r( r
)r Ú_Ú asn1_stringr r r Úresponder_key_hashÆ s z _OCSPResponse.responder_key_hashc C s. | j ƒ \}}|| jjjkr d S t| j|ƒS d S )N)rJ r6 r$ r( r )r Ú x509_namerK r r r Úresponder_nameÏ s z _OCSPResponse.responder_namec C sP | j jjdƒ}| j jjdƒ}| j jj| j||ƒ}| j j|dkƒ |d |d fS )NzASN1_OCTET_STRING **z X509_NAME **r# r )r6 r$ r% r& ZOCSP_resp_get0_idr: r) )r rL rN r, r r r rJ Ø s z!_OCSPResponse._responder_key_namec C s | j jj| jƒ}t| j |ƒS )N)r6 r& ZOCSP_resp_get0_produced_atr: r
)r Ú produced_atr r r rP á s z_OCSPResponse.produced_atc C sH | j jj| j| j jj| j jj| j jj| j jjƒ}| j j|tkƒ t| S )N)r6 r& ÚOCSP_single_get0_statusr; r$ r( r) r )r r= r r r Úcertificate_statusé s z _OCSPResponse.certificate_statusc C sr | j tjk rd S | jjjdƒ}| jjj| j| jjj || jjj | jjj ƒ | jj
|d | jjj kƒ t | j|d ƒS )NzASN1_GENERALIZEDTIME **r ) rR r ÚREVOKEDr6 r$ r% r& rQ r; r( r) r
)r Ú asn1_timer r r Úrevocation_timeö s z _OCSPResponse.revocation_timec C s| | j tjk rd S | jjjdƒ}| jjj| j|| jjj | jjj | jjj ƒ |d dkrXd S | jj
|d t kƒ t |d S d S )Nzint *r r# éÿÿÿÿ) rR r rS r6 r$ r% r& rQ r; r( r) r )r Z
reason_ptrr r r Úrevocation_reason s z _OCSPResponse.revocation_reasonc C sb | j jjdƒ}| j jj| j| j jj| j jj|| j jjƒ | j j|d | j jjkƒ t| j |d ƒS )NzASN1_GENERALIZEDTIME **r ) r6 r$ r% r& rQ r; r( r) r
)r rT r r r Ú this_update s z_OCSPResponse.this_updatec C sb | j jjdƒ}| j jj| j| j jj| j jj| j jj|ƒ |d | j jjkrZt| j |d ƒS d S d S )NzASN1_GENERALIZEDTIME **r )r6 r$ r% r& rQ r; r( r
)r rT r r r Ú next_update, s z_OCSPResponse.next_updatec C s t | j| jƒS )N)r- r6 r< )r r r r Úissuer_key_hash< s z _OCSPResponse.issuer_key_hashc C s t | j| jƒS )N)r. r6 r< )r r r r Úissuer_name_hashA s z _OCSPResponse.issuer_name_hashc C s t | j| jƒS )N)r4 r6 r< )r r r r Úhash_algorithmF s z _OCSPResponse.hash_algorithmc C s t | j| jƒS )N)r0 r6 r< )r r r r Ú
serial_numberK s z_OCSPResponse.serial_numberc C s | j jj| jƒS )N)r6 Z_ocsp_basicresp_ext_parserÚparser: )r r r r Ú
extensionsP s z_OCSPResponse.extensionsc C s | j jj| jƒS )N)r6 Z_ocsp_singleresp_ext_parserr^ r; )r r r r Úsingle_extensionsU s z _OCSPResponse.single_extensionsc C sL |t jjk rtdƒ‚| jjƒ }| jjj|| jƒ}| jj |dkƒ | jj
|ƒS )Nz/The only allowed encoding value is Encoding.DERr ) r ÚEncodingÚDERr r6 Ú_create_mem_bio_gcr& Zi2d_OCSP_RESPONSE_bior7 r) Ú
_read_mem_bio)r ÚencodingÚbior, r r r Ú public_bytesZ s
z_OCSPResponse.public_bytesN) Ú__name__Ú
__module__Ú __qualname__r> r Zread_only_propertyr Úpropertyr" r@ rA rB rE rI rM rO rJ rP rR rU rW rX rY rZ r[ r\ r] Úcached_propertyr_ r` rg r r r r r5 h sT
r5 c @ sZ e Zd Zdd„ Zedd„ ƒZedd„ ƒZedd„ ƒZed d
„ ƒZe j
d d „ ƒZ d
d„ Z dS )Ú _OCSPRequestc C s~ |j j|ƒdkrtdƒ‚|| _|| _| jj j| jdƒ| _| jj| j| jjj kƒ | jj j
| jƒ| _ | jj| j | jjj kƒ d S )Nr# z+OCSP request contains more than one requestr ) r& ZOCSP_request_onereq_countÚNotImplementedErrorr6 Ú
_ocsp_requestZOCSP_request_onereq_get0Z_requestr) r$ r( ZOCSP_onereq_get0_idr< )r r* Z ocsp_requestr r r r> h s z_OCSPRequest.__init__c C s t | j| jƒS )N)r- r6 r< )r r r r rZ v s z _OCSPRequest.issuer_key_hashc C s t | j| jƒS )N)r. r6 r< )r r r r r[ z s z _OCSPRequest.issuer_name_hashc C s t | j| jƒS )N)r0 r6 r< )r r r r r] ~ s z_OCSPRequest.serial_numberc C s t | j| jƒS )N)r4 r6 r< )r r r r r\ ‚ s z_OCSPRequest.hash_algorithmc C s | j jj| jƒS )N)r6 Z_ocsp_req_ext_parserr^ ro )r r r r r_ † s z_OCSPRequest.extensionsc C sL |t jjk rtdƒ‚| jjƒ }| jjj|| jƒ}| jj |dkƒ | jj
|ƒS )Nz/The only allowed encoding value is Encoding.DERr ) r ra rb r r6 rc r& Zi2d_OCSP_REQUEST_bioro r) rd )r re rf r, r r r rg Š s
z_OCSPRequest.public_bytesN)
rh ri rj r> rk rZ r[ r] r\ r rl r_ rg r r r r rm f s rm )&Z
__future__r r r r Z cryptographyr r Zcryptography.exceptionsr Z0cryptography.hazmat.backends.openssl.decode_asn1r r r
r r r
Z)cryptography.hazmat.backends.openssl.x509r Z cryptography.hazmat.primitivesr Zcryptography.x509.ocspr r r r r r r r" r- r. r0 r4 Zregister_interfaceÚobjectr5 rm r r r r Ú s" $
~