U
    gPJ                     @   s  d Z ddlmZmZmZmZ ddlmZ ddlm	Z	m
Z
 ddlmZmZmZmZmZmZmZmZmZmZmZmZmZ ddlmZmZ ddlmZ dd	lmZm Z m!Z!m"Z" G d
d deZ#G dd deZ$G dd deZ%G dd deZ&G dd deZ'G dd deZ(G dd deZ)G dd deZ*G dd deZ+G dd deZ,G dd deZ-G d d! d!eZ.G d"d# d#eZ/G d$d% d%eZ0G d&d' d'eZ1G d(d) d)eZ2G d*d+ d+eZ3G d,d- d-eZ4G d.d/ d/eZ5G d0d1 d1eZ6G d2d3 d3eZ7G d4d5 d5eZ8G d6d7 d7eZ9G d8d9 d9eZ:G d:d; d;eZ;G d<d= d=eZ<G d>d? d?eZ=G d@dA dAeZ>G dBdC dCeZ?G dDdE dEeZ@G dFdG dGeZAG dHdI dIeZBG dJdK dKeZCG dLdM dMeZDG dNdO dOeZEG dPdQ dQeZFG dRdS dSeZGG dTdU dUeZHdVS )Wz
ASN.1 type classes for the online certificate status protocol (OCSP). Exports
the following items:

 - OCSPRequest()
 - OCSPResponse()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function   )unwrap)DigestAlgorithmSignedDigestAlgorithm)BooleanChoice
EnumeratedGeneralizedTime	IA5StringIntegerNullObjectIdentifierOctetBitStringOctetStringParsableOctetStringSequence
SequenceOf)AuthorityInfoAccessSyntax	CRLReason)PublicKeyAlgorithm)CertificateGeneralNameGeneralNamesNamec                   @   s   e Zd ZddiZdS )Versionr   v1N__name__
__module____qualname___map r%   r%   3/tmp/pip-unpacked-wheel-etcy_95o/asn1crypto/ocsp.pyr   (   s    r   c                   @   s(   e Zd ZdefdefdefdefgZdS )CertIdZhash_algorithmZissuer_name_hashZissuer_key_hashZserial_numberN)r!   r"   r#   r   r   r   _fieldsr%   r%   r%   r&   r'   .   s
   r'   c                   @   s   e Zd ZdefdefgZdS )ServiceLocatorZissuerlocatorN)r!   r"   r#   r   r   r(   r%   r%   r%   r&   r)   7   s   r)   c                   @   s   e Zd ZddiZdS )RequestExtensionIdz1.3.6.1.5.5.7.48.1.7service_locatorNr    r%   r%   r%   r&   r+   >   s    r+   c                   @   s4   e Zd ZdefdeddifdefgZdZdeiZ	dS )	RequestExtensionextn_idcriticaldefaultF
extn_valuer.   r1   r,   N)
r!   r"   r#   r+   r
   r   r(   	_oid_pairr)   
_oid_specsr%   r%   r%   r&   r-   D   s    r-   c                   @   s   e Zd ZeZdS )RequestExtensionsN)r!   r"   r#   r-   _child_specr%   r%   r%   r&   r5   Q   s   r5   c                   @   sP   e Zd ZdefdedddfgZdZdZdZdd	 Z	e
d
d Ze
dd ZdS )RequestZreq_certsingle_request_extensionsr   TexplicitoptionalFNc                 C   sd   t  | _| d D ]H}|d j}d| }t| |rBt| ||d j |d jr| j| qd| _dS )v
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r8   r.   	_%s_valuer1   r/   TNset_critical_extensionsnativehasattrsetattrparsedadd_processed_extensionsself	extensionnameZattribute_namer%   r%   r&   _set_extensions_   s    


zRequest._set_extensionsc                 C   s   | j s|   | jS z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        rF   rK   r@   rH   r%   r%   r&   critical_extensionsq   s    
zRequest.critical_extensionsc                 C   s   | j dkr|   | jS )z
        This extension is used when communicating with an OCSP responder that
        acts as a proxy for OCSP requests

        :return:
            None or a ServiceLocator object
        F)rF   rK   _service_locator_valuerN   r%   r%   r&   service_locator_value   s    

zRequest.service_locator_value)r!   r"   r#   r'   r5   r(   rF   r@   rP   rK   propertyrO   rQ   r%   r%   r%   r&   r7   U   s   
r7   c                   @   s   e Zd ZeZdS )RequestsN)r!   r"   r#   r7   r6   r%   r%   r%   r&   rS      s   rS   c                   @   s   e Zd ZddiZdS )ResponseTypez1.3.6.1.5.5.7.48.1.1basic_ocsp_responseNr    r%   r%   r%   r&   rT      s    rT   c                   @   s   e Zd ZeZdS )AcceptableResponsesN)r!   r"   r#   rT   r6   r%   r%   r%   r&   rV      s   rV   c                   @   s"   e Zd ZdefdeddifgZdS )PreferredSignatureAlgorithmZsig_identifierZcert_identifierr;   TN)r!   r"   r#   r	   r   r(   r%   r%   r%   r&   rW      s   rW   c                   @   s   e Zd ZeZdS )PreferredSignatureAlgorithmsN)r!   r"   r#   rW   r6   r%   r%   r%   r&   rX      s   rX   c                   @   s   e Zd ZddddZdS )TBSRequestExtensionIdnonceacceptable_responsespreferred_signature_algorithms)1.3.6.1.5.5.7.48.1.2z1.3.6.1.5.5.7.48.1.4z1.3.6.1.5.5.7.48.1.8Nr    r%   r%   r%   r&   rY      s   rY   c                   @   s8   e Zd ZdefdeddifdefgZdZee	e
dZdS )	TBSRequestExtensionr.   r/   r0   Fr1   r2   )rZ   r[   r\   N)r!   r"   r#   rY   r
   r   r(   r3   r   rV   rX   r4   r%   r%   r%   r&   r^      s   r^   c                   @   s   e Zd ZeZdS )TBSRequestExtensionsN)r!   r"   r#   r^   r6   r%   r%   r%   r&   r_      s   r_   c                   @   s@   e Zd Zdedddfdedddfd	efd
edddfgZdS )
TBSRequestversionr   r   r:   r0   Zrequestor_namer   Tr9   Zrequest_listrequest_extensions   N)r!   r"   r#   r   r   rS   r_   r(   r%   r%   r%   r&   r`      s
   r`   c                   @   s   e Zd ZeZdS )CertificatesN)r!   r"   r#   r   r6   r%   r%   r%   r&   re      s   re   c                   @   s*   e Zd ZdefdefdedddfgZdS )	Signaturesignature_algorithm	signaturecertsr   Tr9   N)r!   r"   r#   r	   r   re   r(   r%   r%   r%   r&   rf      s   rf   c                   @   sp   e Zd ZdefdedddfgZdZdZdZdZ	dZ
dd	 Zed
d Zedd Zedd Zedd ZdS )OCSPRequesttbs_requestZoptional_signaturer   Tr9   FNc                 C   sh   t  | _| d d D ]H}|d j}d| }t| |rFt| ||d j |d jr| j| qd| _dS )	r<   rk   rc   r.   r=   r1   r/   TNr>   rG   r%   r%   r&   rK      s    


zOCSPRequest._set_extensionsc                 C   s   | j s|   | jS rL   rM   rN   r%   r%   r&   rO      s    
zOCSPRequest.critical_extensionsc                 C   s   | j dkr|   | jS )z
        This extension is used to prevent replay attacks by including a unique,
        random value with each request/response pair

        :return:
            None or an OctetString object
        FrF   rK   _nonce_valuerN   r%   r%   r&   nonce_value  s    

zOCSPRequest.nonce_valuec                 C   s   | j dkr|   | jS )a(  
        This extension is used to allow the client and server to communicate
        with alternative response formats other than just basic_ocsp_response,
        although no other formats are defined in the standard.

        :return:
            None or an AcceptableResponses object
        F)rF   rK   _acceptable_responses_valuerN   r%   r%   r&   acceptable_responses_value  s    
z&OCSPRequest.acceptable_responses_valuec                 C   s   | j dkr|   | jS )aj  
        This extension is used by the client to define what signature algorithms
        are preferred, including both the hash algorithm and the public key
        algorithm, with a level of detail down to even the public key algorithm
        parameters, such as curve name.

        :return:
            None or a PreferredSignatureAlgorithms object
        F)rF   rK   %_preferred_signature_algorithms_valuerN   r%   r%   r&   $preferred_signature_algorithms_value   s    
z0OCSPRequest.preferred_signature_algorithms_value)r!   r"   r#   r`   rf   r(   rF   r@   rm   ro   rq   rK   rR   rO   rn   rp   rr   r%   r%   r%   r&   rj      s"   


rj   c                   @   s   e Zd ZdddddddZdS )	OCSPResponseStatusZ
successfulZmalformed_requestZinternal_errorZ	try_laterZsign_requiredunauthorized)r   r   rd            Nr    r%   r%   r%   r&   rs   1  s   rs   c                   @   s(   e Zd ZdeddifdeddifgZdS )ResponderIdZby_namer:   r   by_keyrd   N)r!   r"   r#   r   r   _alternativesr%   r%   r%   r&   rx   <  s   rx   c                   @   s    e Zd Zdd Zedd ZdS )
StatusGoodc                 C   s6   |dk	r,|dkr,t |ts,ttdt|d| _dS )z`
        Sets the value of the object

        :param value:
            None or 'good'
        NgoodzK
                value must be one of None, "good", not %s
                    
isinstancer   
ValueErrorr   reprcontentsrH   valuer%   r%   r&   r?   E  s    zStatusGood.setc                 C   s   dS )Nr|   r%   rN   r%   r%   r&   rA   W  s    zStatusGood.nativeNr!   r"   r#   r?   rR   rA   r%   r%   r%   r&   r{   D  s   r{   c                   @   s    e Zd Zdd Zedd ZdS )StatusUnknownc                 C   s6   |dk	r,|dkr,t |ts,ttdt|d| _dS )zc
        Sets the value of the object

        :param value:
            None or 'unknown'
        NunknownzN
                value must be one of None, "unknown", not %s
                r}   r~   r   r%   r%   r&   r?   ^  s    zStatusUnknown.setc                 C   s   dS )Nr   r%   rN   r%   r%   r&   rA   p  s    zStatusUnknown.nativeNr   r%   r%   r%   r&   r   ]  s   r   c                   @   s$   e Zd ZdefdedddfgZdS )RevokedInfoZrevocation_timeZrevocation_reasonr   Tr9   N)r!   r"   r#   r   r   r(   r%   r%   r%   r&   r   u  s   r   c                   @   s4   e Zd ZdeddifdeddifdeddifgZdS )	
CertStatusr|   Zimplicitr   Zrevokedr   r   rd   N)r!   r"   r#   r{   r   r   rz   r%   r%   r%   r&   r   |  s   r   c                   @   s:   e Zd ZdedddfdedddfdedddfgZd	S )
CrlIdZcrl_urlr   Tr9   Zcrl_numr   Zcrl_timerd   N)r!   r"   r#   r   r   r   r(   r%   r%   r%   r&   r     s   r   c                   @   s   e Zd ZdddddddZdS )	SingleResponseExtensionIdcrlarchive_cutoff
crl_reasoninvalidity_datecertificate_issuer!signed_certificate_timestamp_list)z1.3.6.1.5.5.7.48.1.3z1.3.6.1.5.5.7.48.1.6z	2.5.29.21z	2.5.29.24z	2.5.29.29z1.3.6.1.4.1.11129.2.4.5Nr    r%   r%   r%   r&   r     s   r   c                   @   s>   e Zd ZdefdeddifdefgZdZee	e
e	eedZdS )	SingleResponseExtensionr.   r/   r0   Fr1   r2   )r   r   r   r   r   r   N)r!   r"   r#   r   r
   r   r(   r3   r   r   r   r   r   r4   r%   r%   r%   r&   r     s   r   c                   @   s   e Zd ZeZdS )SingleResponseExtensionsN)r!   r"   r#   r   r6   r%   r%   r%   r&   r     s   r   c                	   @   s   e Zd Zdefdefdefdedddfded	ddfgZd
ZdZ	dZ
dZdZdZdZdd Zedd Zedd Zedd Zedd Zedd Zedd ZdS )SingleResponseZcert_idZcert_statusZthis_updateZnext_updater   Tr9   single_extensionsr   FNc                 C   sd   t  | _| d D ]H}|d j}d| }t| |rBt| ||d j |d jr| j| qd| _dS )r<   r   r.   r=   r1   r/   TNr>   rG   r%   r%   r&   rK     s    


zSingleResponse._set_extensionsc                 C   s   | j s|   | jS rL   rM   rN   r%   r%   r&   rO     s    
z"SingleResponse.critical_extensionsc                 C   s   | j dkr|   | jS )z
        This extension is used to locate the CRL that a certificate's revocation
        is contained within.

        :return:
            None or a CrlId object
        F)rF   rK   
_crl_valuerN   r%   r%   r&   	crl_value  s    

zSingleResponse.crl_valuec                 C   s   | j dkr|   | jS )z
        This extension is used to indicate the date at which an archived
        (historical) certificate status entry will no longer be available.

        :return:
            None or a GeneralizedTime object
        F)rF   rK   _archive_cutoff_valuerN   r%   r%   r&   archive_cutoff_value  s    

z#SingleResponse.archive_cutoff_valuec                 C   s   | j dkr|   | jS )z
        This extension indicates the reason that a certificate was revoked.

        :return:
            None or a CRLReason object
        F)rF   rK   _crl_reason_valuerN   r%   r%   r&   crl_reason_value  s    	
zSingleResponse.crl_reason_valuec                 C   s   | j dkr|   | jS )a=  
        This extension indicates the suspected date/time the private key was
        compromised or the certificate became invalid. This would usually be
        before the revocation date, which is when the CA processed the
        revocation.

        :return:
            None or a GeneralizedTime object
        F)rF   rK   _invalidity_date_valuerN   r%   r%   r&   invalidity_date_value
  s    
z$SingleResponse.invalidity_date_valuec                 C   s   | j dkr|   | jS )z
        This extension indicates the issuer of the certificate in question.

        :return:
            None or an x509.GeneralNames object
        F)rF   rK   _certificate_issuer_valuerN   r%   r%   r&   certificate_issuer_value  s    	
z'SingleResponse.certificate_issuer_value)r!   r"   r#   r'   r   r   r   r(   rF   r@   r   r   r   r   r   rK   rR   rO   r   r   r   r   r   r%   r%   r%   r&   r     s4   




r   c                   @   s   e Zd ZeZdS )	ResponsesN)r!   r"   r#   r   r6   r%   r%   r%   r&   r   (  s   r   c                   @   s   e Zd ZdddZdS )ResponseDataExtensionIdrZ   extended_revoke)r]   z1.3.6.1.5.5.7.48.1.9Nr    r%   r%   r%   r&   r   ,  s   r   c                   @   s6   e Zd ZdefdeddifdefgZdZee	dZ
dS )	ResponseDataExtensionr.   r/   r0   Fr1   r2   )rZ   r   N)r!   r"   r#   r   r
   r   r(   r3   r   r   r4   r%   r%   r%   r&   r   3  s   r   c                   @   s   e Zd ZeZdS )ResponseDataExtensionsN)r!   r"   r#   r   r6   r%   r%   r%   r&   r   A  s   r   c                	   @   s>   e Zd Zdedddfdefdefdefded	d
dfgZdS )ResponseDatara   r   r   rb   Zresponder_idZproduced_at	responsesresponse_extensionsr   Tr9   N)	r!   r"   r#   r   rx   r   r   r   r(   r%   r%   r%   r&   r   E  s   r   c                   @   s0   e Zd ZdefdefdefdedddfgZdS )	BasicOCSPResponsetbs_response_datarg   rh   ri   r   Tr9   N)r!   r"   r#   r   r	   r   re   r(   r%   r%   r%   r&   r   O  s
   r   c                   @   s(   e Zd ZdefdefgZdZdeiZdS )ResponseBytesresponse_typeresponse)r   r   rU   N)	r!   r"   r#   rT   r   r(   r3   r   r4   r%   r%   r%   r&   r   X  s    r   c                   @   sx   e Zd ZdefdedddfgZdZdZdZdZ	dd	 Z
ed
d Zedd Zedd Zedd Zedd ZdS )OCSPResponseZresponse_statusresponse_bytesr   Tr9   FNc                 C   sr   t  | _| d d jd d D ]H}|d j}d| }t| |rPt| ||d j |d jr| j| qd	| _d
S )r<   r   r   r   r   r.   r=   r1   r/   TN)r?   r@   rD   rA   rB   rC   rE   rF   rG   r%   r%   r&   rK   o  s    


zOCSPResponse._set_extensionsc                 C   s   | j s|   | jS rL   rM   rN   r%   r%   r&   rO     s    
z OCSPResponse.critical_extensionsc                 C   s   | j dkr|   | jS )z
        This extension is used to prevent replay attacks on the request/response
        exchange

        :return:
            None or an OctetString object
        Frl   rN   r%   r%   r&   rn     s    

zOCSPResponse.nonce_valuec                 C   s   | j dkr|   | jS )z
        This extension is used to signal that the responder will return a
        "revoked" status for non-issued certificates.

        :return:
            None or a Null object (if present)
        F)rF   rK   _extended_revoke_valuerN   r%   r%   r&   extended_revoke_value  s    

z"OCSPResponse.extended_revoke_valuec                 C   s   | d d j S )z
        A shortcut into the BasicOCSPResponse sequence

        :return:
            None or an asn1crypto.ocsp.BasicOCSPResponse object
        r   r   rD   rN   r%   r%   r&   rU     s    	z OCSPResponse.basic_ocsp_responsec                 C   s   | d d j d S )z
        A shortcut into the parsed, ResponseData sequence

        :return:
            None or an asn1crypto.ocsp.ResponseData object
        r   r   r   r   rN   r%   r%   r&   response_data  s    	zOCSPResponse.response_data)r!   r"   r#   rs   r   r(   rF   r@   rm   r   rK   rR   rO   rn   r   rU   r   r%   r%   r%   r&   r   d  s$   




r   N)I__doc__
__future__r   r   r   r   _errorsr   Zalgosr   r	   corer
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   keysr   x509r   r   r   r   r   r'   r)   r+   r-   r5   r7   rS   rT   rV   rW   rX   rY   r^   r_   r`   re   rf   rj   rs   rx   r{   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%   r%   r%   r&   <module>   sZ   
<	9	Zx
	