int attemptParseTagForErrorMessage(CBS& cbs) {

  unsigned tag = 0;

  if (!CBS_get_any_asn1_element(&cbs, nullptr, &tag, nullptr)) {

  return tag;

}

readDerEncodedOcspResponse(const std::vector<uint8_t>& der) {

  CBS cbs;

  CBS_init(&cbs, der.data(), der.size());

  auto resp = Asn1OcspUtility::parseOcspResponse(cbs);

  if (CBS_len(&cbs) != 0) {

    return absl::InvalidArgumentError("Data contained more than a single OCSP response");

  }

  return resp;

}

absl::Status skipResponderId(CBS& cbs) {

  auto opt1 = Asn1Utility::getOptional(cbs, CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1);

  RETURN_IF_NOT_OK_REF(opt1.status());

  auto opt2 = Asn1Utility::getOptional(cbs, CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 2);

  RETURN_IF_NOT_OK_REF(opt2.status());

  if (opt1.value() || opt2.value()) {

    return absl::OkStatus();

  }

  return absl::InvalidArgumentError(

      absl::StrCat("Unknown choice for Responder ID: ", attemptParseTagForErrorMessage(cbs)));

}

absl::Status skipCertStatus(CBS& cbs) {

  auto opt1 = Asn1Utility::getOptional(cbs, CBS_ASN1_CONTEXT_SPECIFIC | 0);

  RETURN_IF_NOT_OK_REF(opt1.status());

  auto opt2 = Asn1Utility::getOptional(cbs, CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1);

  RETURN_IF_NOT_OK_REF(opt2.status());

  auto opt3 = Asn1Utility::getOptional(cbs, CBS_ASN1_CONTEXT_SPECIFIC | 2);

  RETURN_IF_NOT_OK_REF(opt3.status());

  if (!(opt1.value() || opt2.value() || opt3.value())) {

  return absl::OkStatus();

}

    : status_(status), response_(std::move(response)) {}

BasicOcspResponse::BasicOcspResponse(ResponseData data) : data_(data) {}

    : single_responses_(std::move(single_responses)) {}

    : cert_id_(cert_id), this_update_(this_update), next_update_(next_update) {}

CertId::CertId(std::string serial_number) : serial_number_(serial_number) {}

absl::Status validateResponse(std::unique_ptr<OcspResponse>& response) {

  if (response->status_ != OcspResponseStatus::Successful) {

    return absl::InvalidArgumentError("OCSP response was unsuccessful");

  }

  if (response->response_ == nullptr) {

    return absl::InvalidArgumentError("OCSP response has no body");

  }

  if (response->response_->getNumCerts() != 1) {

    return absl::InvalidArgumentError("OCSP Response must be for one certificate only");

  }

  return absl::OkStatus();

}

OcspResponseWrapperImpl::create(std::vector<uint8_t> der_response, TimeSource& time_source) {

  auto response_or_error = readDerEncodedOcspResponse(der_response);

  RETURN_IF_NOT_OK(response_or_error.status());

  RETURN_IF_NOT_OK(validateResponse(response_or_error.value()));

  return std::make_unique<OcspResponseWrapperImpl>(der_response, time_source,

                                                   std::move(response_or_error.value()));

}

    : raw_bytes_(std::move(der_response)), response_(std::move(response)),

      time_source_(time_source) {

  auto& this_update = response_->response_->getThisUpdate();

  if (time_source_.systemTime() < this_update) {

    std::string time_format(GENERALIZED_TIME_FORMAT);

    DateFormatter formatter(time_format);

    ENVOY_LOG_MISC(warn, "OCSP Response thisUpdate field is set in the future: {}",

                   formatter.fromTime(this_update));

  }

}

bool OcspResponseWrapperImpl::matchesCertificate(X509& cert) const {

  std::string cert_serial_number = CertUtility::getSerialNumberFromCertificate(cert);

  std::string resp_cert_serial_number = response_->response_->getCertSerialNumber();

  return resp_cert_serial_number == cert_serial_number;

}

bool OcspResponseWrapperImpl::isExpired() {

  auto& next_update = response_->response_->getNextUpdate();

  return next_update == absl::nullopt || next_update < time_source_.systemTime();

}

uint64_t OcspResponseWrapperImpl::secondsUntilExpiration() const {

  auto& next_update = response_->response_->getNextUpdate();

  auto now = time_source_.systemTime();

  if (!next_update || next_update.value() <= now) {

    return 0;

  }

  return std::chrono::duration_cast<std::chrono::seconds>(next_update.value() - now).count();

}

Envoy::SystemTime OcspResponseWrapperImpl::getThisUpdate() const {

  return response_->response_->getThisUpdate();

}

Envoy::SystemTime OcspResponseWrapperImpl::getNextUpdate() const {

  auto& next_update = response_->response_->getNextUpdate();

  if (next_update) {

    return *next_update;

  }

}

absl::StatusOr<std::unique_ptr<OcspResponse>> Asn1OcspUtility::parseOcspResponse(CBS& cbs) {

  CBS elem;

  if (!CBS_get_asn1(&cbs, &elem, CBS_ASN1_SEQUENCE)) {

    return absl::InvalidArgumentError("OCSP Response is not a well-formed ASN.1 SEQUENCE");

  }

  auto status_or_error = Asn1OcspUtility::parseResponseStatus(elem);

  RETURN_IF_NOT_OK_REF(status_or_error.status());

  auto opt = Asn1Utility::getOptional(elem, CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0);

  RETURN_IF_NOT_OK_REF(opt.status());

  auto maybe_bytes = std::move(opt.value());

  ResponsePtr resp = nullptr;

  if (maybe_bytes) {

    auto resp_or_error = Asn1OcspUtility::parseResponseBytes(maybe_bytes.value());

    RETURN_IF_NOT_OK_REF(resp_or_error.status());

    resp = std::move(resp_or_error.value());

  }

  return std::make_unique<OcspResponse>(status_or_error.value(), std::move(resp));

}

absl::StatusOr<OcspResponseStatus> Asn1OcspUtility::parseResponseStatus(CBS& cbs) {

  CBS status;

  if (!CBS_get_asn1(&cbs, &status, CBS_ASN1_ENUMERATED)) {

    return absl::InvalidArgumentError("OCSP ResponseStatus is not a well-formed ASN.1 ENUMERATED");

  }

  auto status_ordinal = *CBS_data(&status);

  switch (status_ordinal) {

  case 0:

    return OcspResponseStatus::Successful;

  case 1:

    return OcspResponseStatus::MalformedRequest;

  case 2:

    return OcspResponseStatus::InternalError;

  case 3:

    return OcspResponseStatus::TryLater;

  case 5:

    return OcspResponseStatus::SigRequired;

  case 6:

    return OcspResponseStatus::Unauthorized;

  default:

    return absl::InvalidArgumentError(

        absl::StrCat("Unknown OCSP Response Status variant: ", status_ordinal));

  }

}

absl::StatusOr<ResponsePtr> Asn1OcspUtility::parseResponseBytes(CBS& cbs) {

  CBS elem, response;

  if (!CBS_get_asn1(&cbs, &elem, CBS_ASN1_SEQUENCE)) {

    return absl::InvalidArgumentError("OCSP ResponseBytes is not a well-formed SEQUENCE");

  }

  auto parse_or_error = Asn1Utility::parseOid(elem);

  RETURN_IF_NOT_OK_REF(parse_or_error.status());

  auto oid_str = std::move(parse_or_error.value());

  if (!CBS_get_asn1(&elem, &response, CBS_ASN1_OCTETSTRING)) {

    return absl::InvalidArgumentError("Expected ASN.1 OCTETSTRING for response");

  }

  if (oid_str == BasicOcspResponse::OID) {

    return Asn1OcspUtility::parseBasicOcspResponse(response);

  }

  return absl::InvalidArgumentError(absl::StrCat("Unknown OCSP Response type with OID: ", oid_str));

}

Asn1OcspUtility::parseBasicOcspResponse(CBS& cbs) {

  CBS elem;

  if (!CBS_get_asn1(&cbs, &elem, CBS_ASN1_SEQUENCE)) {

    return absl::InvalidArgumentError(

        "OCSP BasicOCSPResponse is not a wellf-formed ASN.1 SEQUENCE");

  }

  auto response_or_error = Asn1OcspUtility::parseResponseData(elem);

  RETURN_IF_NOT_OK_REF(response_or_error.status());

  return std::make_unique<BasicOcspResponse>(response_or_error.value());

}

absl::StatusOr<ResponseData> Asn1OcspUtility::parseResponseData(CBS& cbs) {

  CBS elem;

  if (!CBS_get_asn1(&cbs, &elem, CBS_ASN1_SEQUENCE)) {

    return absl::InvalidArgumentError("OCSP ResponseData is not a well-formed ASN.1 SEQUENCE");

  }

  auto version_or_error =

      Asn1Utility::getOptional(elem, CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0);

  RETURN_IF_NOT_OK_REF(version_or_error.status());

  auto version_cbs = std::move(version_or_error.value());

  if (version_cbs.has_value()) {

    auto version_or_error = Asn1Utility::parseInteger(*version_cbs);

    RETURN_IF_NOT_OK_REF(version_or_error.status());

    auto version = std::move(version_or_error.value());

    if (version != "00") {

      return absl::InvalidArgumentError(

          fmt::format("OCSP ResponseData version 0x{} is not supported", version));

    }

  }

  auto status = skipResponderId(elem);

  RETURN_IF_NOT_OK(status);

  RETURN_IF_NOT_OK_REF(Asn1Utility::skip(elem, CBS_ASN1_GENERALIZEDTIME).status());

  auto responses_or_error = Asn1Utility::parseSequenceOf<SingleResponse>(

      elem, [](CBS& cbs) -> absl::StatusOr<SingleResponse> { return {parseSingleResponse(cbs)}; });

  RETURN_IF_NOT_OK_REF(responses_or_error.status());

  return {std::move(responses_or_error.value())};

}

absl::StatusOr<SingleResponse> Asn1OcspUtility::parseSingleResponse(CBS& cbs) {

  CBS elem;

  if (!CBS_get_asn1(&cbs, &elem, CBS_ASN1_SEQUENCE)) {

    return absl::InvalidArgumentError("OCSP SingleResponse is not a well-formed ASN.1 SEQUENCE");

  }

  auto id_or_error = Asn1OcspUtility::parseCertId(elem);

  RETURN_IF_NOT_OK_REF(id_or_error.status());

  RETURN_IF_NOT_OK(skipCertStatus(elem));

  auto this_update_or_error = Asn1Utility::parseGeneralizedTime(elem);

  RETURN_IF_NOT_OK_REF(this_update_or_error.status());

  auto next_update_or_error = Asn1Utility::parseOptional<Envoy::SystemTime>(

      elem, Asn1Utility::parseGeneralizedTime,

      CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0);

  RETURN_IF_NOT_OK_REF(next_update_or_error.status());

  return SingleResponse{id_or_error.value(), this_update_or_error.value(),

                        next_update_or_error.value()};

}

absl::StatusOr<CertId> Asn1OcspUtility::parseCertId(CBS& cbs) {

  CBS elem;

  if (!CBS_get_asn1(&cbs, &elem, CBS_ASN1_SEQUENCE)) {

    return absl::InvalidArgumentError("OCSP CertID is not a well-formed ASN.1 SEQUENCE");

  }

  RETURN_IF_NOT_OK_REF(Asn1Utility::skip(elem, CBS_ASN1_SEQUENCE).status());

  RETURN_IF_NOT_OK_REF(Asn1Utility::skip(elem, CBS_ASN1_OCTETSTRING).status());

  RETURN_IF_NOT_OK_REF(Asn1Utility::skip(elem, CBS_ASN1_OCTETSTRING).status());

  auto serial_number_or_error = Asn1Utility::parseInteger(elem);

  RETURN_IF_NOT_OK_REF(serial_number_or_error.status());

  return {serial_number_or_error.value()};

}