o
    CZhF                     @  s>  d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZejejejejejfZd!ddZG dd dejZG dd dZG dd dejdZ G dd dejdZ!G dd dejdZ"G dd dZ#G dd  d Z$e	j%Z%e	j&Z&dS )"    )annotationsN)utilsx509)ocsp)hashesserialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   M/var/www/html/lang_env/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr      s    r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s    r   	algorithmhashes.HashAlgorithmreturnNonec                 C  s   t | ts	tdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm/   s
   
r$   c                   @  s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDUNKNOWNr   r   r   r   r%   6   s    r%   c                   @  s   e Zd ZdddZdS )_SingleResponsecertx509.Certificateissuerr   r   cert_statusr%   this_updatedatetime.datetimenext_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec	           	      C  s  t |tjrt |tjstdt| t |tjstd|d ur,t |tjs,td|| _|| _|| _|| _	|| _
t |tsDtd|tjurZ|d urQtd|d urYtdn$t |tjsdtdt|}|tk rptd|d ur~t |tjs~td	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r!   r   Certificate	TypeErrorr$   datetimeZ_certZ_issuer
_algorithmZ_this_updateZ_next_updater%   r&   r#   r
   r	   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr)   r+   r   r,   r-   r/   r1   r2   r   r   r   __init__=   s\   




z_SingleResponse.__init__N)r)   r*   r+   r*   r   r   r,   r%   r-   r.   r/   r0   r1   r0   r2   r3   )r   r   r   r:   r   r   r   r   r(   <   s    r(   c                   @  s   e Zd ZeejdddZeejdddZeejddd	ZeejdddZ	ejdddZ
eejdddZdS )OCSPRequestr   bytesc                 C     dS z3
        The hash of the issuer public key
        Nr   r9   r   r   r   issuer_key_hash       zOCSPRequest.issuer_key_hashc                 C  r=   z-
        The hash of the issuer name
        Nr   r?   r   r   r   issuer_name_hash   rA   zOCSPRequest.issuer_name_hashr   c                 C  r=   zK
        The hash algorithm used in the issuer name and key hashes
        Nr   r?   r   r   r   hash_algorithm   rA   zOCSPRequest.hash_algorithmintc                 C  r=   zM
        The serial number of the cert whose status is being checked
        Nr   r?   r   r   r   serial_number   rA   zOCSPRequest.serial_numberencodingserialization.Encodingc                 C  r=   )z/
        Serializes the request to DER
        Nr   r9   rI   r   r   r   public_bytes   rA   zOCSPRequest.public_bytesx509.Extensionsc                 C  r=   )zP
        The list of request extensions. Not single request extensions.
        Nr   r?   r   r   r   
extensions   rA   zOCSPRequest.extensionsNr   r<   r   r   r   rF   rI   rJ   r   r<   r   rM   )r   r   r   propertyabcabstractmethodr@   rC   rE   rH   rL   rN   r   r   r   r   r;      s$    r;   )	metaclassc                   @  s   e Zd ZeejdddZeejdddZeejdd	d
ZeejdddZ	eejdddZ
eejd ddZeejd ddZeejd!ddZeejd"ddZdS )#OCSPSingleResponser   r%   c                 C  r=   zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   r?   r   r   r   certificate_status   rA   z%OCSPSingleResponse.certificate_statusr0   c                 C  r=   z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   r?   r   r   r   r1      rA   z"OCSPSingleResponse.revocation_timer3   c                 C  r=   zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   r?   r   r   r   r2      rA   z$OCSPSingleResponse.revocation_reasonr.   c                 C  r=   z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   r?   r   r   r   r-      rA   zOCSPSingleResponse.this_updatec                 C  r=   zC
        The time when newer information will be available
        Nr   r?   r   r   r   r/      rA   zOCSPSingleResponse.next_updater<   c                 C  r=   r>   r   r?   r   r   r   r@      rA   z"OCSPSingleResponse.issuer_key_hashc                 C  r=   rB   r   r?   r   r   r   rC      rA   z#OCSPSingleResponse.issuer_name_hashr   c                 C  r=   rD   r   r?   r   r   r   rE      rA   z!OCSPSingleResponse.hash_algorithmrF   c                 C  r=   rG   r   r?   r   r   r   rH      rA   z OCSPSingleResponse.serial_numberNr   r%   r   r0   r   r3   r   r.   rO   rP   rQ   )r   r   r   rT   rU   rV   rZ   r1   r2   r-   r/   r@   rC   rE   rH   r   r   r   r   rX      s8    rX   c                   @  s  e Zd Zeejd@ddZeejdAddZeejdBd	d
ZeejdCddZ	eejdDddZ
eejdDddZeejdEddZeejdFddZeejdGddZeejdHddZeejdId d!ZeejdJd#d$ZeejdKd&d'ZeejdHd(d)ZeejdJd*d+ZeejdDd,d-ZeejdDd.d/ZeejdLd1d2ZeejdMd4d5ZeejdNd7d8ZeejdNd9d:ZejdOd=d>Zd?S )POCSPResponser   #typing.Iterator[OCSPSingleResponse]c                 C  r=   )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   r?   r   r   r   	responses   rA   zOCSPResponse.responsesr   c                 C  r=   )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   r?   r   r   r   response_status   rA   zOCSPResponse.response_statusx509.ObjectIdentifierc                 C  r=   )zA
        The ObjectIdentifier of the signature algorithm
        Nr   r?   r   r   r   signature_algorithm_oid  rA   z$OCSPResponse.signature_algorithm_oidhashes.HashAlgorithm | Nonec                 C  r=   )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   r?   r   r   r   signature_hash_algorithm	  rA   z%OCSPResponse.signature_hash_algorithmr<   c                 C  r=   )z%
        The signature bytes
        Nr   r?   r   r   r   	signature  rA   zOCSPResponse.signaturec                 C  r=   )z+
        The tbsResponseData bytes
        Nr   r?   r   r   r   tbs_response_bytes  rA   zOCSPResponse.tbs_response_byteslist[x509.Certificate]c                 C  r=   )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   r?   r   r   r   certificates   rA   zOCSPResponse.certificatesbytes | Nonec                 C  r=   )z2
        The responder's key hash or None
        Nr   r?   r   r   r   responder_key_hash)  rA   zOCSPResponse.responder_key_hashx509.Name | Nonec                 C  r=   )z.
        The responder's Name or None
        Nr   r?   r   r   r   responder_name0  rA   zOCSPResponse.responder_namer.   c                 C  r=   )z4
        The time the response was produced
        Nr   r?   r   r   r   produced_at7  rA   zOCSPResponse.produced_atr%   c                 C  r=   rY   r   r?   r   r   r   rZ   >  rA   zOCSPResponse.certificate_statusr0   c                 C  r=   r[   r   r?   r   r   r   r1   E  rA   zOCSPResponse.revocation_timer3   c                 C  r=   r\   r   r?   r   r   r   r2   M  rA   zOCSPResponse.revocation_reasonc                 C  r=   r]   r   r?   r   r   r   r-   U  rA   zOCSPResponse.this_updatec                 C  r=   r^   r   r?   r   r   r   r/   ]  rA   zOCSPResponse.next_updatec                 C  r=   r>   r   r?   r   r   r   r@   d  rA   zOCSPResponse.issuer_key_hashc                 C  r=   rB   r   r?   r   r   r   rC   k  rA   zOCSPResponse.issuer_name_hashr   c                 C  r=   rD   r   r?   r   r   r   rE   r  rA   zOCSPResponse.hash_algorithmrF   c                 C  r=   rG   r   r?   r   r   r   rH   y  rA   zOCSPResponse.serial_numberrM   c                 C  r=   )zR
        The list of response extensions. Not single response extensions.
        Nr   r?   r   r   r   rN     rA   zOCSPResponse.extensionsc                 C  r=   )zR
        The list of single response extensions. Not response extensions.
        Nr   r?   r   r   r   single_extensions  rA   zOCSPResponse.single_extensionsrI   rJ   c                 C  r=   )z0
        Serializes the response to DER
        Nr   rK   r   r   r   rL     rA   zOCSPResponse.public_bytesN)r   rd   )r   r   )r   rg   )r   ri   rO   )r   rm   )r   ro   )r   rq   rb   r_   r`   ra   rP   rQ   rS   rR   )r   r   r   rT   rU   rV   re   rf   rh   rj   rk   rl   rn   rp   rr   rs   rZ   r1   r2   r-   r/   r@   rC   rE   rH   rN   rt   rL   r   r   r   r   rc      s    rc   c                   @  sF   e Zd Zddg fd#d
dZd$ddZd%ddZd&ddZd'd!d"ZdS )(OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonerequest_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | NonerN   (list[x509.Extension[x509.ExtensionType]]r   r    c                 C  s   || _ || _|| _d S N)_request_request_hash_extensions)r9   rv   rx   rN   r   r   r   r:     s   

zOCSPRequestBuilder.__init__r)   r*   r+   r   r   c                 C  sZ   | j d us
| jd urtdt| t|tjrt|tjs"tdt|||f| j| j	S )N.Only one certificate can be added to a requestr4   )
r|   r}   r#   r$   r!   r   r5   r6   ru   r~   )r9   r)   r+   r   r   r   r   add_certificate  s   z"OCSPRequestBuilder.add_certificaterC   r<   r@   rH   rF   c                 C  s   | j d us
| jd urtdt|tstdt| td| td| |j	t
|ks5|j	t
|kr9tdt| j ||||f| jS )Nr   z serial_number must be an integerrC   r@   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r|   r}   r#   r!   rF   r6   r$   r   _check_bytesdigest_sizelenru   r~   )r9   rC   r@   rH   r   r   r   r   add_certificate_by_hash  s&   

z*OCSPRequestBuilder.add_certificate_by_hashextvalx509.ExtensionTypecriticalboolc                 C  sJ   t |tjs
tdt|j||}t|| j t| j	| j
g | j|S Nz"extension must be an ExtensionType)r!   r   ExtensionTyper6   	Extensionoidr   r~   ru   r|   r}   r9   r   r   	extensionr   r   r   add_extension  s   z OCSPRequestBuilder.add_extensionr;   c                 C  s&   | j d u r| jd u rtdt| S )Nz*You must add a certificate before building)r|   r}   r#   r   Zcreate_ocsp_requestr?   r   r   r   build  s   
zOCSPRequestBuilder.build)rv   rw   rx   ry   rN   rz   r   r    )r)   r*   r+   r*   r   r   r   ru   )
rC   r<   r@   r<   rH   rF   r   r   r   ru   )r   r   r   r   r   ru   )r   r;   )r   r   r   r:   r   r   r   r   r   r   r   r   ru     s    


ru   c                   @  s`   e Zd Zdddg fd5d
dZd6ddZd7d d!Zd8d#d$Zd9d)d*Zd:d/d0Ze	d;d3d4Z
dS )<OCSPResponseBuilderNresponse_SingleResponse | Noneresponder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecertslist[x509.Certificate] | NonerN   rz   c                 C  s   || _ || _|| _|| _d S r{   )	_response_responder_id_certsr~   )r9   r   r   r   rN   r   r   r   r:     s   
zOCSPResponseBuilder.__init__r)   r*   r+   r   r   r,   r%   r-   r.   r/   r0   r1   r2   r3   r   c	           
   	   C  s<   | j d ur	tdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)r   r#   r(   r   r   r   r~   )
r9   r)   r+   r   r,   r-   r/   r1   r2   Z
singlerespr   r   r   add_response  s$   

z OCSPResponseBuilder.add_responserI   r   responder_certc                 C  sP   | j d ur	tdt|tjstdt|tstdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r   r#   r!   r   r5   r6   r   r   r   r   r~   )r9   rI   r   r   r   r   r     s   

z OCSPResponseBuilder.responder_id!typing.Iterable[x509.Certificate]c                 C  s\   | j d ur	tdt|}t|dkrtdtdd |D s$tdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s    | ]	}t |tjV  qd S r{   )r!   r   r5   ).0xr   r   r   	<genexpr>1  s    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r   r#   listr   allr6   r   r   r   r~   )r9   r   r   r   r   rn   )  s   
z OCSPResponseBuilder.certificatesr   r   r   r   c                 C  sN   t |tjs
tdt|j||}t|| j t| j	| j
| jg | j|S r   )r!   r   r   r6   r   r   r   r~   r   r   r   r   r   r   r   r   r   :  s   z!OCSPResponseBuilder.add_extensionprivate_keyr   ri   rc   c                 C  s6   | j d u r	td| jd u rtdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)r   r#   r   r   create_ocsp_responser   r   )r9   r   r   r   r   r   signJ  s   


zOCSPResponseBuilder.signrf   r   c                 C  s4   t |ts	td|tju rtdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r!   r   r6   r   r#   r   r   )clsrf   r   r   r   build_unsuccessfulX  s   

z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r   r   r   rN   rz   )r)   r*   r+   r*   r   r   r,   r%   r-   r.   r/   r0   r1   r0   r2   r3   r   r   )rI   r   r   r*   r   r   )r   r   r   r   )r   r   r   r   r   r   )r   r   r   ri   r   rc   )rf   r   r   rc   )r   r   r   r:   r   r   rn   r   r   classmethodr   r   r   r   r   r     s    




r   )r   r   r   r    )'
__future__r   rU   r7   typingZcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser	   r
   r   Enumr   r   SHA1SHA224SHA256SHA384SHA512r"   r$   r%   r(   ABCMetar;   rX   rc   ru   r   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   <module>   s8   

	F+D %T}
