U
    Ê¹Öh›1  ã                   @  s
  d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ G d	d
„ d
ejƒZG dd„ dejƒZejejejejejfZdddœdd„ZG dd„ dejƒZG dd„ dƒZe	jZe	jZe	jZG dd„ dƒZG dd„ dƒZ e	j!Z!e	j"Z"dS )é    )ÚannotationsN)ÚIterable)ÚutilsÚx509)Úocsp)Úhashes)Ú CertificateIssuerPrivateKeyTypes)Ú_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú
__module__Ú__qualname__ZHASHÚNAME© r   r   ú<./venv/lib/python3.8/site-packages/cryptography/x509/ocsp.pyr
      s   r
   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚOCSPResponseStatusr   é   é   é   é   é   N)	r   r   r   Ú
SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDZUNAUTHORIZEDr   r   r   r   r      s   r   úhashes.HashAlgorithmÚNone)Ú	algorithmÚreturnc                 C  s   t | tƒstdƒ‚d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú
isinstanceÚ_ALLOWED_HASHESÚ
ValueError)r   r   r   r   Ú_verify_algorithm*   s    
ÿr   c                   @  s   e Zd ZdZdZdZdS )ÚOCSPCertStatusr   r   r   N)r   r   r   ZGOODÚREVOKEDZUNKNOWNr   r   r   r   r    1   s   r    c                	   @  s(   e Zd Zdddddddddœd	d
„ZdS )Ú_SingleResponsez0tuple[x509.Certificate, x509.Certificate] | Noneztuple[bytes, bytes, int] | Noner   r    údatetime.datetimeúdatetime.datetime | Noneúx509.ReasonFlags | None)ÚrespÚ	resp_hashr   Úcert_statusÚthis_updateÚnext_updateÚrevocation_timeÚrevocation_reasonc	           	      C  sÚ   t |ƒ t|tjƒstdƒ‚|d k	r8t|tjƒs8tdƒ‚|| _|| _|| _|| _|| _t|t	ƒshtdƒ‚|t	j
k	r”|d k	r‚tdƒ‚|d k	rÄtdƒ‚n0t|tjƒs¨tdƒ‚|d k	rÄt|tjƒsÄtdƒ‚|| _|| _|| _d S )Nz%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectzCrevocation_reason must be an item from the ReasonFlags enum or None)r   r   ÚdatetimeÚ	TypeErrorZ_respZ
_resp_hashZ
_algorithmZ_this_updateZ_next_updater    r!   r   r   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	Úselfr&   r'   r   r(   r)   r*   r+   r,   r   r   r   Ú__init__8   sL    
 ÿ
ÿ
ÿÿ
 ÿÿz_SingleResponse.__init__N)r   r   r   r0   r   r   r   r   r"   7   s   r"   c                   @  sr   e Zd Zddg fdddddœdd„Zd	d	d
d dœdd„Zdddd
d dœdd„Zddd dœdd„Zddœdd„ZdS )ÚOCSPRequestBuilderNzFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonez5tuple[bytes, bytes, int, hashes.HashAlgorithm] | Noneú(list[x509.Extension[x509.ExtensionType]]r   )ÚrequestÚrequest_hashÚ
extensionsr   c                 C  s   || _ || _|| _d S ©N)Ú_requestÚ_request_hashÚ_extensions)r/   r3   r4   r5   r   r   r   r0   w   s    
zOCSPRequestBuilder.__init__úx509.Certificater   )ÚcertÚissuerr   r   c                 C  sZ   | j d k	s| jd k	rtdƒ‚t|ƒ t|tjƒr<t|tjƒsDtdƒ‚t|||f| j| j	ƒS )Nú.Only one certificate can be added to a requestú%cert and issuer must be a Certificate)
r7   r8   r   r   r   r   ÚCertificater.   r1   r9   )r/   r;   r<   r   r   r   r   Úadd_certificate…   s     ÿ  ÿz"OCSPRequestBuilder.add_certificateÚbytesÚint)Úissuer_name_hashÚissuer_key_hashÚserial_numberr   r   c                 C  sŠ   | j d k	s| jd k	rtdƒ‚t|tƒs.tdƒ‚t|ƒ t d|¡ t d|¡ |j	t
|ƒksj|j	t
|ƒkrrtdƒ‚t| j ||||f| jƒS )Nr=   ú serial_number must be an integerrC   rD   ú`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r7   r8   r   r   rB   r.   r   r   Ú_check_bytesÚdigest_sizeÚlenr1   r9   )r/   rC   rD   rE   r   r   r   r   Úadd_certificate_by_hash˜   s(    
ÿþÿ
ýz*OCSPRequestBuilder.add_certificate_by_hashúx509.ExtensionTypeÚbool©ÚextvalÚcriticalr   c                 C  sH   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| j|f•ƒS ©Nz"extension must be an ExtensionType)r   r   ÚExtensionTyper.   Ú	ExtensionÚoidr	   r9   r1   r7   r8   ©r/   rO   rP   Ú	extensionr   r   r   Úadd_extension¶   s      
ÿz OCSPRequestBuilder.add_extensionÚOCSPRequest)r   c                 C  s&   | j d kr| jd krtdƒ‚t | ¡S )Nz*You must add a certificate before building)r7   r8   r   r   Zcreate_ocsp_request)r/   r   r   r   ÚbuildÃ   s    zOCSPRequestBuilder.build)r   r   r   r0   r@   rK   rW   rY   r   r   r   r   r1   v   s   ør1   c                   @  sÂ   e Zd Zdddg fdddddœdd„Zd	d	d
dddddd dœ	dd„Zdddd
dddddd dœ
dd„Zdd	d dœdd„Zdd dœdd„Zdd d d!œd"d#„Zd$d%d&d'œd(d)„Z	e
d*d&d+œd,d-„ƒZdS ).ÚOCSPResponseBuilderNz_SingleResponse | Nonez5tuple[x509.Certificate, OCSPResponderEncoding] | Nonezlist[x509.Certificate] | Noner2   )ÚresponseÚresponder_idÚcertsr5   c                 C  s   || _ || _|| _|| _d S r6   )Ú	_responseÚ_responder_idÚ_certsr9   )r/   r[   r\   r]   r5   r   r   r   r0   Ë   s    zOCSPResponseBuilder.__init__r:   r   r    r#   r$   r%   )	r;   r<   r   r(   r)   r*   r+   r,   r   c	           
   	   C  s`   | j d k	rtdƒ‚t|tjƒr*t|tjƒs2tdƒ‚t||fd ||||||ƒ}	t|	| j| j	| j
ƒS )Nú#Only one response per OCSPResponse.r>   )r^   r   r   r   r?   r.   r"   rZ   r_   r`   r9   )
r/   r;   r<   r   r(   r)   r*   r+   r,   Ú
singlerespr   r   r   Úadd_responseØ   s.    
 ÿø
üz OCSPResponseBuilder.add_responserA   rB   )
rC   rD   rE   r   r(   r)   r*   r+   r,   r   c
              	   C  s˜   | j d k	rtdƒ‚t|tƒs$tdƒ‚t d|¡ t d|¡ t|ƒ |jt	|ƒks`|jt	|ƒkrhtdƒ‚t
d |||f||||||	ƒ}
t|
| j| j| jƒS )Nra   rF   rC   rD   rG   )r^   r   r   rB   r.   r   rH   r   rI   rJ   r"   rZ   r_   r`   r9   )r/   rC   rD   rE   r   r(   r)   r*   r+   r,   rb   r   r   r   Úadd_response_by_hashü   s>    

ÿþÿø
üz(OCSPResponseBuilder.add_response_by_hashr
   )ÚencodingÚresponder_certr   c                 C  sP   | j d k	rtdƒ‚t|tjƒs&tdƒ‚t|tƒs8tdƒ‚t| j||f| j	| j
ƒS )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r_   r   r   r   r?   r.   r
   rZ   r^   r`   r9   )r/   re   rf   r   r   r   r\   *  s    

ÿüz OCSPResponseBuilder.responder_idzIterable[x509.Certificate])r]   r   c                 C  s\   | j d k	rtdƒ‚t|ƒ}t|ƒdkr.tdƒ‚tdd„ |D ƒƒsHtdƒ‚t| j| j|| j	ƒS )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   | ]}t |tjƒV  qd S r6   )r   r   r?   )Ú.0Úxr   r   r   Ú	<genexpr>E  s     z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r`   r   ÚlistrJ   Úallr.   rZ   r^   r_   r9   )r/   r]   r   r   r   Úcertificates=  s    
üz OCSPResponseBuilder.certificatesrL   rM   rN   c                 C  sL   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| j| j|f•ƒS rQ   )r   r   rR   r.   rS   rT   r	   r9   rZ   r^   r_   r`   rU   r   r   r   rW   N  s    
üz!OCSPResponseBuilder.add_extensionr   zhashes.HashAlgorithm | NoneÚOCSPResponse)Úprivate_keyr   r   c                 C  s6   | j d krtdƒ‚| jd kr$tdƒ‚t tj| ||¡S )Nz&You must add a response before signingz*You must add a responder_id before signing)r^   r   r_   r   Úcreate_ocsp_responser   r   )r/   rn   r   r   r   r   Úsign^  s    

   ÿzOCSPResponseBuilder.signr   )Úresponse_statusr   c                 C  s4   t |tƒstdƒ‚|tjkr$tdƒ‚t |d d d ¡S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r.   r   r   r   ro   )Úclsrq   r   r   r   Úbuild_unsuccessfull  s    
ÿ
z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r0   rc   rd   r\   rl   rW   rp   Úclassmethodrs   r   r   r   r   rZ   Ê   s   ú$ .rZ   )#Z
__future__r   r-   Zcollections.abcr   Zcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser	   ÚEnumr
   r   ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512r   r   r    r"   rX   rm   ZOCSPSingleResponser1   rZ   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   Ú<module>   s4   
û	:T 1