
    3TffH                    <   d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZmZmZ  G d d	ej&                        Z G d
 dej&                        Zej,                  ej.                  ej0                  ej2                  ej4                  fZddZ G d dej&                        Z G d d      Z G d dej>                        Z  G d dej>                        Z! G d dej>                        Z" G d d      Z# G d d      Z$ddZ%d dZ&y)!    )annotationsN)utilsx509)ocsp)hashesserialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                      e Zd ZdZdZy)OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME     8/usr/lib/python3/dist-packages/cryptography/x509/ocsp.pyr   r      s    DDr   r   c                  $    e Zd ZdZdZdZdZdZdZy)OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULMALFORMED_REQUESTINTERNAL_ERROR	TRY_LATERSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s!    JNILLr   r   c                :    t        | t              st        d      y )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)	algorithms    r   _verify_algorithmr)   /   s!    i1G
 	
 2r   c                      e Zd ZdZdZdZy)OCSPCertStatusr   r   r   N)r   r   r   GOODREVOKEDUNKNOWNr   r   r   r+   r+   6   s    DGGr   r+   c                  4    e Zd Z	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 ddZy)_SingleResponsec	                   t        |t        j                        rt        |t        j                        st        d      t	        |       t        |t
        j
                        st        d      |%t        |t
        j
                        st        d      || _        || _        || _        || _	        || _
        t        |t              st        d      |t        j                  ur|t        d      |vt        d      t        |t
        j
                        st        d      t        |      }|t        k  rt        d      |%t        |t        j                         st        d	      || _        || _        || _        y )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r%   r   Certificate	TypeErrorr)   datetime_cert_issuer
_algorithm_this_update_next_updater+   r-   r'   r   r
   ReasonFlags_cert_status_revocation_time_revocation_reason)	selfcertissuerr(   cert_statusthis_updatenext_updaterevocation_timerevocation_reasons	            r   __init__z_SingleResponse.__init__=   s    $ 0 01D$$:
 CDD)$+x'8'89CDD":**,
 KLL
#''+~6J  n444* !  !, " 
 ox/@/@A KLL8IO!33 ' 
 !,Z!4#3#36  # 
 ( /"3r   N)r@   x509.CertificaterA   rH   r(   hashes.HashAlgorithmrB   r+   rC   datetime.datetimerD   "typing.Optional[datetime.datetime]rE   rK   rF   !typing.Optional[x509.ReasonFlags])r   r   r   rG   r   r   r   r0   r0   <   s^    B4B4 !B4 (	B4
 $B4 'B4 8B4 <B4 =B4r   r0   c                  "   e Zd Zeej
                  dd              Zeej
                  dd              Zeej
                  d	d              Zeej
                  d
d              Z	ej
                  dd       Z
eej
                  dd              Zy)OCSPRequestc                     yz3
        The hash of the issuer public key
        Nr   r?   s    r   issuer_key_hashzOCSPRequest.issuer_key_hash       r   c                     yz-
        The hash of the issuer name
        Nr   rQ   s    r   issuer_name_hashzOCSPRequest.issuer_name_hash   rS   r   c                     yzK
        The hash algorithm used in the issuer name and key hashes
        Nr   rQ   s    r   hash_algorithmzOCSPRequest.hash_algorithm   rS   r   c                     yzM
        The serial number of the cert whose status is being checked
        Nr   rQ   s    r   serial_numberzOCSPRequest.serial_number   rS   r   c                     y)z/
        Serializes the request to DER
        Nr   r?   encodings     r   public_byteszOCSPRequest.public_bytes   rS   r   c                     y)zP
        The list of request extensions. Not single request extensions.
        Nr   rQ   s    r   
extensionszOCSPRequest.extensions   rS   r   Nreturnbytesrd   rI   rd   intr_   zserialization.Encodingrd   re   rd   zx509.Extensions)r   r   r   propertyabcabstractmethodrR   rV   rY   r\   r`   rb   r   r   r   rN   rN      s      
   
   
   
 	 
   r   rN   )	metaclassc                     e Zd Zeej
                  dd              Zeej
                  dd              Zeej
                  dd              Zeej
                  dd              Z	eej
                  dd              Z
eej
                  dd              Zeej
                  dd              Zeej
                  dd              Zeej
                  dd	              Zy
)OCSPSingleResponsec                     yzY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   rQ   s    r   certificate_statusz%OCSPSingleResponse.certificate_status   rS   r   c                     yz^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   rQ   s    r   rE   z"OCSPSingleResponse.revocation_time   rS   r   c                     yzi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   rQ   s    r   rF   z$OCSPSingleResponse.revocation_reason   rS   r   c                     yz
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   rQ   s    r   rC   zOCSPSingleResponse.this_update   rS   r   c                     yzC
        The time when newer information will be available
        Nr   rQ   s    r   rD   zOCSPSingleResponse.next_update   rS   r   c                     yrP   r   rQ   s    r   rR   z"OCSPSingleResponse.issuer_key_hash   rS   r   c                     yrU   r   rQ   s    r   rV   z#OCSPSingleResponse.issuer_name_hash   rS   r   c                     yrX   r   rQ   s    r   rY   z!OCSPSingleResponse.hash_algorithm   rS   r   c                     yr[   r   rQ   s    r   r\   z OCSPSingleResponse.serial_number   rS   r   Nrd   r+   rd   rK   rd   rL   rd   rJ   rc   rf   rg   )r   r   r   rk   rl   rm   rs   rE   rF   rC   rD   rR   rV   rY   r\   r   r   r   rp   rp      s2     
            
   
   
   
   r   rp   c                  &   e Zd Zeej
                  dd              Zeej
                  dd              Zeej
                  dd              Zeej
                  	 	 dd              Z	eej
                  dd              Z
eej
                  dd              Zeej
                  dd              Zeej
                  dd              Zeej
                  dd	              Zeej
                  d d
              Zeej
                  d!d              Zeej
                  d"d              Zeej
                  d#d              Zeej
                  d d              Zeej
                  d"d              Zeej
                  dd              Zeej
                  dd              Zeej
                  d$d              Zeej
                  d%d              Zeej
                  d&d              Zeej
                  d&d              Zej
                  d'd       Zy)(OCSPResponsec                     y)z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   rQ   s    r   	responseszOCSPResponse.responses   rS   r   c                     y)zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   rQ   s    r   response_statuszOCSPResponse.response_status   rS   r   c                     y)zA
        The ObjectIdentifier of the signature algorithm
        Nr   rQ   s    r   signature_algorithm_oidz$OCSPResponse.signature_algorithm_oid  rS   r   c                     y)zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   rQ   s    r   signature_hash_algorithmz%OCSPResponse.signature_hash_algorithm	  rS   r   c                     y)z%
        The signature bytes
        Nr   rQ   s    r   	signaturezOCSPResponse.signature  rS   r   c                     y)z+
        The tbsResponseData bytes
        Nr   rQ   s    r   tbs_response_byteszOCSPResponse.tbs_response_bytes  rS   r   c                     y)z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   rQ   s    r   certificateszOCSPResponse.certificates   rS   r   c                     y)z2
        The responder's key hash or None
        Nr   rQ   s    r   responder_key_hashzOCSPResponse.responder_key_hash)  rS   r   c                     y)z.
        The responder's Name or None
        Nr   rQ   s    r   responder_namezOCSPResponse.responder_name0  rS   r   c                     y)z4
        The time the response was produced
        Nr   rQ   s    r   produced_atzOCSPResponse.produced_at7  rS   r   c                     yrr   r   rQ   s    r   rs   zOCSPResponse.certificate_status>  rS   r   c                     yru   r   rQ   s    r   rE   zOCSPResponse.revocation_timeE  rS   r   c                     yrw   r   rQ   s    r   rF   zOCSPResponse.revocation_reasonM  rS   r   c                     yry   r   rQ   s    r   rC   zOCSPResponse.this_updateU  rS   r   c                     yr{   r   rQ   s    r   rD   zOCSPResponse.next_update]  rS   r   c                     yrP   r   rQ   s    r   rR   zOCSPResponse.issuer_key_hashd  rS   r   c                     yrU   r   rQ   s    r   rV   zOCSPResponse.issuer_name_hashk  rS   r   c                     yrX   r   rQ   s    r   rY   zOCSPResponse.hash_algorithmr  rS   r   c                     yr[   r   rQ   s    r   r\   zOCSPResponse.serial_numbery  rS   r   c                     y)zR
        The list of response extensions. Not single response extensions.
        Nr   rQ   s    r   rb   zOCSPResponse.extensions  rS   r   c                     y)zR
        The list of single response extensions. Not response extensions.
        Nr   rQ   s    r   single_extensionszOCSPResponse.single_extensions  rS   r   c                     y)z0
        Serializes the response to DER
        Nr   r^   s     r   r`   zOCSPResponse.public_bytes  rS   r   N)rd   z#typing.Iterator[OCSPSingleResponse])rd   r   )rd   zx509.ObjectIdentifier)rd   %typing.Optional[hashes.HashAlgorithm]rc   )rd   ztyping.List[x509.Certificate])rd   ztyping.Optional[bytes])rd   ztyping.Optional[x509.Name]r   r   r   r   rf   rg   rj   ri   )r   r   r   rk   rl   rm   r   r   r   r   r   r   r   r   r   r   rs   rE   rF   rC   rD   rR   rV   rY   r\   rb   r   r`   r   r   r   r   r      s           
 	.     
   
      
   
   
   
            
   
   
   
   
   
   
 	 r   r   c                  z    e Zd Zddg f	 	 	 	 	 	 	 ddZ	 	 	 	 	 	 	 	 ddZ	 	 	 	 	 	 	 	 	 	 d	dZ	 	 	 	 	 	 d
dZddZy)OCSPRequestBuilderNc                .    || _         || _        || _        y N)_request_request_hash_extensions)r?   requestrequest_hashrb   s       r   rG   zOCSPRequestBuilder.__init__  s      )%r   c                $   | j                   | j                  t        d      t        |       t	        |t
        j                        rt	        |t
        j                        st        d      t        |||f| j                  | j                        S )N.Only one certificate can be added to a requestr2   )
r   r   r'   r)   r%   r   r3   r4   r   r   )r?   r@   rA   r(   s       r   add_certificatez"OCSPRequestBuilder.add_certificate  s     ==$(:(:(FMNN)$$ 0 01D$$:
 CDD!69%t'9'94;K;K
 	
r   c                   | j                   | j                  t        d      t        |t              st        d      t        |       t        j                  d|       t        j                  d|       |j                  t        |      k7  s|j                  t        |      k7  rt        d      t        | j                   ||||f| j                        S )Nr   z serial_number must be an integerrV   rR   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r   r   r'   r%   rh   r4   r)   r   _check_bytesdigest_sizelenr   r   )r?   rV   rR   r\   r(   s        r   add_certificate_by_hashz*OCSPRequestBuilder.add_certificate_by_hash  s     ==$(:(:(FMNN-->??)$-/?@,o>  C%
 
""c/&::6 
 "MMyI
 	
r   c                   t        |t        j                        st        d      t        j                  |j
                  ||      }t        || j                         t        | j                  | j                  | j                  |gz         S Nz"extension must be an ExtensionType)r%   r   ExtensionTyper4   	Extensionoidr   r   r   r   r   r?   extvalcritical	extensions       r   add_extensionz OCSPRequestBuilder.add_extension  sq     &$"4"45@AANN6::x@	#It/?/?@!MM4--t/?/?9+/M
 	
r   c                r    | j                   | j                  t        d      t        j                  |       S )Nz*You must add a certificate before building)r   r   r'   r   create_ocsp_requestrQ   s    r   buildzOCSPRequestBuilder.build  s4    == T%7%7%?IJJ''--r   )r   zWtyping.Optional[typing.Tuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm]]r   zFtyping.Optional[typing.Tuple[bytes, bytes, int, hashes.HashAlgorithm]]rb   /typing.List[x509.Extension[x509.ExtensionType]]rd   None)r@   rH   rA   rH   r(   rI   rd   r   )
rV   re   rR   re   r\   rh   r(   rI   rd   r   )r   x509.ExtensionTyper   boolrd   r   )rd   rN   )r   r   r   rG   r   r   r   r   r   r   r   r   r     s      FH&
&
& D& 
& 

 !
 (	

 

&

 
 	

 (
 

<
(
48
	
.r   r   c                      e Zd Zdddg f	 	 	 	 	 	 	 d	dZ	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 d
dZ	 	 	 	 	 	 ddZ	 	 	 	 ddZ	 	 	 	 	 	 ddZ	 	 	 	 	 	 ddZe		 	 	 	 dd       Z
y)OCSPResponseBuilderNc                <    || _         || _        || _        || _        y r   )	_response_responder_id_certsr   )r?   responseresponder_idcertsrb   s        r   rG   zOCSPResponseBuilder.__init__  s"     ")%r   c	           
         | j                   t        d      t        ||||||||      }	t        |	| j                  | j
                  | j                        S )Nz#Only one response per OCSPResponse.)r   r'   r0   r   r   r   r   )
r?   r@   rA   r(   rB   rC   rD   rE   rF   
singleresps
             r   add_responsez OCSPResponseBuilder.add_response  sg     >>%BCC$	

 #KK	
 	
r   c                   | j                   t        d      t        |t        j                        st        d      t        |t              st        d      t        | j                  ||f| j                  | j                        S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r   r'   r%   r   r3   r4   r   r   r   r   r   )r?   r_   responder_certs      r   r   z OCSPResponseBuilder.responder_id  s     )@AA.$*:*:;BCC($9:H  #NNX&KK	
 	
r   c                
   | j                   t        d      t        |      }t        |      dk(  rt        d      t	        d |D              st        d      t        | j                  | j                  || j                        S )Nz!certificates may only be set oncer   zcerts must not be an empty listc              3  P   K   | ]  }t        |t        j                           y wr   )r%   r   r3   ).0xs     r   	<genexpr>z3OCSPResponseBuilder.certificates.<locals>.<genexpr>4  s     Bq:a!1!12Bs   $&z$certs must be a list of Certificates)
r   r'   listr   allr4   r   r   r   r   )r?   r   s     r   r   z OCSPResponseBuilder.certificates,  s}     ;;"@AAUu:?>??BEBBBCC"NN	
 	
r   c                .   t        |t        j                        st        d      t        j                  |j
                  ||      }t        || j                         t        | j                  | j                  | j                  | j                  |gz         S r   )r%   r   r   r4   r   r   r   r   r   r   r   r   r   s       r   r   z!OCSPResponseBuilder.add_extension=  sz     &$"4"45@AANN6::x@	#It/?/?@"NNKK	{*	
 	
r   c                    | j                   t        d      | j                  t        d      t        j                  t
        j                  | ||      S )Nz&You must add a response before signingz*You must add a responder_id before signing)r   r'   r   r   create_ocsp_responser   r   )r?   private_keyr(   s      r   signzOCSPResponseBuilder.signM  sT    
 >>!EFF%IJJ(())4i
 	
r   c                    t        |t              st        d      |t        j                  u rt	        d      t        j                  |d d d       S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r%   r   r4   r   r'   r   r   )clsr   s     r   build_unsuccessfulz&OCSPResponseBuilder.build_unsuccessful[  sS     /+=>I  0;;;CDD(($dKKr   )r   z typing.Optional[_SingleResponse]r   zFtyping.Optional[typing.Tuple[x509.Certificate, OCSPResponderEncoding]]r   z.typing.Optional[typing.List[x509.Certificate]]rb   r   )r@   rH   rA   rH   r(   rI   rB   r+   rC   rJ   rD   rK   rE   rK   rF   rL   rd   r   )r_   r   r   rH   rd   r   )r   z!typing.Iterable[x509.Certificate]rd   r   )r   r   r   r   rd   r   )r   r	   r(   r   rd   r   )r   r   rd   r   )r   r   r   rG   r   r   r   r   r   classmethodr   r   r   r   r   r     s3    6: @DFH&2&
& >& D&

 !
 (	

 $
 '
 8
 <
 =
 

>
-
?O
	
&
6
	
"
(
48
	
 
5
 9
 
	
 
L0
L	
L 
Lr   r   c                ,    t        j                  |       S r   )r   load_der_ocsp_requestdatas    r   r   r   i  s    %%d++r   c                ,    t        j                  |       S r   )r   load_der_ocsp_responser   s    r   r   r   m  s    &&t,,r   )r(   rI   rd   r   )r   re   rd   rN   )r   re   rd   r   )'
__future__r   rl   r5   typingcryptographyr   r   "cryptography.hazmat.bindings._rustr   cryptography.hazmat.primitivesr   r   /cryptography.hazmat.primitives.asymmetric.typesr	   cryptography.x509.baser
   r   r   Enumr   r   SHA1SHA224SHA256SHA384SHA512r&   r)   r+   r0   ABCMetarN   rp   r   r   r   r   r   r   r   r   <module>r      s   
 # 
   $ 3 @ EJJ 
  KK
MM
MM
MM
MM
UZZ C4 C4L(CKK (VA3;; AHaS[[ aHS. S.l{L {L|,-r   