o
    9fF                     @  s>  d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZejejejejejfZd!ddZG dd dejZG dd dZG dd dejdZ G dd dejdZ!G dd dejdZ"G dd dZ#G dd  d Z$e	j%Z%e	j&Z&dS )"    )annotationsN)utilsx509)ocsp)hashesserialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__ZHASHNAME r   r   6lib/python3.10/site-packages/cryptography/x509/ocsp.pyr      s    r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDZUNAUTHORIZEDr   r   r   r   r      s    r   	algorithmhashes.HashAlgorithmreturnNonec                 C  s   t | ts	tdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm/   s
   
r!   c                   @  s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDZUNKNOWNr   r   r   r   r"   6   s    r"   c                   @  s   e Zd ZdddZdS )_SingleResponsecertx509.Certificateissuerr   r   cert_statusr"   this_updatedatetime.datetimenext_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec	           	      C  s  t |tjrt |tjstdt| t |tjstd|d ur,t |tjs,td|| _|| _|| _|| _	|| _
t |tsDtd|tjurZ|d urQtd|d urYtdn$t |tjsdtdt|}|tk rptd|d ur~t |tjs~td	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r   r   Certificate	TypeErrorr!   datetimeZ_certZ_issuerZ
_algorithmZ_this_updateZ_next_updater"   r#   r    r
   r	   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr%   r'   r   r(   r)   r+   r-   r.   r   r   r   __init__=   s\   




z_SingleResponse.__init__N)r%   r&   r'   r&   r   r   r(   r"   r)   r*   r+   r,   r-   r,   r.   r/   )r   r   r   r5   r   r   r   r   r$   <   s    r$   c                   @  s   e Zd ZeejdddZeejdddZeejddd	ZeejdddZ	ejdddZ
eejdddZdS )OCSPRequestr   bytesc                 C     dS z3
        The hash of the issuer public key
        Nr   r4   r   r   r   issuer_key_hash       zOCSPRequest.issuer_key_hashc                 C  r8   z-
        The hash of the issuer name
        Nr   r:   r   r   r   issuer_name_hash   r<   zOCSPRequest.issuer_name_hashr   c                 C  r8   zK
        The hash algorithm used in the issuer name and key hashes
        Nr   r:   r   r   r   hash_algorithm   r<   zOCSPRequest.hash_algorithmintc                 C  r8   zM
        The serial number of the cert whose status is being checked
        Nr   r:   r   r   r   serial_number   r<   zOCSPRequest.serial_numberencodingserialization.Encodingc                 C  r8   )z/
        Serializes the request to DER
        Nr   r4   rD   r   r   r   public_bytes   r<   zOCSPRequest.public_bytesx509.Extensionsc                 C  r8   )zP
        The list of request extensions. Not single request extensions.
        Nr   r:   r   r   r   
extensions   r<   zOCSPRequest.extensionsNr   r7   r   r   r   rA   rD   rE   r   r7   r   rH   )r   r   r   propertyabcabstractmethodr;   r>   r@   rC   rG   rI   r   r   r   r   r6      s$    r6   )	metaclassc                   @  s   e Zd ZeejdddZeejdddZeejdd	d
ZeejdddZ	eejdddZ
eejd ddZeejd ddZeejd!ddZeejd"ddZdS )#OCSPSingleResponser   r"   c                 C  r8   zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   r:   r   r   r   certificate_status   r<   z%OCSPSingleResponse.certificate_statusr,   c                 C  r8   z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   r:   r   r   r   r-      r<   z"OCSPSingleResponse.revocation_timer/   c                 C  r8   zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   r:   r   r   r   r.      r<   z$OCSPSingleResponse.revocation_reasonr*   c                 C  r8   z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   r:   r   r   r   r)      r<   zOCSPSingleResponse.this_updatec                 C  r8   zC
        The time when newer information will be available
        Nr   r:   r   r   r   r+      r<   zOCSPSingleResponse.next_updater7   c                 C  r8   r9   r   r:   r   r   r   r;      r<   z"OCSPSingleResponse.issuer_key_hashc                 C  r8   r=   r   r:   r   r   r   r>      r<   z#OCSPSingleResponse.issuer_name_hashr   c                 C  r8   r?   r   r:   r   r   r   r@      r<   z!OCSPSingleResponse.hash_algorithmrA   c                 C  r8   rB   r   r:   r   r   r   rC      r<   z OCSPSingleResponse.serial_numberNr   r"   r   r,   r   r/   r   r*   rJ   rK   rL   )r   r   r   rO   rP   rQ   rU   r-   r.   r)   r+   r;   r>   r@   rC   r   r   r   r   rS      s8    rS   c                   @  s  e Zd Zeejd@ddZeejdAddZeejdBd	d
ZeejdCddZ	eejdDddZ
eejdDddZeejdEddZeejdFddZeejdGddZeejdHddZeejdId d!ZeejdJd#d$ZeejdKd&d'ZeejdHd(d)ZeejdJd*d+ZeejdDd,d-ZeejdDd.d/ZeejdLd1d2ZeejdMd4d5ZeejdNd7d8ZeejdNd9d:ZejdOd=d>Zd?S )POCSPResponser   #typing.Iterator[OCSPSingleResponse]c                 C  r8   )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   r:   r   r   r   	responses   r<   zOCSPResponse.responsesr   c                 C  r8   )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   r:   r   r   r   response_status   r<   zOCSPResponse.response_statusx509.ObjectIdentifierc                 C  r8   )zA
        The ObjectIdentifier of the signature algorithm
        Nr   r:   r   r   r   signature_algorithm_oid  r<   z$OCSPResponse.signature_algorithm_oidhashes.HashAlgorithm | Nonec                 C  r8   )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   r:   r   r   r   signature_hash_algorithm	  r<   z%OCSPResponse.signature_hash_algorithmr7   c                 C  r8   )z%
        The signature bytes
        Nr   r:   r   r   r   	signature  r<   zOCSPResponse.signaturec                 C  r8   )z+
        The tbsResponseData bytes
        Nr   r:   r   r   r   tbs_response_bytes  r<   zOCSPResponse.tbs_response_byteslist[x509.Certificate]c                 C  r8   )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   r:   r   r   r   certificates   r<   zOCSPResponse.certificatesbytes | Nonec                 C  r8   )z2
        The responder's key hash or None
        Nr   r:   r   r   r   responder_key_hash)  r<   zOCSPResponse.responder_key_hashx509.Name | Nonec                 C  r8   )z.
        The responder's Name or None
        Nr   r:   r   r   r   responder_name0  r<   zOCSPResponse.responder_namer*   c                 C  r8   )z4
        The time the response was produced
        Nr   r:   r   r   r   produced_at7  r<   zOCSPResponse.produced_atr"   c                 C  r8   rT   r   r:   r   r   r   rU   >  r<   zOCSPResponse.certificate_statusr,   c                 C  r8   rV   r   r:   r   r   r   r-   E  r<   zOCSPResponse.revocation_timer/   c                 C  r8   rW   r   r:   r   r   r   r.   M  r<   zOCSPResponse.revocation_reasonc                 C  r8   rX   r   r:   r   r   r   r)   U  r<   zOCSPResponse.this_updatec                 C  r8   rY   r   r:   r   r   r   r+   ]  r<   zOCSPResponse.next_updatec                 C  r8   r9   r   r:   r   r   r   r;   d  r<   zOCSPResponse.issuer_key_hashc                 C  r8   r=   r   r:   r   r   r   r>   k  r<   zOCSPResponse.issuer_name_hashr   c                 C  r8   r?   r   r:   r   r   r   r@   r  r<   zOCSPResponse.hash_algorithmrA   c                 C  r8   rB   r   r:   r   r   r   rC   y  r<   zOCSPResponse.serial_numberrH   c                 C  r8   )zR
        The list of response extensions. Not single response extensions.
        Nr   r:   r   r   r   rI     r<   zOCSPResponse.extensionsc                 C  r8   )zR
        The list of single response extensions. Not response extensions.
        Nr   r:   r   r   r   single_extensions  r<   zOCSPResponse.single_extensionsrD   rE   c                 C  r8   )z0
        Serializes the response to DER
        Nr   rF   r   r   r   rG     r<   zOCSPResponse.public_bytesN)r   r_   )r   r   )r   rb   )r   rd   rJ   )r   rh   )r   rj   )r   rl   r]   rZ   r[   r\   rK   rL   rN   rM   )r   r   r   rO   rP   rQ   r`   ra   rc   re   rf   rg   ri   rk   rm   rn   rU   r-   r.   r)   r+   r;   r>   r@   rC   rI   ro   rG   r   r   r   r   r^      s    r^   c                   @  sF   e Zd Zddg fd#d
dZd$ddZd%ddZd&ddZd'd!d"ZdS )(OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonerequest_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | NonerI   (list[x509.Extension[x509.ExtensionType]]r   r   c                 C  s   || _ || _|| _d S N)_request_request_hash_extensions)r4   rq   rs   rI   r   r   r   r5     s   

zOCSPRequestBuilder.__init__r%   r&   r'   r   r   c                 C  sZ   | j d us
| jd urtdt| t|tjrt|tjs"tdt|||f| j| j	S )N.Only one certificate can be added to a requestr0   )
rw   rx   r    r!   r   r   r1   r2   rp   ry   )r4   r%   r'   r   r   r   r   add_certificate  s   z"OCSPRequestBuilder.add_certificater>   r7   r;   rC   rA   c                 C  s   | j d us
| jd urtdt|tstdt| td| td| |j	t
|ks5|j	t
|kr9tdt| j ||||f| jS )Nrz   z serial_number must be an integerr>   r;   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rw   rx   r    r   rA   r2   r!   r   _check_bytesZdigest_sizelenrp   ry   )r4   r>   r;   rC   r   r   r   r   add_certificate_by_hash  s&   

z*OCSPRequestBuilder.add_certificate_by_hashextvalx509.ExtensionTypecriticalboolc                 C  sJ   t |tjs
tdt|j||}t|| j t| j	| j
g | j|S Nz"extension must be an ExtensionType)r   r   ExtensionTyper2   	Extensionoidr   ry   rp   rw   rx   r4   r   r   	extensionr   r   r   add_extension  s   z OCSPRequestBuilder.add_extensionr6   c                 C  s&   | j d u r| jd u rtdt| S )Nz*You must add a certificate before building)rw   rx   r    r   Zcreate_ocsp_requestr:   r   r   r   build  s   
zOCSPRequestBuilder.build)rq   rr   rs   rt   rI   ru   r   r   )r%   r&   r'   r&   r   r   r   rp   )
r>   r7   r;   r7   rC   rA   r   r   r   rp   )r   r   r   r   r   rp   )r   r6   )r   r   r   r5   r{   r~   r   r   r   r   r   r   rp     s    


rp   c                   @  s`   e Zd Zdddg fd5d
dZd6ddZd7d d!Zd8d#d$Zd9d)d*Zd:d/d0Ze	d;d3d4Z
dS )<OCSPResponseBuilderNresponse_SingleResponse | Noneresponder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecertslist[x509.Certificate] | NonerI   ru   c                 C  s   || _ || _|| _|| _d S rv   )	_response_responder_id_certsry   )r4   r   r   r   rI   r   r   r   r5     s   
zOCSPResponseBuilder.__init__r%   r&   r'   r   r   r(   r"   r)   r*   r+   r,   r-   r.   r/   r   c	           
   	   C  s<   | j d ur	tdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)r   r    r$   r   r   r   ry   )
r4   r%   r'   r   r(   r)   r+   r-   r.   Z
singlerespr   r   r   add_response  s$   

z OCSPResponseBuilder.add_responserD   r   responder_certc                 C  sP   | j d ur	tdt|tjstdt|tstdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r   r    r   r   r1   r2   r   r   r   r   ry   )r4   rD   r   r   r   r   r     s   

z OCSPResponseBuilder.responder_id!typing.Iterable[x509.Certificate]c                 C  s\   | j d ur	tdt|}t|dkrtdtdd |D s$tdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s    | ]	}t |tjV  qd S rv   )r   r   r1   ).0xr   r   r   	<genexpr>1  s    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r   r    listr}   allr2   r   r   r   ry   )r4   r   r   r   r   ri   )  s   
z OCSPResponseBuilder.certificatesr   r   r   r   c                 C  sN   t |tjs
tdt|j||}t|| j t| j	| j
| jg | j|S r   )r   r   r   r2   r   r   r   ry   r   r   r   r   r   r   r   r   r   :  s   z!OCSPResponseBuilder.add_extensionprivate_keyr   rd   r^   c                 C  s6   | j d u r	td| jd u rtdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)r   r    r   r   create_ocsp_responser   r   )r4   r   r   r   r   r   signJ  s   


zOCSPResponseBuilder.signra   r   c                 C  s4   t |ts	td|tju rtdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r2   r   r    r   r   )clsra   r   r   r   build_unsuccessfulX  s   

z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r   r   r   rI   ru   )r%   r&   r'   r&   r   r   r(   r"   r)   r*   r+   r,   r-   r,   r.   r/   r   r   )rD   r   r   r&   r   r   )r   r   r   r   )r   r   r   r   r   r   )r   r   r   rd   r   r^   )ra   r   r   r^   )r   r   r   r5   r   r   ri   r   r   classmethodr   r   r   r   r   r     s    




r   )r   r   r   r   )'Z
__future__r   rP   r3   typingZcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser	   r
   r   Enumr   r   ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512r   r!   r"   r$   ABCMetar6   rS   r^   rp   r   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   <module>   s8   

	F+D %T}
