a
    ϏPfF                     @  sD  d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZejejejejejfZdddddZG dd dejZG dd dZG dd dejdZ G dd dejdZ!G dd dejdZ"G dd dZ#G dd dZ$e	j%Z%e	j&Z&dS )     )annotationsN)utilsx509)ocsp)hashesserialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   W/var/www/html/python-backend/venv/lib/python3.9/site-packages/cryptography/x509/ocsp.pyr      s   r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s   r   hashes.HashAlgorithmNone)	algorithmreturnc                 C  s   t | tstdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm/   s    
r$   c                   @  s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDUNKNOWNr   r   r   r   r%   6   s   r%   c                	   @  s(   e Zd Zddddddddddd	Zd
S )_SingleResponsex509.Certificater   r%   datetime.datetimedatetime.datetime | Nonex509.ReasonFlags | None)certissuerr   cert_statusthis_updatenext_updaterevocation_timerevocation_reasonc	           	      C  s  t |tjrt |tjs tdt| t |tjs<td|d urXt |tjsXtd|| _|| _|| _|| _	|| _
t |tstd|tjur|d urtd|d urtdnHt |tjstdt|}|tk rtd|d urt |tjstd	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r!   r   Certificate	TypeErrorr$   datetimeZ_certZ_issuer
_algorithmZ_this_updateZ_next_updater%   r&   r#   r
   r	   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr-   r.   r   r/   r0   r1   r2   r3   r   r   r   __init__=   sZ    



z_SingleResponse.__init__N)r   r   r   r:   r   r   r   r   r(   <   s   r(   c                   @  s   e Zd ZeejddddZeejddddZeejdddd	Zeejd
dddZ	ejdddddZ
eejddddZdS )OCSPRequestbytesr    c                 C  s   dS z3
        The hash of the issuer public key
        Nr   r9   r   r   r   issuer_key_hash   s    zOCSPRequest.issuer_key_hashc                 C  s   dS z-
        The hash of the issuer name
        Nr   r?   r   r   r   issuer_name_hash   s    zOCSPRequest.issuer_name_hashr   c                 C  s   dS zK
        The hash algorithm used in the issuer name and key hashes
        Nr   r?   r   r   r   hash_algorithm   s    zOCSPRequest.hash_algorithmintc                 C  s   dS zM
        The serial number of the cert whose status is being checked
        Nr   r?   r   r   r   serial_number   s    zOCSPRequest.serial_numberserialization.Encodingencodingr    c                 C  s   dS )z/
        Serializes the request to DER
        Nr   r9   rJ   r   r   r   public_bytes   s    zOCSPRequest.public_bytesx509.Extensionsc                 C  s   dS )zP
        The list of request extensions. Not single request extensions.
        Nr   r?   r   r   r   
extensions   s    zOCSPRequest.extensionsN)r   r   r   propertyabcabstractmethodr@   rB   rD   rG   rL   rN   r   r   r   r   r;      s"   r;   )	metaclassc                   @  s   e Zd ZeejddddZeejddddZeejddd	d
ZeejddddZ	eejddddZ
eejddddZeejddddZeejddddZeejddddZdS )OCSPSingleResponser%   r=   c                 C  s   dS zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   r?   r   r   r   certificate_status   s    z%OCSPSingleResponse.certificate_statusr+   c                 C  s   dS z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   r?   r   r   r   r2      s    z"OCSPSingleResponse.revocation_timer,   c                 C  s   dS zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   r?   r   r   r   r3      s    z$OCSPSingleResponse.revocation_reasonr*   c                 C  s   dS z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   r?   r   r   r   r0      s    zOCSPSingleResponse.this_updatec                 C  s   dS zC
        The time when newer information will be available
        Nr   r?   r   r   r   r1      s    zOCSPSingleResponse.next_updater<   c                 C  s   dS r>   r   r?   r   r   r   r@      s    z"OCSPSingleResponse.issuer_key_hashc                 C  s   dS rA   r   r?   r   r   r   rB      s    z#OCSPSingleResponse.issuer_name_hashr   c                 C  s   dS rC   r   r?   r   r   r   rD      s    z!OCSPSingleResponse.hash_algorithmrE   c                 C  s   dS rF   r   r?   r   r   r   rG      s    z OCSPSingleResponse.serial_numberN)r   r   r   rO   rP   rQ   rU   r2   r3   r0   r1   r@   rB   rD   rG   r   r   r   r   rS      s6   rS   c                   @  s  e Zd ZeejddddZeejddddZeejddd	d
ZeejddddZ	eejddddZ
eejddddZeejddddZeejddddZeejddddZeejddddZeejddd d!Zeejd"dd#d$Zeejd%dd&d'Zeejddd(d)Zeejd"dd*d+Zeejddd,d-Zeejddd.d/Zeejd0dd1d2Zeejd3dd4d5Zeejd6dd7d8Zeejd6dd9d:Zejd;dd<d=d>Zd?S )@OCSPResponsez#typing.Iterator[OCSPSingleResponse]r=   c                 C  s   dS )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   r?   r   r   r   	responses   s    zOCSPResponse.responsesr   c                 C  s   dS )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   r?   r   r   r   response_status   s    zOCSPResponse.response_statuszx509.ObjectIdentifierc                 C  s   dS )zA
        The ObjectIdentifier of the signature algorithm
        Nr   r?   r   r   r   signature_algorithm_oid  s    z$OCSPResponse.signature_algorithm_oidhashes.HashAlgorithm | Nonec                 C  s   dS )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   r?   r   r   r   signature_hash_algorithm	  s    z%OCSPResponse.signature_hash_algorithmr<   c                 C  s   dS )z%
        The signature bytes
        Nr   r?   r   r   r   	signature  s    zOCSPResponse.signaturec                 C  s   dS )z+
        The tbsResponseData bytes
        Nr   r?   r   r   r   tbs_response_bytes  s    zOCSPResponse.tbs_response_byteszlist[x509.Certificate]c                 C  s   dS )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   r?   r   r   r   certificates   s    zOCSPResponse.certificateszbytes | Nonec                 C  s   dS )z2
        The responder's key hash or None
        Nr   r?   r   r   r   responder_key_hash)  s    zOCSPResponse.responder_key_hashzx509.Name | Nonec                 C  s   dS )z.
        The responder's Name or None
        Nr   r?   r   r   r   responder_name0  s    zOCSPResponse.responder_namer*   c                 C  s   dS )z4
        The time the response was produced
        Nr   r?   r   r   r   produced_at7  s    zOCSPResponse.produced_atr%   c                 C  s   dS rT   r   r?   r   r   r   rU   >  s    zOCSPResponse.certificate_statusr+   c                 C  s   dS rV   r   r?   r   r   r   r2   E  s    zOCSPResponse.revocation_timer,   c                 C  s   dS rW   r   r?   r   r   r   r3   M  s    zOCSPResponse.revocation_reasonc                 C  s   dS rX   r   r?   r   r   r   r0   U  s    zOCSPResponse.this_updatec                 C  s   dS rY   r   r?   r   r   r   r1   ]  s    zOCSPResponse.next_updatec                 C  s   dS r>   r   r?   r   r   r   r@   d  s    zOCSPResponse.issuer_key_hashc                 C  s   dS rA   r   r?   r   r   r   rB   k  s    zOCSPResponse.issuer_name_hashr   c                 C  s   dS rC   r   r?   r   r   r   rD   r  s    zOCSPResponse.hash_algorithmrE   c                 C  s   dS rF   r   r?   r   r   r   rG   y  s    zOCSPResponse.serial_numberrM   c                 C  s   dS )zR
        The list of response extensions. Not single response extensions.
        Nr   r?   r   r   r   rN     s    zOCSPResponse.extensionsc                 C  s   dS )zR
        The list of single response extensions. Not response extensions.
        Nr   r?   r   r   r   single_extensions  s    zOCSPResponse.single_extensionsrH   rI   c                 C  s   dS )z0
        Serializes the response to DER
        Nr   rK   r   r   r   rL     s    zOCSPResponse.public_bytesN)r   r   r   rO   rP   rQ   r[   r\   r]   r_   r`   ra   rb   rc   rd   re   rU   r2   r3   r0   r1   r@   rB   rD   rG   rN   rf   rL   r   r   r   r   rZ      s   rZ   c                   @  sr   e Zd Zddg fdddddddZd	d	d
d dddZdddd
d dddZddd dddZddddZdS )OCSPRequestBuilderNzFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonez5tuple[bytes, bytes, int, hashes.HashAlgorithm] | None(list[x509.Extension[x509.ExtensionType]]r   )requestrequest_hashrN   r    c                 C  s   || _ || _|| _d S N)_request_request_hash_extensions)r9   ri   rj   rN   r   r   r   r:     s    
zOCSPRequestBuilder.__init__r)   r   )r-   r.   r   r    c                 C  sZ   | j d us| jd urtdt| t|tjr<t|tjsDtdt|||f| j| j	S )N.Only one certificate can be added to a requestr4   )
rl   rm   r#   r$   r!   r   r5   r6   rg   rn   )r9   r-   r.   r   r   r   r   add_certificate  s    z"OCSPRequestBuilder.add_certificater<   rE   )rB   r@   rG   r   r    c                 C  s   | j d us| jd urtdt|ts.tdt| td| td| |j	t
|ksj|j	t
|krrtdt| j ||||f| jS )Nro   z serial_number must be an integerrB   r@   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rl   rm   r#   r!   rE   r6   r$   r   _check_bytesdigest_sizelenrg   rn   )r9   rB   r@   rG   r   r   r   r   add_certificate_by_hash  s(    

z*OCSPRequestBuilder.add_certificate_by_hashx509.ExtensionTypeboolextvalcriticalr    c                 C  sJ   t |tjstdt|j||}t|| j t| j	| j
g | j|S Nz"extension must be an ExtensionType)r!   r   ExtensionTyper6   	Extensionoidr   rn   rg   rl   rm   r9   rx   ry   	extensionr   r   r   add_extension  s    z OCSPRequestBuilder.add_extensionr;   r=   c                 C  s&   | j d u r| jd u rtdt| S )Nz*You must add a certificate before building)rl   rm   r#   r   Zcreate_ocsp_requestr?   r   r   r   build  s    zOCSPRequestBuilder.build)r   r   r   r:   rp   rt   r   r   r   r   r   r   rg     s   rg   c                
   @  s   e Zd Zdddg fdddddddZd	d	d
dddddd d	ddZdd	d dddZdd dddZddd dddZdd d!d"d#d$Ze	d%d!d&d'd(Z
dS ))OCSPResponseBuilderNz_SingleResponse | Nonez5tuple[x509.Certificate, OCSPResponderEncoding] | Nonezlist[x509.Certificate] | Nonerh   )responseresponder_idcertsrN   c                 C  s   || _ || _|| _|| _d S rk   )	_response_responder_id_certsrn   )r9   r   r   r   rN   r   r   r   r:     s    zOCSPResponseBuilder.__init__r)   r   r%   r*   r+   r,   )	r-   r.   r   r/   r0   r1   r2   r3   r    c	           
   	   C  s<   | j d urtdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)r   r#   r(   r   r   r   rn   )
r9   r-   r.   r   r/   r0   r1   r2   r3   Z
singlerespr   r   r   add_response  s$    

z OCSPResponseBuilder.add_responser   )rJ   responder_certr    c                 C  sP   | j d urtdt|tjs&tdt|ts8tdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r   r#   r!   r   r5   r6   r   r   r   r   rn   )r9   rJ   r   r   r   r   r     s    

z OCSPResponseBuilder.responder_idz!typing.Iterable[x509.Certificate])r   r    c                 C  s\   | j d urtdt|}t|dkr.tdtdd |D sHtdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   | ]}t |tjV  qd S rk   )r!   r   r5   ).0xr   r   r   	<genexpr>1      z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r   r#   listrs   allr6   r   r   r   rn   )r9   r   r   r   r   rb   )  s    
z OCSPResponseBuilder.certificatesru   rv   rw   c                 C  sN   t |tjstdt|j||}t|| j t| j	| j
| jg | j|S rz   )r!   r   r{   r6   r|   r}   r   rn   r   r   r   r   r~   r   r   r   r   :  s    z!OCSPResponseBuilder.add_extensionr   r^   rZ   )private_keyr   r    c                 C  s6   | j d u rtd| jd u r$tdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)r   r#   r   r   create_ocsp_responser   r   )r9   r   r   r   r   r   signJ  s    


zOCSPResponseBuilder.signr   )r\   r    c                 C  s4   t |tstd|tju r$tdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r!   r   r6   r   r#   r   r   )clsr\   r   r   r   build_unsuccessfulX  s    

z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r:   r   r   rb   r   r   classmethodr   r   r   r   r   r     s   r   )'
__future__r   rP   r7   typingZcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser	   r
   r   Enumr   r   SHA1SHA224SHA256SHA384SHA512r"   r$   r%   r(   ABCMetar;   rS   rZ   rg   r   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   <module>   s6   
	F+D %T}