a
    `Émg~,  ã                   @  s  d dl mZ d dlZd dlZd dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZmZ G dd	„ d	ejƒZG d
d„ dejƒZe
je
je
je
je
jfZdddœdd„ZG dd„ dejƒZG dd„ dƒZejZejZejZG dd„ dƒZ G dd„ dƒZ!ej"Z"ej#Z#dS )é    )ÚannotationsN)ÚutilsÚx509)Úocsp)Úhashes)Ú CertificateIssuerPrivateKeyTypes)Ú_EARLIEST_UTC_TIMEÚ_convert_to_naive_utc_timeÚ_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú
__module__Ú__qualname__ÚHASHÚNAME© r   r   úO/var/www/html/idle/venv/lib64/python3.9/site-packages/cryptography/x509/ocsp.pyr      s   r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚOCSPResponseStatusr   é   é   é   é   é   N)	r   r   r   Ú
SUCCESSFULZMALFORMED_REQUESTÚINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDÚUNAUTHORIZEDr   r   r   r   r      s   r   úhashes.HashAlgorithmÚNone)Ú	algorithmÚreturnc                 C  s   t | tƒstdƒ‚d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú
isinstanceÚ_ALLOWED_HASHESÚ
ValueError)r   r   r   r   Ú_verify_algorithm.   s    
ÿr#   c                   @  s   e Zd ZdZdZdZdS )ÚOCSPCertStatusr   r   r   N)r   r   r   ZGOODÚREVOKEDÚUNKNOWNr   r   r   r   r$   5   s   r$   c                	   @  s(   e Zd Zdddddddddœdd	„Zd
S )Ú_SingleResponseúx509.Certificater   r$   údatetime.datetimeúdatetime.datetime | Noneúx509.ReasonFlags | None)ÚcertÚissuerr   Úcert_statusÚthis_updateÚnext_updateÚrevocation_timeÚrevocation_reasonc	           	      C  s  t |tjƒrt |tjƒs tdƒ‚t|ƒ t |tjƒs<tdƒ‚|d urXt |tjƒsXtdƒ‚|| _|| _|| _|| _	|| _
t |tƒsˆtdƒ‚|tjur´|d ur¢tdƒ‚|d urütdƒ‚nHt |tjƒsÈtdƒ‚t|ƒ}|tk ràtdƒ‚|d urüt |tjƒsütd	ƒ‚|| _|| _|| _d S )
Nú%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r    r   ÚCertificateÚ	TypeErrorr#   ÚdatetimeZ_certZ_issuerÚ
_algorithmZ_this_updateZ_next_updater$   r%   r"   r	   r   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	Úselfr,   r-   r   r.   r/   r0   r1   r2   r   r   r   Ú__init__<   sZ    ÿ
ÿ
ÿ
ÿÿÿ
ÿÿz_SingleResponse.__init__N)r   r   r   r9   r   r   r   r   r'   ;   s   r'   c                   @  sr   e Zd Zddg fdddddœdd„Zd	d	d
d dœdd„Zdddd
d dœdd„Zddd dœdd„Zddœdd„ZdS )ÚOCSPRequestBuilderNzFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonez5tuple[bytes, bytes, int, hashes.HashAlgorithm] | Noneú(list[x509.Extension[x509.ExtensionType]]r   )ÚrequestÚrequest_hashÚ
extensionsr   c                 C  s   || _ || _|| _d S ©N)Ú_requestÚ_request_hashÚ_extensions)r8   r<   r=   r>   r   r   r   r9   ‡   s    
zOCSPRequestBuilder.__init__r(   r   )r,   r-   r   r   c                 C  sZ   | j d us| jd urtdƒ‚t|ƒ t|tjƒr<t|tjƒsDtdƒ‚t|||f| j| j	ƒS )Nú.Only one certificate can be added to a requestr3   )
r@   rA   r"   r#   r    r   r4   r5   r:   rB   )r8   r,   r-   r   r   r   r   Úadd_certificate•   s    ÿÿz"OCSPRequestBuilder.add_certificateÚbytesÚint)Úissuer_name_hashÚissuer_key_hashÚserial_numberr   r   c                 C  sŠ   | j d us| jd urtdƒ‚t|tƒs.tdƒ‚t|ƒ t d|¡ t d|¡ |j	t
|ƒksj|j	t
|ƒkrrtdƒ‚t| j ||||f| jƒS )NrC   z serial_number must be an integerrG   rH   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r@   rA   r"   r    rF   r5   r#   r   Ú_check_bytesÚdigest_sizeÚlenr:   rB   )r8   rG   rH   rI   r   r   r   r   Úadd_certificate_by_hash¨   s(    
ÿþÿ
ýz*OCSPRequestBuilder.add_certificate_by_hashúx509.ExtensionTypeÚbool©ÚextvalÚcriticalr   c                 C  sJ   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
g | j¢|‘ƒS ©Nz"extension must be an ExtensionType)r    r   ÚExtensionTyper5   Ú	ExtensionÚoidr
   rB   r:   r@   rA   ©r8   rQ   rR   Ú	extensionr   r   r   Úadd_extensionÆ   s    ÿz OCSPRequestBuilder.add_extensionÚOCSPRequest)r   c                 C  s&   | j d u r| jd u rtdƒ‚t | ¡S )Nz*You must add a certificate before building)r@   rA   r"   r   Zcreate_ocsp_request)r8   r   r   r   ÚbuildÓ   s    zOCSPRequestBuilder.build)r   r   r   r9   rD   rM   rY   r[   r   r   r   r   r:   †   s   ør:   c                
   @  s¢   e Zd Zdddg fdddddœdd„Zd	d	d
dddddd dœ	dd„Zdd	d dœdd„Zdd dœdd„Zddd dœdd„Zdd d!d"œd#d$„Ze	d%d!d&œd'd(„ƒZ
dS ))ÚOCSPResponseBuilderNz_SingleResponse | Nonez5tuple[x509.Certificate, OCSPResponderEncoding] | Nonezlist[x509.Certificate] | Noner;   )ÚresponseÚresponder_idÚcertsr>   c                 C  s   || _ || _|| _|| _d S r?   )Ú	_responseÚ_responder_idÚ_certsrB   )r8   r]   r^   r_   r>   r   r   r   r9   Û   s    zOCSPResponseBuilder.__init__r(   r   r$   r)   r*   r+   )	r,   r-   r   r.   r/   r0   r1   r2   r   c	           
   	   C  s<   | j d urtdƒ‚t||||||||ƒ}	t|	| j| j| jƒS )Nz#Only one response per OCSPResponse.)r`   r"   r'   r\   ra   rb   rB   )
r8   r,   r-   r   r.   r/   r0   r1   r2   Z
singlerespr   r   r   Úadd_responseè   s$    
ø
üz OCSPResponseBuilder.add_responser   )ÚencodingÚresponder_certr   c                 C  sP   | j d urtdƒ‚t|tjƒs&tdƒ‚t|tƒs8tdƒ‚t| j||f| j	| j
ƒS )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)ra   r"   r    r   r4   r5   r   r\   r`   rb   rB   )r8   rd   re   r   r   r   r^     s    

ÿüz OCSPResponseBuilder.responder_idz!typing.Iterable[x509.Certificate])r_   r   c                 C  s\   | j d urtdƒ‚t|ƒ}t|ƒdkr.tdƒ‚tdd„ |D ƒƒsHtdƒ‚t| j| j|| j	ƒS )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   | ]}t |tjƒV  qd S r?   )r    r   r4   )Ú.0Úxr   r   r   Ú	<genexpr>"  ó    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rb   r"   ÚlistrL   Úallr5   r\   r`   ra   rB   )r8   r_   r   r   r   Úcertificates  s    
üz OCSPResponseBuilder.certificatesrN   rO   rP   c                 C  sN   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| jg | j¢|‘ƒS rS   )r    r   rT   r5   rU   rV   r
   rB   r\   r`   ra   rb   rW   r   r   r   rY   +  s    üz!OCSPResponseBuilder.add_extensionr   zhashes.HashAlgorithm | NoneÚOCSPResponse)Úprivate_keyr   r   c                 C  s6   | j d u rtdƒ‚| jd u r$tdƒ‚t tj| ||¡S )Nz&You must add a response before signingz*You must add a responder_id before signing)r`   r"   ra   r   Úcreate_ocsp_responser   r   )r8   rn   r   r   r   r   Úsign;  s    


ÿzOCSPResponseBuilder.signr   )Úresponse_statusr   c                 C  s4   t |tƒstdƒ‚|tju r$tdƒ‚t |d d d ¡S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r    r   r5   r   r"   r   ro   )Úclsrq   r   r   r   Úbuild_unsuccessfulI  s    
ÿ
z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r9   rc   r^   rl   rY   rp   Úclassmethodrs   r   r   r   r   r\   Ú   s   úr\   )$Ú
__future__r   r6   ÚtypingZcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser   r	   r
   ÚEnumr   r   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512r!   r#   r$   r'   rZ   rm   ZOCSPSingleResponser:   r\   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   Ú<module>   s2   
û	FT}