
    ,dfH                       d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZmZmZ  G d d	ej                  Z G d
 dej                  Zej        ej        ej        ej        ej        fZd$dZ G d dej                  Z G d d          Z G d dej                  Z  G d dej                  Z! G d dej                  Z" G d d          Z# G d d          Z$d%d"Z%d&d#Z&dS )'    )annotationsN)utilsx509)ocsp)hashesserialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                      e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME     6lib/python3.11/site-packages/cryptography/x509/ocsp.pyr   r      s        DDDDr   r   c                  &    e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULMALFORMED_REQUESTINTERNAL_ERROR	TRY_LATERSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s-        JNILLLLr   r   	algorithmhashes.HashAlgorithmreturnNonec                N    t          | t                    st          d          d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r$   s    r   _verify_algorithmr,   /   s3    i11 
G
 
 	

 
r   c                      e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   GOODREVOKEDUNKNOWNr   r   r   r.   r.   6   s        DGGGGr   r.   c                      e Zd ZddZdS )_SingleResponsecertx509.Certificateissuerr$   r%   cert_statusr.   this_updatedatetime.datetimenext_update"typing.Optional[datetime.datetime]revocation_timerevocation_reason!typing.Optional[x509.ReasonFlags]c	                f   t          |t          j                  rt          |t          j                  st          d          t	          |           t          |t
          j                  st          d          |)t          |t
          j                  st          d          || _        || _        || _        || _	        || _
        t          |t                    st          d          |t          j        ur#|t          d          |t          d          n}t          |t
          j                  st          d          t          |          }|t          k     rt          d          |)t          |t          j                  st          d	          || _        || _        || _        d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r)   r   Certificate	TypeErrorr,   datetime_cert_issuer
_algorithm_this_update_next_updater.   r0   r+   r   r
   ReasonFlags_cert_status_revocation_time_revocation_reason)	selfr4   r6   r$   r7   r8   r:   r<   r=   s	            r   __init__z_SingleResponse.__init__=   s    $ 011 	ED$:
 :
 	E CDDD)$$$+x'899 	ECDDD":*,
 ,
" KLLL
#''+~66 	J   n444* !   !, "   - ox/@AA M KLLL8IIO!333 '  
 !,Z!4#36 6,  #  
 ( /"3r   N)r4   r5   r6   r5   r$   r%   r7   r.   r8   r9   r:   r;   r<   r;   r=   r>   )r   r   r   rN   r   r   r   r3   r3   <   s.        B4 B4 B4 B4 B4 B4r   r3   c                  *   e Zd Zeej        dd                        Zeej        dd                        Zeej        dd                        Zeej        dd                        Z	ej        dd            Z
eej        dd                        ZdS )OCSPRequestr&   bytesc                    dS z3
        The hash of the issuer public key
        Nr   rM   s    r   issuer_key_hashzOCSPRequest.issuer_key_hash         r   c                    dS z-
        The hash of the issuer name
        Nr   rT   s    r   issuer_name_hashzOCSPRequest.issuer_name_hash   rV   r   r%   c                    dS zK
        The hash algorithm used in the issuer name and key hashes
        Nr   rT   s    r   hash_algorithmzOCSPRequest.hash_algorithm   rV   r   intc                    dS zM
        The serial number of the cert whose status is being checked
        Nr   rT   s    r   serial_numberzOCSPRequest.serial_number   rV   r   encodingserialization.Encodingc                    dS )z/
        Serializes the request to DER
        Nr   rM   ra   s     r   public_byteszOCSPRequest.public_bytes   rV   r   x509.Extensionsc                    dS )zP
        The list of request extensions. Not single request extensions.
        Nr   rT   s    r   
extensionszOCSPRequest.extensions   rV   r   Nr&   rQ   r&   r%   r&   r]   ra   rb   r&   rQ   r&   rf   )r   r   r   propertyabcabstractmethodrU   rY   r\   r`   re   rh   r   r   r   rP   rP      s           X
     X
     X
     X
 	   
     X  r   rP   )	metaclassc                     e Zd Zeej        dd                        Zeej        dd                        Zeej        dd                        Zeej        dd	                        Z	eej        dd
                        Z
eej        dd                        Zeej        dd                        Zeej        dd                        Zeej        dd                        ZdS )OCSPSingleResponser&   r.   c                    dS zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   rT   s    r   certificate_statusz%OCSPSingleResponse.certificate_status   rV   r   r;   c                    dS z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   rT   s    r   r<   z"OCSPSingleResponse.revocation_time   rV   r   r>   c                    dS zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   rT   s    r   r=   z$OCSPSingleResponse.revocation_reason   rV   r   r9   c                    dS z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   rT   s    r   r8   zOCSPSingleResponse.this_update   rV   r   c                    dS zC
        The time when newer information will be available
        Nr   rT   s    r   r:   zOCSPSingleResponse.next_update   rV   r   rQ   c                    dS rS   r   rT   s    r   rU   z"OCSPSingleResponse.issuer_key_hash   rV   r   c                    dS rX   r   rT   s    r   rY   z#OCSPSingleResponse.issuer_name_hash   rV   r   r%   c                    dS r[   r   rT   s    r   r\   z!OCSPSingleResponse.hash_algorithm   rV   r   r]   c                    dS r_   r   rT   s    r   r`   z OCSPSingleResponse.serial_number   rV   r   Nr&   r.   r&   r;   r&   r>   r&   r9   ri   rj   rk   )r   r   r   rn   ro   rp   rv   r<   r=   r8   r:   rU   rY   r\   r`   r   r   r   rs   rs      s           X
     X     X     X     X
     X
     X
     X
     X  r   rs   c                  J   e Zd Zeej        d*d                        Zeej        d+d                        Zeej        d,d                        Zeej        d-d	                        Z	eej        d.d                        Z
eej        d.d                        Zeej        d/d                        Zeej        d0d                        Zeej        d1d                        Zeej        d2d                        Zeej        d3d                        Zeej        d4d                        Zeej        d5d                        Zeej        d2d                        Zeej        d4d                        Zeej        d.d                        Zeej        d.d                        Zeej        d6d                         Zeej        d7d"                        Zeej        d8d$                        Zeej        d8d%                        Zej        d9d(            Zd)S ):OCSPResponser&   #typing.Iterator[OCSPSingleResponse]c                    dS )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   rT   s    r   	responseszOCSPResponse.responses   rV   r   r   c                    dS )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   rT   s    r   response_statuszOCSPResponse.response_status   rV   r   x509.ObjectIdentifierc                    dS )zA
        The ObjectIdentifier of the signature algorithm
        Nr   rT   s    r   signature_algorithm_oidz$OCSPResponse.signature_algorithm_oid  rV   r   %typing.Optional[hashes.HashAlgorithm]c                    dS )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   rT   s    r   signature_hash_algorithmz%OCSPResponse.signature_hash_algorithm	  rV   r   rQ   c                    dS )z%
        The signature bytes
        Nr   rT   s    r   	signaturezOCSPResponse.signature  rV   r   c                    dS )z+
        The tbsResponseData bytes
        Nr   rT   s    r   tbs_response_byteszOCSPResponse.tbs_response_bytes  rV   r   typing.List[x509.Certificate]c                    dS )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   rT   s    r   certificateszOCSPResponse.certificates   rV   r   typing.Optional[bytes]c                    dS )z2
        The responder's key hash or None
        Nr   rT   s    r   responder_key_hashzOCSPResponse.responder_key_hash)  rV   r   typing.Optional[x509.Name]c                    dS )z.
        The responder's Name or None
        Nr   rT   s    r   responder_namezOCSPResponse.responder_name0  rV   r   r9   c                    dS )z4
        The time the response was produced
        Nr   rT   s    r   produced_atzOCSPResponse.produced_at7  rV   r   r.   c                    dS ru   r   rT   s    r   rv   zOCSPResponse.certificate_status>  rV   r   r;   c                    dS rx   r   rT   s    r   r<   zOCSPResponse.revocation_timeE  rV   r   r>   c                    dS rz   r   rT   s    r   r=   zOCSPResponse.revocation_reasonM  rV   r   c                    dS r|   r   rT   s    r   r8   zOCSPResponse.this_updateU  rV   r   c                    dS r~   r   rT   s    r   r:   zOCSPResponse.next_update]  rV   r   c                    dS rS   r   rT   s    r   rU   zOCSPResponse.issuer_key_hashd  rV   r   c                    dS rX   r   rT   s    r   rY   zOCSPResponse.issuer_name_hashk  rV   r   r%   c                    dS r[   r   rT   s    r   r\   zOCSPResponse.hash_algorithmr  rV   r   r]   c                    dS r_   r   rT   s    r   r`   zOCSPResponse.serial_numbery  rV   r   rf   c                    dS )zR
        The list of response extensions. Not single response extensions.
        Nr   rT   s    r   rh   zOCSPResponse.extensions  rV   r   c                    dS )zR
        The list of single response extensions. Not response extensions.
        Nr   rT   s    r   single_extensionszOCSPResponse.single_extensions  rV   r   ra   rb   c                    dS )z0
        Serializes the response to DER
        Nr   rd   s     r   re   zOCSPResponse.public_bytes  rV   r   N)r&   r   )r&   r   )r&   r   )r&   r   ri   )r&   r   )r&   r   )r&   r   r   r   r   r   rj   rk   rm   rl   )r   r   r   rn   ro   rp   r   r   r   r   r   r   r   r   r   r   rv   r<   r=   r8   r:   rU   rY   r\   r`   rh   r   re   r   r   r   r   r      s           X     X     X
     X     X
     X
     X     X
     X
     X
     X
     X     X     X     X
     X
     X
     X
     X
     X
     X
 	     r   r   c                  >    e Zd Zddg fdd
ZddZd dZd!dZd"dZdS )#OCSPRequestBuilderNrequestWtyping.Optional[typing.Tuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm]]request_hashFtyping.Optional[typing.Tuple[bytes, bytes, int, hashes.HashAlgorithm]]rh   /typing.List[x509.Extension[x509.ExtensionType]]r&   r'   c                0    || _         || _        || _        d S N)_request_request_hash_extensions)rM   r   r   rh   s       r   rN   zOCSPRequestBuilder.__init__  s!      )%r   r4   r5   r6   r$   r%   c                   | j         | j        t          d          t          |           t	          |t
          j                  rt	          |t
          j                  st          d          t          |||f| j        | j	                  S )N.Only one certificate can be added to a requestr@   )
r   r   r+   r,   r)   r   rA   rB   r   r   )rM   r4   r6   r$   s       r   add_certificatez"OCSPRequestBuilder.add_certificate  s     =$(:(FMNNN)$$$$ 011 	ED$:
 :
 	E CDDD!69%t'94;K
 
 	
r   rY   rQ   rU   r`   r]   c                   | j         | j        t          d          t          |t                    st          d          t          |           t          j        d|           t          j        d|           |j	        t          |          k    s|j	        t          |          k    rt          d          t          | j         ||||f| j                  S )Nr   z serial_number must be an integerrY   rU   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r   r   r+   r)   r]   rB   r,   r   _check_bytesdigest_sizelenr   r   )rM   rY   rU   r`   r$   s        r   add_certificate_by_hashz*OCSPRequestBuilder.add_certificate_by_hash  s     =$(:(FMNNN--- 	@>???)$$$-/?@@@,o>>> C%
 %
 
 
"c/&:&:::6  
 "MyI
 
 	
r   extvalx509.ExtensionTypecriticalboolc                    t          |t          j                  st          d          t          j        |j        ||          }t          || j                   t          | j	        | j
        | j        |gz             S Nz"extension must be an ExtensionType)r)   r   ExtensionTyperB   	Extensionoidr   r   r   r   r   rM   r   r   	extensions       r   add_extensionz OCSPRequestBuilder.add_extension  sy     &$"455 	B@AAAN6:x@@	#It/?@@@!M4-t/?9+/M
 
 	
r   rP   c                d    | j         | j        t          d          t          j        |           S )Nz*You must add a certificate before building)r   r   r+   r   create_ocsp_requestrT   s    r   buildzOCSPRequestBuilder.build  s2    = T%7%?IJJJ'---r   )r   r   r   r   rh   r   r&   r'   )r4   r5   r6   r5   r$   r%   r&   r   )
rY   rQ   rU   rQ   r`   r]   r$   r%   r&   r   )r   r   r   r   r&   r   )r&   rP   )r   r   r   rN   r   r   r   r   r   r   r   r   r     s          FH& & & & & 
 
 
 
&
 
 
 
<
 
 
 
. . . . . .r   r   c                  `    e Zd Zdddg fd.d
Zd/dZd0dZd1d Zd2d%Zd3d*Ze	d4d-            Z
dS )5OCSPResponseBuilderNresponse typing.Optional[_SingleResponse]responder_idFtyping.Optional[typing.Tuple[x509.Certificate, OCSPResponderEncoding]]certs.typing.Optional[typing.List[x509.Certificate]]rh   r   c                >    || _         || _        || _        || _        d S r   )	_response_responder_id_certsr   )rM   r   r   r   rh   s        r   rN   zOCSPResponseBuilder.__init__  s(     ")%r   r4   r5   r6   r$   r%   r7   r.   r8   r9   r:   r;   r<   r=   r>   r&   c	           
         | j         t          d          t          ||||||||          }	t          |	| j        | j        | j                  S )Nz#Only one response per OCSPResponse.)r   r+   r3   r   r   r   r   )
rM   r4   r6   r$   r7   r8   r:   r<   r=   
singleresps
             r   add_responsez OCSPResponseBuilder.add_response  sj     >%BCCC$	
 	

 #K	
 
 	
r   ra   r   responder_certc                   | j         t          d          t          |t          j                  st          d          t          |t                    st          d          t          | j        ||f| j	        | j
                  S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r   r+   r)   r   rA   rB   r   r   r   r   r   )rM   ra   r   s      r   r   z OCSPResponseBuilder.responder_id  s     )@AAA.$*:;; 	DBCCC($9:: 	H   #NX&K	
 
 	
r   !typing.Iterable[x509.Certificate]c                "   | j         t          d          t          |          }t          |          dk    rt          d          t	          d |D                       st          d          t          | j        | j        || j	                  S )Nz!certificates may only be set oncer   zcerts must not be an empty listc              3  J   K   | ]}t          |t          j                  V  d S r   )r)   r   rA   ).0xs     r   	<genexpr>z3OCSPResponseBuilder.certificates.<locals>.<genexpr>4  s/      BBq:a!122BBBBBBr   z$certs must be a list of Certificates)
r   r+   listr   allrB   r   r   r   r   )rM   r   s     r   r   z OCSPResponseBuilder.certificates,  s     ;"@AAAUu::??>???BBEBBBBB 	DBCCC"N	
 
 	
r   r   r   r   r   c                   t          |t          j                  st          d          t          j        |j        ||          }t          || j                   t          | j	        | j
        | j        | j        |gz             S r   )r)   r   r   rB   r   r   r   r   r   r   r   r   r   s       r   r   z!OCSPResponseBuilder.add_extension=  s     &$"455 	B@AAAN6:x@@	#It/?@@@"NK	{*	
 
 	
r   private_keyr	   r   r   c                    | j         t          d          | j        t          d          t          j        t
          j        | ||          S )Nz&You must add a response before signingz*You must add a responder_id before signing)r   r+   r   r   create_ocsp_responser   r   )rM   r   r$   s      r   signzOCSPResponseBuilder.signM  sT    
 >!EFFF%IJJJ()4i
 
 	
r   r   r   c                    t          |t                    st          d          |t          j        u rt	          d          t          j        |d d d           S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r)   r   rB   r   r+   r   r   )clsr   s     r   build_unsuccessfulz&OCSPResponseBuilder.build_unsuccessful[  sc     /+=>> 	I   0;;;CDDD($dKKKr   )r   r   r   r   r   r   rh   r   )r4   r5   r6   r5   r$   r%   r7   r.   r8   r9   r:   r;   r<   r;   r=   r>   r&   r   )ra   r   r   r5   r&   r   )r   r   r&   r   )r   r   r   r   r&   r   )r   r	   r$   r   r&   r   )r   r   r&   r   )r   r   r   rN   r   r   r   r   r   classmethodr   r   r   r   r   r     s         6: @DFH& & & & &
 
 
 
>
 
 
 
&
 
 
 
"
 
 
 
 
 
 
 
 
L 
L 
L [
L 
L 
Lr   r   datarQ   c                *    t          j        |           S r   )r   load_der_ocsp_requestr   s    r   r   r   i  s    %d+++r   c                *    t          j        |           S r   )r   load_der_ocsp_responser   s    r   r   r   m  s    &t,,,r   )r$   r%   r&   r'   )r   rQ   r&   rP   )r   rQ   r&   r   )'
__future__r   ro   rC   typingcryptographyr   r   "cryptography.hazmat.bindings._rustr   cryptography.hazmat.primitivesr   r   /cryptography.hazmat.primitives.asymmetric.typesr	   cryptography.x509.baser
   r   r   Enumr   r   SHA1SHA224SHA256SHA384SHA512r*   r,   r.   r3   ABCMetarP   rs   r   r   r   r   r   r   r   r   <module>r	     s  
 # " " " " " 



   $ $ $ $ $ $ $ $ 3 3 3 3 3 3 @ @ @ @ @ @ @ @                  EJ   
        K
M
M
M
M
 
 
 
    UZ   C4 C4 C4 C4 C4 C4 C4 C4L( ( ( ( (CK ( ( ( (VA A A A A3; A A A AHa a a a aS[ a a a aHS. S. S. S. S. S. S. S.l{L {L {L {L {L {L {L {L|, , , ,- - - - - -r   