U
    /2‹i›1  ã                   @  s
  d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ G d	d
„ d
ejƒZG dd„ dejƒZejejejejejfZdddœdd„ZG dd„ dejƒZG dd„ dƒZe	jZe	jZe	jZG dd„ dƒZG dd„ dƒZ e	j!Z!e	j"Z"dS )é    )ÚannotationsN)ÚIterable)ÚutilsÚx509)Úocsp)Úhashes)Ú CertificateIssuerPrivateKeyTypes)Ú_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú
__module__Ú__qualname__ÚHASHÚNAME© r   r   ú:/tmp/pip-unpacked-wheel-d9r6v89i/cryptography/x509/ocsp.pyr
      s   r
   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚOCSPResponseStatusr   é   é   é   é   é   N)	r   r   r   Ú
SUCCESSFULZMALFORMED_REQUESTÚINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDÚUNAUTHORIZEDr   r   r   r   r      s   r   úhashes.HashAlgorithmÚNone)Ú	algorithmÚreturnc                 C  s   t | tƒstdƒ‚d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú
isinstanceÚ_ALLOWED_HASHESÚ
ValueError)r   r   r   r   Ú_verify_algorithm*   s    
ÿr"   c                   @  s   e Zd ZdZdZdZdS )ÚOCSPCertStatusr   r   r   N)r   r   r   ZGOODÚREVOKEDÚUNKNOWNr   r   r   r   r#   1   s   r#   c                	   @  s(   e Zd Zdddddddddœd	d
„ZdS )Ú_SingleResponsez0tuple[x509.Certificate, x509.Certificate] | Noneztuple[bytes, bytes, int] | Noner   r#   údatetime.datetimeúdatetime.datetime | Noneúx509.ReasonFlags | None)ÚrespÚ	resp_hashr   Úcert_statusÚthis_updateÚnext_updateÚrevocation_timeÚrevocation_reasonc	           	      C  sÚ   t |ƒ t|tjƒstdƒ‚|d k	r8t|tjƒs8tdƒ‚|| _|| _|| _|| _|| _t|t	ƒshtdƒ‚|t	j
k	r”|d k	r‚tdƒ‚|d k	rÄtdƒ‚n0t|tjƒs¨tdƒ‚|d k	rÄt|tjƒsÄtdƒ‚|| _|| _|| _d S )Nz%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectzCrevocation_reason must be an item from the ReasonFlags enum or None)r"   r   ÚdatetimeÚ	TypeErrorZ_respZ
_resp_hashÚ
_algorithmZ_this_updateZ_next_updater#   r$   r!   r   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	Úselfr*   r+   r   r,   r-   r.   r/   r0   r   r   r   Ú__init__8   sL    
 ÿ
ÿ
ÿÿ
 ÿÿz_SingleResponse.__init__N)r   r   r   r5   r   r   r   r   r&   7   s   r&   c                   @  sr   e Zd Zddg fdddddœdd„Zd	d	d
d dœdd„Zdddd
d dœdd„Zddd dœdd„Zddœdd„ZdS )ÚOCSPRequestBuilderNzFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonez5tuple[bytes, bytes, int, hashes.HashAlgorithm] | Noneú(list[x509.Extension[x509.ExtensionType]]r   )ÚrequestÚrequest_hashÚ
extensionsr   c                 C  s   || _ || _|| _d S ©N)Ú_requestÚ_request_hashÚ_extensions)r4   r8   r9   r:   r   r   r   r5   w   s    
zOCSPRequestBuilder.__init__úx509.Certificater   )ÚcertÚissuerr   r   c                 C  sZ   | j d k	s| jd k	rtdƒ‚t|ƒ t|tjƒr<t|tjƒsDtdƒ‚t|||f| j| j	ƒS )Nú.Only one certificate can be added to a requestú%cert and issuer must be a Certificate)
r<   r=   r!   r"   r   r   ÚCertificater2   r6   r>   )r4   r@   rA   r   r   r   r   Úadd_certificate…   s     ÿ  ÿz"OCSPRequestBuilder.add_certificateÚbytesÚint)Úissuer_name_hashÚissuer_key_hashÚserial_numberr   r   c                 C  sŠ   | j d k	s| jd k	rtdƒ‚t|tƒs.tdƒ‚t|ƒ t d|¡ t d|¡ |j	t
|ƒksj|j	t
|ƒkrrtdƒ‚t| j ||||f| jƒS )NrB   ú serial_number must be an integerrH   rI   ú`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r<   r=   r!   r   rG   r2   r"   r   Ú_check_bytesÚdigest_sizeÚlenr6   r>   )r4   rH   rI   rJ   r   r   r   r   Úadd_certificate_by_hash˜   s(    
ÿþÿ
ýz*OCSPRequestBuilder.add_certificate_by_hashúx509.ExtensionTypeÚbool©ÚextvalÚcriticalr   c                 C  sH   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| j|f•ƒS ©Nz"extension must be an ExtensionType)r   r   ÚExtensionTyper2   Ú	ExtensionÚoidr	   r>   r6   r<   r=   ©r4   rT   rU   Ú	extensionr   r   r   Úadd_extension¶   s      
ÿz OCSPRequestBuilder.add_extensionÚOCSPRequest)r   c                 C  s&   | j d kr| jd krtdƒ‚t | ¡S )Nz*You must add a certificate before building)r<   r=   r!   r   Zcreate_ocsp_request)r4   r   r   r   ÚbuildÃ   s    zOCSPRequestBuilder.build)r   r   r   r5   rE   rP   r\   r^   r   r   r   r   r6   v   s   ør6   c                   @  sÂ   e Zd Zdddg fdddddœdd„Zd	d	d
dddddd dœ	dd„Zdddd
dddddd dœ
dd„Zdd	d dœdd„Zdd dœdd„Zdd d d!œd"d#„Zd$d%d&d'œd(d)„Z	e
d*d&d+œd,d-„ƒZdS ).ÚOCSPResponseBuilderNz_SingleResponse | Nonez5tuple[x509.Certificate, OCSPResponderEncoding] | Nonezlist[x509.Certificate] | Noner7   )ÚresponseÚresponder_idÚcertsr:   c                 C  s   || _ || _|| _|| _d S r;   )Ú	_responseÚ_responder_idÚ_certsr>   )r4   r`   ra   rb   r:   r   r   r   r5   Ë   s    zOCSPResponseBuilder.__init__r?   r   r#   r'   r(   r)   )	r@   rA   r   r,   r-   r.   r/   r0   r   c	           
   	   C  s`   | j d k	rtdƒ‚t|tjƒr*t|tjƒs2tdƒ‚t||fd ||||||ƒ}	t|	| j| j	| j
ƒS )Nú#Only one response per OCSPResponse.rC   )rc   r!   r   r   rD   r2   r&   r_   rd   re   r>   )
r4   r@   rA   r   r,   r-   r.   r/   r0   Ú
singlerespr   r   r   Úadd_responseØ   s.    
 ÿø
üz OCSPResponseBuilder.add_responserF   rG   )
rH   rI   rJ   r   r,   r-   r.   r/   r0   r   c
              	   C  s˜   | j d k	rtdƒ‚t|tƒs$tdƒ‚t d|¡ t d|¡ t|ƒ |jt	|ƒks`|jt	|ƒkrhtdƒ‚t
d |||f||||||	ƒ}
t|
| j| j| jƒS )Nrf   rK   rH   rI   rL   )rc   r!   r   rG   r2   r   rM   r"   rN   rO   r&   r_   rd   re   r>   )r4   rH   rI   rJ   r   r,   r-   r.   r/   r0   rg   r   r   r   Úadd_response_by_hashü   s>    

ÿþÿø
üz(OCSPResponseBuilder.add_response_by_hashr
   )ÚencodingÚresponder_certr   c                 C  sP   | j d k	rtdƒ‚t|tjƒs&tdƒ‚t|tƒs8tdƒ‚t| j||f| j	| j
ƒS )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)rd   r!   r   r   rD   r2   r
   r_   rc   re   r>   )r4   rj   rk   r   r   r   ra   *  s    

ÿüz OCSPResponseBuilder.responder_idzIterable[x509.Certificate])rb   r   c                 C  s\   | j d k	rtdƒ‚t|ƒ}t|ƒdkr.tdƒ‚tdd„ |D ƒƒsHtdƒ‚t| j| j|| j	ƒS )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   | ]}t |tjƒV  qd S r;   )r   r   rD   )Ú.0Úxr   r   r   Ú	<genexpr>E  s     z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
re   r!   ÚlistrO   Úallr2   r_   rc   rd   r>   )r4   rb   r   r   r   Úcertificates=  s    
üz OCSPResponseBuilder.certificatesrQ   rR   rS   c                 C  sL   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| j| j|f•ƒS rV   )r   r   rW   r2   rX   rY   r	   r>   r_   rc   rd   re   rZ   r   r   r   r\   N  s    
üz!OCSPResponseBuilder.add_extensionr   zhashes.HashAlgorithm | NoneÚOCSPResponse)Úprivate_keyr   r   c                 C  s6   | j d krtdƒ‚| jd kr$tdƒ‚t tj| ||¡S )Nz&You must add a response before signingz*You must add a responder_id before signing)rc   r!   rd   r   Úcreate_ocsp_responser   r   )r4   rs   r   r   r   r   Úsign^  s    

   ÿzOCSPResponseBuilder.signr   )Úresponse_statusr   c                 C  s4   t |tƒstdƒ‚|tjkr$tdƒ‚t |d d d ¡S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r2   r   r!   r   rt   )Úclsrv   r   r   r   Úbuild_unsuccessfull  s    
ÿ
z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r5   rh   ri   ra   rq   r\   ru   Úclassmethodrx   r   r   r   r   r_   Ê   s   ú$ .r_   )#Ú
__future__r   r1   Úcollections.abcr   Zcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser	   ÚEnumr
   r   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512r    r"   r#   r&   r]   rr   ZOCSPSingleResponser6   r_   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   Ú<module>   s4   
û	:T 1