o
    h~,                     @  s  d dl mZ d dlZd dlZd dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZe
je
je
je
je
jfZdddZG dd dejZG dd dZejZejZejZG dd dZ G dd dZ!ej"Z"ej#Z#dS )    )annotationsN)utilsx509)ocsp)hashes) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   I/var/www/html/venv/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr      s    r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s    r   	algorithmhashes.HashAlgorithmreturnNonec                 C  s   t | ts	tdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm.   s
   
r#   c                   @  s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDUNKNOWNr   r   r   r   r$   5   s    r$   c                   @  s   e Zd ZdddZdS )_SingleResponsecertx509.Certificateissuerr   r   cert_statusr$   this_updatedatetime.datetimenext_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec	           	      C  s  t |tjrt |tjstdt| t |tjstd|d ur,t |tjs,td|| _|| _|| _|| _	|| _
t |tsDtd|tjurZ|d urQtd|d urYtdn$t |tjsdtdt|}|tk rptd|d ur~t |tjs~td	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r    r   Certificate	TypeErrorr#   datetimeZ_certZ_issuer
_algorithmZ_this_updateZ_next_updater$   r%   r"   r	   r   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr(   r*   r   r+   r,   r.   r0   r1   r   r   r   __init__<   s\   




z_SingleResponse.__init__N)r(   r)   r*   r)   r   r   r+   r$   r,   r-   r.   r/   r0   r/   r1   r2   )r   r   r   r9   r   r   r   r   r'   ;   s    r'   c                   @  sF   e Zd Zddg fd#d
dZd$ddZd%ddZd&ddZd'd!d"ZdS )(OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonerequest_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | None
extensions(list[x509.Extension[x509.ExtensionType]]r   r   c                 C  s   || _ || _|| _d S N)_request_request_hash_extensions)r8   r;   r=   r?   r   r   r   r9      s   

zOCSPRequestBuilder.__init__r(   r)   r*   r   r   c                 C  sZ   | j d us
| jd urtdt| t|tjrt|tjs"tdt|||f| j| j	S )N.Only one certificate can be added to a requestr3   )
rB   rC   r"   r#   r    r   r4   r5   r:   rD   )r8   r(   r*   r   r   r   r   add_certificate   s   z"OCSPRequestBuilder.add_certificateissuer_name_hashbytesissuer_key_hashserial_numberintc                 C  s   | j d us
| jd urtdt|tstdt| td| td| |j	t
|ks5|j	t
|kr9tdt| j ||||f| jS )NrE   z serial_number must be an integerrG   rI   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rB   rC   r"   r    rK   r5   r#   r   _check_bytesdigest_sizelenr:   rD   )r8   rG   rI   rJ   r   r   r   r   add_certificate_by_hash   s&   

z*OCSPRequestBuilder.add_certificate_by_hashextvalx509.ExtensionTypecriticalboolc                 C  sJ   t |tjs
tdt|j||}t|| j t| j	| j
g | j|S Nz"extension must be an ExtensionType)r    r   ExtensionTyper5   	Extensionoidr
   rD   r:   rB   rC   r8   rP   rR   	extensionr   r   r   add_extension   s   z OCSPRequestBuilder.add_extensionOCSPRequestc                 C  s&   | j d u r| jd u rtdt| S )Nz*You must add a certificate before building)rB   rC   r"   r   Zcreate_ocsp_request)r8   r   r   r   build   s   
zOCSPRequestBuilder.build)r;   r<   r=   r>   r?   r@   r   r   )r(   r)   r*   r)   r   r   r   r:   )
rG   rH   rI   rH   rJ   rK   r   r   r   r:   )rP   rQ   rR   rS   r   r:   )r   r[   )r   r   r   r9   rF   rO   rZ   r\   r   r   r   r   r:      s    


r:   c                   @  s`   e Zd Zdddg fd5d
dZd6ddZd7d d!Zd8d#d$Zd9d)d*Zd:d/d0Ze	d;d3d4Z
dS )<OCSPResponseBuilderNresponse_SingleResponse | Noneresponder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecertslist[x509.Certificate] | Noner?   r@   c                 C  s   || _ || _|| _|| _d S rA   )	_response_responder_id_certsrD   )r8   r^   r`   rb   r?   r   r   r   r9      s   
zOCSPResponseBuilder.__init__r(   r)   r*   r   r   r+   r$   r,   r-   r.   r/   r0   r1   r2   r   c	           
   	   C  s<   | j d ur	tdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)rd   r"   r'   r]   re   rf   rD   )
r8   r(   r*   r   r+   r,   r.   r0   r1   Z
singlerespr   r   r   add_response   s$   

z OCSPResponseBuilder.add_responseencodingr   responder_certc                 C  sP   | j d ur	tdt|tjstdt|tstdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)re   r"   r    r   r4   r5   r   r]   rd   rf   rD   )r8   rh   ri   r   r   r   r`     s   

z OCSPResponseBuilder.responder_id!typing.Iterable[x509.Certificate]c                 C  s\   | j d ur	tdt|}t|dkrtdtdd |D s$tdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s    | ]	}t |tjV  qd S rA   )r    r   r4   ).0xr   r   r   	<genexpr>"  s    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rf   r"   listrN   allr5   r]   rd   re   rD   )r8   rb   r   r   r   certificates  s   
z OCSPResponseBuilder.certificatesrP   rQ   rR   rS   c                 C  sN   t |tjs
tdt|j||}t|| j t| j	| j
| jg | j|S rT   )r    r   rU   r5   rV   rW   r
   rD   r]   rd   re   rf   rX   r   r   r   rZ   +  s   z!OCSPResponseBuilder.add_extensionprivate_keyr   hashes.HashAlgorithm | NoneOCSPResponsec                 C  s6   | j d u r	td| jd u rtdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)rd   r"   re   r   create_ocsp_responser   r   )r8   rq   r   r   r   r   sign;  s   


zOCSPResponseBuilder.signresponse_statusr   c                 C  s4   t |ts	td|tju rtdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r    r   r5   r   r"   r   rt   )clsrv   r   r   r   build_unsuccessfulI  s   

z&OCSPResponseBuilder.build_unsuccessful)r^   r_   r`   ra   rb   rc   r?   r@   )r(   r)   r*   r)   r   r   r+   r$   r,   r-   r.   r/   r0   r/   r1   r2   r   r]   )rh   r   ri   r)   r   r]   )rb   rj   r   r]   )rP   rQ   rR   rS   r   r]   )rq   r   r   rr   r   rs   )rv   r   r   rs   )r   r   r   r9   rg   r`   rp   rZ   ru   classmethodrx   r   r   r   r   r]      s    




r]   )r   r   r   r   )$
__future__r   r6   typingZcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser   r	   r
   Enumr   r   SHA1SHA224SHA256SHA384SHA512r!   r#   r$   r'   r[   rs   ZOCSPSingleResponser:   r]   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   <module>   s4   

	FT}
