U
    c3A                     @   sV  d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZe	je	je	je	je	jfZe	jddddZG dd dejZG dd dZG dd de jdZG dd de jdZ G dd de jdZ!G dd dZ"G dd dZ#e$eddd Z%e$e!dd!d"Z&dS )#    N)utils)x509)ocsp)hashesserialization)CERTIFICATE_PRIVATE_KEY_TYPES)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @   s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__ZHASHNAME r   r   5lib/python3.8/site-packages/cryptography/x509/ocsp.pyr      s   r   c                   @   s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDZUNAUTHORIZEDr   r   r   r   r      s   r   )	algorithmreturnc                 C   s   t | tstdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm/   s    
r   c                   @   s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDZUNKNOWNr   r   r   r   r   6   s   r   c                	   @   sH   e Zd Zejejejeeje	j
ej e	j
ej e	j
ej dddZdS )_SingleResponse)certissuerr   cert_statusthis_updatenext_updaterevocation_timerevocation_reasonc	           	      C   s  t |tjrt |tjs tdt| t |tjs<td|d k	rXt |tjsXtd|| _|| _|| _|| _	|| _
t |tstd|tjk	r|d k	rtd|d k	rtdnHt |tjstdt|}|tk rtd|d k	rt |tjstd	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r   r   Certificate	TypeErrorr   datetimeZ_certZ_issuerZ
_algorithmZ_this_updateZ_next_updater   r    r   r	   r   ReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr"   r#   r   r$   r%   r&   r'   r(   r   r   r   __init__=   s`     
 


 z_SingleResponse.__init__N)r   r   r   r   r*   r   HashAlgorithmr   r,   typingOptionalr-   r/   r   r   r   r   r!   <   s   


r!   c                   @   s   e Zd ZejedddZejedddZejej	dddZ
ejeddd	Zejejed
ddZejejdddZdS )OCSPRequestr   c                 C   s   dS z3
        The hash of the issuer public key
        Nr   r.   r   r   r   issuer_key_hash   s    zOCSPRequest.issuer_key_hashc                 C   s   dS z-
        The hash of the issuer name
        Nr   r6   r   r   r   issuer_name_hash   s    zOCSPRequest.issuer_name_hashc                 C   s   dS zK
        The hash algorithm used in the issuer name and key hashes
        Nr   r6   r   r   r   hash_algorithm   s    zOCSPRequest.hash_algorithmc                 C   s   dS zM
        The serial number of the cert whose status is being checked
        Nr   r6   r   r   r   serial_number   s    zOCSPRequest.serial_numberencodingr   c                 C   s   dS )z/
        Serializes the request to DER
        Nr   r.   r?   r   r   r   public_bytes   s    zOCSPRequest.public_bytesc                 C   s   dS )zP
        The list of request extensions. Not single request extensions.
        Nr   r6   r   r   r   
extensions   s    zOCSPRequest.extensionsN)r   r   r   abcabstractpropertybytesr7   r9   r   r0   r;   intr=   abstractmethodr   EncodingrA   r   
ExtensionsrB   r   r   r   r   r3      s   r3   )	metaclassc                   @   s   e Zd ZejedddZejeje	j	 dddZ
ejejej dddZeje	j	ddd	Zejeje	j	 dd
dZejedddZejedddZejejdddZejedddZdS )OCSPSingleResponser4   c                 C   s   dS zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   r6   r   r   r   certificate_status   s    z%OCSPSingleResponse.certificate_statusc                 C   s   dS z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   r6   r   r   r   r'      s    z"OCSPSingleResponse.revocation_timec                 C   s   dS zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   r6   r   r   r   r(      s    z$OCSPSingleResponse.revocation_reasonc                 C   s   dS z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   r6   r   r   r   r%      s    zOCSPSingleResponse.this_updatec                 C   s   dS zC
        The time when newer information will be available
        Nr   r6   r   r   r   r&      s    zOCSPSingleResponse.next_updatec                 C   s   dS r5   r   r6   r   r   r   r7      s    z"OCSPSingleResponse.issuer_key_hashc                 C   s   dS r8   r   r6   r   r   r   r9      s    z#OCSPSingleResponse.issuer_name_hashc                 C   s   dS r:   r   r6   r   r   r   r;      s    z!OCSPSingleResponse.hash_algorithmc                 C   s   dS r<   r   r6   r   r   r   r=      s    z OCSPSingleResponse.serial_numberN)r   r   r   rC   rD   r   rM   r1   r2   r,   r'   r   r-   r(   r%   r&   rE   r7   r9   r   r0   r;   rF   r=   r   r   r   r   rK      s$   rK   c                   @   s  e Zd Zejeje dddZeje	dddZ
ejejdddZejejej ddd	Zejedd
dZejedddZejejej dddZejeje dddZejejej dddZejejdddZejedddZejejej dddZejejej  dddZ!ejejdddZ"ejejej dddZ#ejedd d!Z$ejedd"d#Z%ejejdd$d%Z&eje'dd&d'Z(ejej)dd(d)Z*ejej)dd*d+Z+ej,e-j.ed,d-d.Z/d/S )0OCSPResponser4   c                 C   s   dS )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   r6   r   r   r   	responses   s    zOCSPResponse.responsesc                 C   s   dS )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   r6   r   r   r   response_status   s    zOCSPResponse.response_statusc                 C   s   dS )zA
        The ObjectIdentifier of the signature algorithm
        Nr   r6   r   r   r   signature_algorithm_oid   s    z$OCSPResponse.signature_algorithm_oidc                 C   s   dS )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   r6   r   r   r   signature_hash_algorithm   s    z%OCSPResponse.signature_hash_algorithmc                 C   s   dS )z%
        The signature bytes
        Nr   r6   r   r   r   	signature   s    zOCSPResponse.signaturec                 C   s   dS )z+
        The tbsResponseData bytes
        Nr   r6   r   r   r   tbs_response_bytes  s    zOCSPResponse.tbs_response_bytesc                 C   s   dS )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   r6   r   r   r   certificates  s    zOCSPResponse.certificatesc                 C   s   dS )z2
        The responder's key hash or None
        Nr   r6   r   r   r   responder_key_hash  s    zOCSPResponse.responder_key_hashc                 C   s   dS )z.
        The responder's Name or None
        Nr   r6   r   r   r   responder_name  s    zOCSPResponse.responder_namec                 C   s   dS )z4
        The time the response was produced
        Nr   r6   r   r   r   produced_at   s    zOCSPResponse.produced_atc                 C   s   dS rL   r   r6   r   r   r   rM   &  s    zOCSPResponse.certificate_statusc                 C   s   dS rN   r   r6   r   r   r   r'   ,  s    zOCSPResponse.revocation_timec                 C   s   dS rO   r   r6   r   r   r   r(   3  s    zOCSPResponse.revocation_reasonc                 C   s   dS rP   r   r6   r   r   r   r%   :  s    zOCSPResponse.this_updatec                 C   s   dS rQ   r   r6   r   r   r   r&   A  s    zOCSPResponse.next_updatec                 C   s   dS r5   r   r6   r   r   r   r7   G  s    zOCSPResponse.issuer_key_hashc                 C   s   dS r8   r   r6   r   r   r   r9   M  s    zOCSPResponse.issuer_name_hashc                 C   s   dS r:   r   r6   r   r   r   r;   S  s    zOCSPResponse.hash_algorithmc                 C   s   dS r<   r   r6   r   r   r   r=   Y  s    zOCSPResponse.serial_numberc                 C   s   dS )zR
        The list of response extensions. Not single response extensions.
        Nr   r6   r   r   r   rB   _  s    zOCSPResponse.extensionsc                 C   s   dS )zR
        The list of single response extensions. Not response extensions.
        Nr   r6   r   r   r   single_extensionse  s    zOCSPResponse.single_extensionsr>   c                 C   s   dS )z0
        Serializes the response to DER
        Nr   r@   r   r   r   rA   k  s    zOCSPResponse.public_bytesN)0r   r   r   rC   rD   r1   IteratorrK   rS   r   rT   r   ZObjectIdentifierrU   r2   r   r0   rV   rE   rW   rX   Listr*   rY   rZ   Namer[   r,   r\   r   rM   r'   r-   r(   r%   r&   r7   r9   r;   rF   r=   rI   rB   r]   rG   r   rH   rA   r   r   r   r   rR      sZ   
rR   c                   @   s   e Zd Zdg fejejejejej	f  ej
ejej  ddddZejejej	d dddZejed dd	d
ZedddZdS )OCSPRequestBuilderN)requestrB   r   c                 C   s   || _ || _d S N)_request_extensions)r.   rb   rB   r   r   r   r/   s  s    	zOCSPRequestBuilder.__init__)r"   r#   r   r   c                 C   sL   | j d k	rtdt| t|tjr2t|tjs:tdt|||f| jS )Nz.Only one certificate can be added to a requestr)   )	rd   r   r   r   r   r*   r+   ra   re   )r.   r"   r#   r   r   r   r   add_certificate  s    
 z"OCSPRequestBuilder.add_certificateextvalcriticalr   c                 C   sD   t |tjstdt|j||}t|| j t| j	| j|g S Nz"extension must be an ExtensionType)
r   r   ExtensionTyper+   	Extensionoidr
   re   ra   rd   r.   rh   ri   	extensionr   r   r   add_extension  s     
z OCSPRequestBuilder.add_extensionr4   c                 C   s   | j d krtdt| S )Nz*You must add a certificate before building)rd   r   r   Zcreate_ocsp_requestr6   r   r   r   build  s    
zOCSPRequestBuilder.build)r   r   r   r1   r2   Tupler   r*   r   r0   r_   rl   rk   r/   rf   boolrp   r3   rq   r   r   r   r   ra   r  s*    ra   c                
   @   s
  e Zd Zdddg feje ejejeje	f  ejej
ej  ej
ejej  dddZejejejeejejej ejej ejej d d	ddZe	ejd dd	d
Zejej d dddZejed dddZeejej edddZeeedddZdS )OCSPResponseBuilderN)responseresponder_idcertsrB   c                 C   s   || _ || _|| _|| _d S rc   )	_response_responder_id_certsre   )r.   ru   rv   rw   rB   r   r   r   r/     s    	zOCSPResponseBuilder.__init__)	r"   r#   r   r$   r%   r&   r'   r(   r   c	           
   	   C   s<   | j d k	rtdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)rx   r   r!   rt   ry   rz   re   )
r.   r"   r#   r   r$   r%   r&   r'   r(   Z
singlerespr   r   r   add_response  s$    

z OCSPResponseBuilder.add_response)r?   responder_certr   c                 C   sP   | j d k	rtdt|tjs&tdt|ts8tdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)ry   r   r   r   r*   r+   r   rt   rx   rz   re   )r.   r?   r|   r   r   r   rv     s    

z OCSPResponseBuilder.responder_id)rw   r   c                 C   s\   | j d k	rtdt|}t|dkr.tdtdd |D sHtdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s   s   | ]}t |tjV  qd S rc   )r   r   r*   ).0xr   r   r   	<genexpr>  s     z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rz   r   listlenallr+   rt   rx   ry   re   )r.   rw   r   r   r   rY     s    
z OCSPResponseBuilder.certificatesrg   c                 C   sL   t |tjstdt|j||}t|| j t| j	| j
| j| j|g S rj   )r   r   rk   r+   rl   rm   r
   re   rt   rx   ry   rz   rn   r   r   r   rp     s    
z!OCSPResponseBuilder.add_extension)private_keyr   r   c                 C   s6   | j d krtd| jd kr$tdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)rx   r   ry   r   create_ocsp_responser   r   )r.   r   r   r   r   r   sign  s    

   zOCSPResponseBuilder.sign)rT   r   c                 C   s4   t |tstd|tjkr$tdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r+   r   r   r   r   )clsrT   r   r   r   build_unsuccessful  s    

z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r1   r2   r!   rr   r   r*   r   r_   rl   rk   r/   r   r0   r   r,   r-   r{   rv   IterablerY   rs   rp   r   rR   r   classmethodr   r   r   r   r   r   rt     sR   


  
 
rt   )datar   c                 C   s
   t | S rc   )r   load_der_ocsp_requestr   r   r   r   r   "  s    r   c                 C   s
   t | S rc   )r   load_der_ocsp_responser   r   r   r   r   &  s    r   )'rC   r,   r1   Zcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser   r	   r
   Enumr   r   ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512r   r0   r   r   r!   ABCMetar3   rK   rR   ra   rt   rE   r   r   r   r   r   r   <module>   s6   
	F&; 2~