U
    üS‚g~,  ã                   @  s  d dl mZ d dlZd dlZd dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZmZ G dd	„ d	ejƒZG d
d„ dejƒZe
je
je
je
je
jfZdddœdd„ZG dd„ dejƒZG dd„ dƒZejZejZejZG dd„ dƒZ G dd„ dƒZ!ej"Z"ej#Z#dS )é    )ÚannotationsN)ÚutilsÚx509)Úocsp)Úhashes)Ú CertificateIssuerPrivateKeyTypes)Ú_EARLIEST_UTC_TIMEÚ_convert_to_naive_utc_timeÚ_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú
__module__Ú__qualname__ÚHASHÚNAME© r   r   ú:/tmp/pip-unpacked-wheel-xwsikbwl/cryptography/x509/ocsp.pyr      s   r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚOCSPResponseStatusr   é   é   é   é   é   N)	r   r   r   Ú
SUCCESSFULZMALFORMED_REQUESTÚINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDÚUNAUTHORIZEDr   r   r   r   r      s   r   úhashes.HashAlgorithmÚNone)Ú	algorithmÚreturnc                 C  s   t | tƒstdƒ‚d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú
isinstanceÚ_ALLOWED_HASHESÚ
ValueError)r   r   r   r   Ú_verify_algorithm.   s    
ÿr#   c                   @  s   e Zd ZdZdZdZdS )ÚOCSPCertStatusr   r   r   N)r   r   r   ZGOODÚREVOKEDÚUNKNOWNr   r   r   r   r$   5   s   r$   c                	   @  s(   e Zd Zdddddddddœdd	„Zd
S )Ú_SingleResponseúx509.Certificater   r$   údatetime.datetimeúdatetime.datetime | Noneúx509.ReasonFlags | None)ÚcertÚissuerr   Úcert_statusÚthis_updateÚnext_updateÚrevocation_timeÚrevocation_reasonc	           	      C  s  t |tjƒrt |tjƒs tdƒ‚t|ƒ t |tjƒs<tdƒ‚|d k	rXt |tjƒsXtdƒ‚|| _|| _|| _|| _	|| _
t |tƒsˆtdƒ‚|tjk	r´|d k	r¢tdƒ‚|d k	rütdƒ‚nHt |tjƒsÈtdƒ‚t|ƒ}|tk ràtdƒ‚|d k	rüt |tjƒsütd	ƒ‚|| _|| _|| _d S )
Nú%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r    r   ÚCertificateÚ	TypeErrorr#   ÚdatetimeZ_certZ_issuerÚ
_algorithmZ_this_updateZ_next_updater$   r%   r"   r	   r   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	Úselfr,   r-   r   r.   r/   r0   r1   r2   r   r   r   Ú__init__<   s`     ÿ
 ÿ
ÿ
ÿÿÿ
 ÿÿz_SingleResponse.__init__N)r   r   r   r9   r   r   r   r   r'   ;   s   r'   c                   @  sr   e Zd Zddg fdddddœdd„Zd	d	d
d dœdd„Zdddd
d dœdd„Zddd dœdd„Zddœdd„ZdS )ÚOCSPRequestBuilderNzFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonez5tuple[bytes, bytes, int, hashes.HashAlgorithm] | Noneú(list[x509.Extension[x509.ExtensionType]]r   )ÚrequestÚrequest_hashÚ
extensionsr   c                 C  s   || _ || _|| _d S ©N)Ú_requestÚ_request_hashÚ_extensions)r8   r<   r=   r>   r   r   r   r9   ‡   s    
zOCSPRequestBuilder.__init__r(   r   )r,   r-   r   r   c                 C  sZ   | j d k	s| jd k	rtdƒ‚t|ƒ t|tjƒr<t|tjƒsDtdƒ‚t|||f| j| j	ƒS )Nú.Only one certificate can be added to a requestr3   )
r@   rA   r"   r#   r    r   r4   r5   r:   rB   )r8   r,   r-   r   r   r   r   Úadd_certificate•   s     ÿ  ÿz"OCSPRequestBuilder.add_certificateÚbytesÚint)Úissuer_name_hashÚissuer_key_hashÚserial_numberr   r   c                 C  sŠ   | j d k	s| jd k	rtdƒ‚t|tƒs.tdƒ‚t|ƒ t d|¡ t d|¡ |j	t
|ƒksj|j	t
|ƒkrrtdƒ‚t| j ||||f| jƒS )NrC   z serial_number must be an integerrG   rH   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r@   rA   r"   r    rF   r5   r#   r   Ú_check_bytesÚdigest_sizeÚlenr:   rB   )r8   rG   rH   rI   r   r   r   r   Úadd_certificate_by_hash¨   s(    
ÿþÿ
ýz*OCSPRequestBuilder.add_certificate_by_hashúx509.ExtensionTypeÚbool©ÚextvalÚcriticalr   c                 C  sH   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| j|f•ƒS ©Nz"extension must be an ExtensionType)r    r   ÚExtensionTyper5   Ú	ExtensionÚoidr
   rB   r:   r@   rA   ©r8   rQ   rR   Ú	extensionr   r   r   Úadd_extensionÆ   s      
ÿz OCSPRequestBuilder.add_extensionÚOCSPRequest)r   c                 C  s&   | j d kr| jd krtdƒ‚t | ¡S )Nz*You must add a certificate before building)r@   rA   r"   r   Zcreate_ocsp_request)r8   r   r   r   ÚbuildÓ   s    zOCSPRequestBuilder.build)r   r   r   r9   rD   rM   rY   r[   r   r   r   r   r:   †   s   ør:   c                
   @  s¢   e Zd Zdddg fdddddœdd„Zd	d	d
dddddd dœ	dd„Zdd	d dœdd„Zdd dœdd„Zddd dœdd„Zdd d!d"œd#d$„Ze	d%d!d&œd'd(„ƒZ
dS ))ÚOCSPResponseBuilderNz_SingleResponse | Nonez5tuple[x509.Certificate, OCSPResponderEncoding] | Nonezlist[x509.Certificate] | Noner;   )ÚresponseÚresponder_idÚcertsr>   c                 C  s   || _ || _|| _|| _d S r?   )Ú	_responseÚ_responder_idÚ_certsrB   )r8   r]   r^   r_   r>   r   r   r   r9   Û   s    zOCSPResponseBuilder.__init__r(   r   r$   r)   r*   r+   )	r,   r-   r   r.   r/   r0   r1   r2   r   c	           
   	   C  s<   | j d k	rtdƒ‚t||||||||ƒ}	t|	| j| j| jƒS )Nz#Only one response per OCSPResponse.)r`   r"   r'   r\   ra   rb   rB   )
r8   r,   r-   r   r.   r/   r0   r1   r2   Z
singlerespr   r   r   Úadd_responseè   s$    
ø
üz OCSPResponseBuilder.add_responser   )ÚencodingÚresponder_certr   c                 C  sP   | j d k	rtdƒ‚t|tjƒs&tdƒ‚t|tƒs8tdƒ‚t| j||f| j	| j
ƒS )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)ra   r"   r    r   r4   r5   r   r\   r`   rb   rB   )r8   rd   re   r   r   r   r^     s    

ÿüz OCSPResponseBuilder.responder_idz!typing.Iterable[x509.Certificate])r_   r   c                 C  s\   | j d k	rtdƒ‚t|ƒ}t|ƒdkr.tdƒ‚tdd„ |D ƒƒsHtdƒ‚t| j| j|| j	ƒS )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   | ]}t |tjƒV  qd S r?   )r    r   r4   )Ú.0Úxr   r   r   Ú	<genexpr>"  s     z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rb   r"   ÚlistrL   Úallr5   r\   r`   ra   rB   )r8   r_   r   r   r   Úcertificates  s    
üz OCSPResponseBuilder.certificatesrN   rO   rP   c                 C  sL   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| j| j|f•ƒS rS   )r    r   rT   r5   rU   rV   r
   rB   r\   r`   ra   rb   rW   r   r   r   rY   +  s    
üz!OCSPResponseBuilder.add_extensionr   zhashes.HashAlgorithm | NoneÚOCSPResponse)Úprivate_keyr   r   c                 C  s6   | j d krtdƒ‚| jd kr$tdƒ‚t tj| ||¡S )Nz&You must add a response before signingz*You must add a responder_id before signing)r`   r"   ra   r   Úcreate_ocsp_responser   r   )r8   rm   r   r   r   r   Úsign;  s    

   ÿzOCSPResponseBuilder.signr   )Úresponse_statusr   c                 C  s4   t |tƒstdƒ‚|tjkr$tdƒ‚t |d d d ¡S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r    r   r5   r   r"   r   rn   )Úclsrp   r   r   r   Úbuild_unsuccessfulI  s    
ÿ
z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r9   rc   r^   rk   rY   ro   Úclassmethodrr   r   r   r   r   r\   Ú   s   úr\   )$Ú
__future__r   r6   ÚtypingZcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser   r	   r
   ÚEnumr   r   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512r!   r#   r$   r'   rZ   rl   ZOCSPSingleResponser:   r\   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   Ú<module>   s2   
û	FT}