U
    cc3A                     @   sV  d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZe	je	je	je	je	jfZe	jddddZG dd dejZG dd dZG dd de jdZG dd de jdZ G dd de jdZ!G dd dZ"G dd dZ#e$eddd Z%e$e!dd!d"Z&dS )#    N)utils)x509)ocsp)hashesserialization)CERTIFICATE_PRIVATE_KEY_TYPES)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @   s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   :/tmp/pip-unpacked-wheel-4layejjw/cryptography/x509/ocsp.pyr      s   r   c                   @   s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s   r   )	algorithmreturnc                 C   s   t | tstdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm/   s    
r!   c                   @   s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDUNKNOWNr   r   r   r   r"   6   s   r"   c                	   @   sH   e Zd Zejejejeeje	j
ej e	j
ej e	j
ej dddZdS )_SingleResponse)certissuerr   cert_statusthis_updatenext_updaterevocation_timerevocation_reasonc	           	      C   s  t |tjrt |tjs tdt| t |tjs<td|d k	rXt |tjsXtd|| _|| _|| _|| _	|| _
t |tstd|tjk	r|d k	rtd|d k	rtdnHt |tjstdt|}|tk rtd|d k	rt |tjstd	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r   r   Certificate	TypeErrorr!   datetimeZ_certZ_issuer
_algorithmZ_this_updateZ_next_updater"   r#   r    r	   r   ReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr&   r'   r   r(   r)   r*   r+   r,   r   r   r   __init__=   s`     
 


 z_SingleResponse.__init__N)r   r   r   r   r.   r   HashAlgorithmr"   r0   typingOptionalr2   r4   r   r   r   r   r%   <   s   


r%   c                   @   s   e Zd ZejedddZejedddZejej	dddZ
ejeddd	Zejejed
ddZejejdddZdS )OCSPRequestr   c                 C   s   dS z3
        The hash of the issuer public key
        Nr   r3   r   r   r   issuer_key_hash   s    zOCSPRequest.issuer_key_hashc                 C   s   dS z-
        The hash of the issuer name
        Nr   r;   r   r   r   issuer_name_hash   s    zOCSPRequest.issuer_name_hashc                 C   s   dS zK
        The hash algorithm used in the issuer name and key hashes
        Nr   r;   r   r   r   hash_algorithm   s    zOCSPRequest.hash_algorithmc                 C   s   dS zM
        The serial number of the cert whose status is being checked
        Nr   r;   r   r   r   serial_number   s    zOCSPRequest.serial_numberencodingr   c                 C   s   dS )z/
        Serializes the request to DER
        Nr   r3   rD   r   r   r   public_bytes   s    zOCSPRequest.public_bytesc                 C   s   dS )zP
        The list of request extensions. Not single request extensions.
        Nr   r;   r   r   r   
extensions   s    zOCSPRequest.extensionsN)r   r   r   abcabstractpropertybytesr<   r>   r   r5   r@   intrB   abstractmethodr   EncodingrF   r   
ExtensionsrG   r   r   r   r   r8      s   r8   )	metaclassc                   @   s   e Zd ZejedddZejeje	j	 dddZ
ejejej dddZeje	j	ddd	Zejeje	j	 dd
dZejedddZejedddZejejdddZejedddZdS )OCSPSingleResponser9   c                 C   s   dS zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   r;   r   r   r   certificate_status   s    z%OCSPSingleResponse.certificate_statusc                 C   s   dS z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   r;   r   r   r   r+      s    z"OCSPSingleResponse.revocation_timec                 C   s   dS zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   r;   r   r   r   r,      s    z$OCSPSingleResponse.revocation_reasonc                 C   s   dS z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   r;   r   r   r   r)      s    zOCSPSingleResponse.this_updatec                 C   s   dS zC
        The time when newer information will be available
        Nr   r;   r   r   r   r*      s    zOCSPSingleResponse.next_updatec                 C   s   dS r:   r   r;   r   r   r   r<      s    z"OCSPSingleResponse.issuer_key_hashc                 C   s   dS r=   r   r;   r   r   r   r>      s    z#OCSPSingleResponse.issuer_name_hashc                 C   s   dS r?   r   r;   r   r   r   r@      s    z!OCSPSingleResponse.hash_algorithmc                 C   s   dS rA   r   r;   r   r   r   rB      s    z OCSPSingleResponse.serial_numberN)r   r   r   rH   rI   r"   rR   r6   r7   r0   r+   r   r2   r,   r)   r*   rJ   r<   r>   r   r5   r@   rK   rB   r   r   r   r   rP      s$   rP   c                   @   s  e Zd Zejeje dddZeje	dddZ
ejejdddZejejej ddd	Zejedd
dZejedddZejejej dddZejeje dddZejejej dddZejejdddZejedddZejejej dddZejejej  dddZ!ejejdddZ"ejejej dddZ#ejedd d!Z$ejedd"d#Z%ejejdd$d%Z&eje'dd&d'Z(ejej)dd(d)Z*ejej)dd*d+Z+ej,e-j.ed,d-d.Z/d/S )0OCSPResponser9   c                 C   s   dS )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   r;   r   r   r   	responses   s    zOCSPResponse.responsesc                 C   s   dS )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   r;   r   r   r   response_status   s    zOCSPResponse.response_statusc                 C   s   dS )zA
        The ObjectIdentifier of the signature algorithm
        Nr   r;   r   r   r   signature_algorithm_oid   s    z$OCSPResponse.signature_algorithm_oidc                 C   s   dS )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   r;   r   r   r   signature_hash_algorithm   s    z%OCSPResponse.signature_hash_algorithmc                 C   s   dS )z%
        The signature bytes
        Nr   r;   r   r   r   	signature   s    zOCSPResponse.signaturec                 C   s   dS )z+
        The tbsResponseData bytes
        Nr   r;   r   r   r   tbs_response_bytes  s    zOCSPResponse.tbs_response_bytesc                 C   s   dS )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   r;   r   r   r   certificates  s    zOCSPResponse.certificatesc                 C   s   dS )z2
        The responder's key hash or None
        Nr   r;   r   r   r   responder_key_hash  s    zOCSPResponse.responder_key_hashc                 C   s   dS )z.
        The responder's Name or None
        Nr   r;   r   r   r   responder_name  s    zOCSPResponse.responder_namec                 C   s   dS )z4
        The time the response was produced
        Nr   r;   r   r   r   produced_at   s    zOCSPResponse.produced_atc                 C   s   dS rQ   r   r;   r   r   r   rR   &  s    zOCSPResponse.certificate_statusc                 C   s   dS rS   r   r;   r   r   r   r+   ,  s    zOCSPResponse.revocation_timec                 C   s   dS rT   r   r;   r   r   r   r,   3  s    zOCSPResponse.revocation_reasonc                 C   s   dS rU   r   r;   r   r   r   r)   :  s    zOCSPResponse.this_updatec                 C   s   dS rV   r   r;   r   r   r   r*   A  s    zOCSPResponse.next_updatec                 C   s   dS r:   r   r;   r   r   r   r<   G  s    zOCSPResponse.issuer_key_hashc                 C   s   dS r=   r   r;   r   r   r   r>   M  s    zOCSPResponse.issuer_name_hashc                 C   s   dS r?   r   r;   r   r   r   r@   S  s    zOCSPResponse.hash_algorithmc                 C   s   dS rA   r   r;   r   r   r   rB   Y  s    zOCSPResponse.serial_numberc                 C   s   dS )zR
        The list of response extensions. Not single response extensions.
        Nr   r;   r   r   r   rG   _  s    zOCSPResponse.extensionsc                 C   s   dS )zR
        The list of single response extensions. Not response extensions.
        Nr   r;   r   r   r   single_extensionse  s    zOCSPResponse.single_extensionsrC   c                 C   s   dS )z0
        Serializes the response to DER
        Nr   rE   r   r   r   rF   k  s    zOCSPResponse.public_bytesN)0r   r   r   rH   rI   r6   IteratorrP   rX   r   rY   r   ZObjectIdentifierrZ   r7   r   r5   r[   rJ   r\   r]   Listr.   r^   r_   Namer`   r0   ra   r"   rR   r+   r2   r,   r)   r*   r<   r>   r@   rK   rB   rN   rG   rb   rL   r   rM   rF   r   r   r   r   rW      sZ   
rW   c                   @   s   e Zd Zdg fejejejejej	f  ej
ejej  ddddZejejej	d dddZejed dd	d
ZedddZdS )OCSPRequestBuilderN)requestrG   r   c                 C   s   || _ || _d S N)_request_extensions)r3   rg   rG   r   r   r   r4   s  s    	zOCSPRequestBuilder.__init__)r&   r'   r   r   c                 C   sL   | j d k	rtdt| t|tjr2t|tjs:tdt|||f| jS )Nz.Only one certificate can be added to a requestr-   )	ri   r    r!   r   r   r.   r/   rf   rj   )r3   r&   r'   r   r   r   r   add_certificate  s    
 z"OCSPRequestBuilder.add_certificateextvalcriticalr   c                 C   sD   t |tjstdt|j||}t|| j t| j	| j|g S Nz"extension must be an ExtensionType)
r   r   ExtensionTyper/   	Extensionoidr
   rj   rf   ri   r3   rm   rn   	extensionr   r   r   add_extension  s     
z OCSPRequestBuilder.add_extensionr9   c                 C   s   | j d krtdt| S )Nz*You must add a certificate before building)ri   r    r   Zcreate_ocsp_requestr;   r   r   r   build  s    
zOCSPRequestBuilder.build)r   r   r   r6   r7   Tupler   r.   r   r5   rd   rq   rp   r4   rk   boolru   r8   rv   r   r   r   r   rf   r  s*    rf   c                
   @   s
  e Zd Zdddg feje ejejeje	f  ejej
ej  ej
ejej  dddZejejejeejejej ejej ejej d d	ddZe	ejd dd	d
Zejej d dddZejed dddZeejej edddZeeedddZdS )OCSPResponseBuilderN)responseresponder_idcertsrG   c                 C   s   || _ || _|| _|| _d S rh   )	_response_responder_id_certsrj   )r3   rz   r{   r|   rG   r   r   r   r4     s    	zOCSPResponseBuilder.__init__)	r&   r'   r   r(   r)   r*   r+   r,   r   c	           
   	   C   s<   | j d k	rtdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)r}   r    r%   ry   r~   r   rj   )
r3   r&   r'   r   r(   r)   r*   r+   r,   Z
singlerespr   r   r   add_response  s$    

z OCSPResponseBuilder.add_response)rD   responder_certr   c                 C   sP   | j d k	rtdt|tjs&tdt|ts8tdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r~   r    r   r   r.   r/   r   ry   r}   r   rj   )r3   rD   r   r   r   r   r{     s    

z OCSPResponseBuilder.responder_id)r|   r   c                 C   s\   | j d k	rtdt|}t|dkr.tdtdd |D sHtdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s   s   | ]}t |tjV  qd S rh   )r   r   r.   ).0xr   r   r   	<genexpr>  s     z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r   r    listlenallr/   ry   r}   r~   rj   )r3   r|   r   r   r   r^     s    
z OCSPResponseBuilder.certificatesrl   c                 C   sL   t |tjstdt|j||}t|| j t| j	| j
| j| j|g S ro   )r   r   rp   r/   rq   rr   r
   rj   ry   r}   r~   r   rs   r   r   r   ru     s    
z!OCSPResponseBuilder.add_extension)private_keyr   r   c                 C   s6   | j d krtd| jd kr$tdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)r}   r    r~   r   create_ocsp_responser   r   )r3   r   r   r   r   r   sign  s    

   zOCSPResponseBuilder.sign)rY   r   c                 C   s4   t |tstd|tjkr$tdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r/   r   r    r   r   )clsrY   r   r   r   build_unsuccessful  s    

z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r6   r7   r%   rw   r   r.   r   rd   rq   rp   r4   r   r5   r"   r0   r2   r   r{   Iterabler^   rx   ru   r   rW   r   classmethodr   r   r   r   r   r   ry     sR   


  
 
ry   )datar   c                 C   s
   t | S rh   )r   load_der_ocsp_requestr   r   r   r   r   "  s    r   c                 C   s
   t | S rh   )r   load_der_ocsp_responser   r   r   r   r   &  s    r   )'rH   r0   r6   Zcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser   r	   r
   Enumr   r   SHA1SHA224SHA256SHA384SHA512r   r5   r!   r"   r%   ABCMetar8   rP   rW   rf   ry   rJ   r   r   r   r   r   r   <module>   s6   
	F&; 2~