a
    còf#N  ã                   @  sh  d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZmZmZ G dd	„ d	ejƒZG d
d„ dejƒZejejejejejfZdddœdd„ZG dd„ dejƒZG dd„ dƒZG dd„ dejd�Z G dd„ dejd�Z!G dd„ dejd�Z"e  #e	j ¡ e" #e	j"¡ e! #e	j!¡ G dd„ dƒZ$G dd„ dƒZ%e	j&Z&e	j'Z'dS ) é    )ÚannotationsN)ÚutilsÚx509)Úocsp)ÚhashesÚserialization)Ú CertificateIssuerPrivateKeyTypes)Ú_EARLIEST_UTC_TIMEÚ_convert_to_naive_utc_timeÚ_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú
__module__Ú__qualname__ÚHASHÚNAME© r   r   úS/home/httpd/docs/test/DocsMgr/lib/python3.9/site-packages/cryptography/x509/ocsp.pyr      s   r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚOCSPResponseStatusr   é   é   é   é   é   N)	r   r   r   Ú
SUCCESSFULZMALFORMED_REQUESTÚINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDÚUNAUTHORIZEDr   r   r   r   r      s   r   úhashes.HashAlgorithmÚNone)Ú	algorithmÚreturnc                 C  s   t | tƒstdƒ‚d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú
isinstanceÚ_ALLOWED_HASHESÚ
ValueError)r   r   r   r   Ú_verify_algorithm/   s    
ÿr$   c                   @  s   e Zd ZdZdZdZdS )ÚOCSPCertStatusr   r   r   N)r   r   r   ZGOODÚREVOKEDÚUNKNOWNr   r   r   r   r%   6   s   r%   c                	   @  s(   e Zd Zdddddddddœdd	„Zd
S )Ú_SingleResponseúx509.Certificater   r%   údatetime.datetimeúdatetime.datetime | Noneúx509.ReasonFlags | None)ÚcertÚissuerr   Úcert_statusÚthis_updateÚnext_updateÚrevocation_timeÚrevocation_reasonc	           	      C  s  t |tjƒrt |tjƒs tdƒ‚t|ƒ t |tjƒs<tdƒ‚|d urXt |tjƒsXtdƒ‚|| _|| _|| _|| _	|| _
t |tƒsˆtdƒ‚|tjur´|d ur¢tdƒ‚|d urütdƒ‚nHt |tjƒsÈtdƒ‚t|ƒ}|tk ràtdƒ‚|d urüt |tjƒsütd	ƒ‚|| _|| _|| _d S )
Nú%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r!   r   ÚCertificateÚ	TypeErrorr$   ÚdatetimeZ_certZ_issuerÚ
_algorithmZ_this_updateZ_next_updater%   r&   r#   r
   r	   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	Úselfr-   r.   r   r/   r0   r1   r2   r3   r   r   r   Ú__init__=   sZ    ÿ
ÿ
ÿ
ÿÿÿ
ÿÿz_SingleResponse.__init__N)r   r   r   r:   r   r   r   r   r(   <   s   r(   c                   @  sš   e Zd Zeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd	„ƒƒZeejd
dœdd„ƒƒZ	ejdddœdd„ƒZ
eejddœdd„ƒƒZdS )ÚOCSPRequestÚbytes©r    c                 C  s   dS ©z3
        The hash of the issuer public key
        Nr   ©r9   r   r   r   Úissuer_key_hashƒ   s    zOCSPRequest.issuer_key_hashc                 C  s   dS ©z-
        The hash of the issuer name
        Nr   r?   r   r   r   Úissuer_name_hashŠ   s    zOCSPRequest.issuer_name_hashr   c                 C  s   dS ©zK
        The hash algorithm used in the issuer name and key hashes
        Nr   r?   r   r   r   Úhash_algorithm‘   s    zOCSPRequest.hash_algorithmÚintc                 C  s   dS ©zM
        The serial number of the cert whose status is being checked
        Nr   r?   r   r   r   Úserial_number˜   s    zOCSPRequest.serial_numberúserialization.Encoding©Úencodingr    c                 C  s   dS )z/
        Serializes the request to DER
        Nr   ©r9   rJ   r   r   r   Úpublic_bytesŸ   s    zOCSPRequest.public_bytesúx509.Extensionsc                 C  s   dS )zP
        The list of request extensions. Not single request extensions.
        Nr   r?   r   r   r   Ú
extensions¥   s    zOCSPRequest.extensionsN)r   r   r   ÚpropertyÚabcÚabstractmethodr@   rB   rD   rG   rL   rN   r   r   r   r   r;   ‚   s"   r;   )Ú	metaclassc                   @  s,  e Zd Zeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd	„ƒƒZeejd
dœdd„ƒƒZ	eejddœdd„ƒƒZ
eejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd „ƒƒZd!S )"ÚOCSPSingleResponser%   r=   c                 C  s   dS ©zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   r?   r   r   r   Úcertificate_status®   s    z%OCSPSingleResponse.certificate_statusr+   c                 C  s   dS ©z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   r?   r   r   r   r2   µ   s    z"OCSPSingleResponse.revocation_timec                 C  s   dS ©z‡
        The date of when the certificate was revoked or None if not
        revoked. Represented as a non-naive UTC datetime.
        Nr   r?   r   r   r   Úrevocation_time_utc½   s    z&OCSPSingleResponse.revocation_time_utcr,   c                 C  s   dS ©zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   r?   r   r   r   r3   Å   s    z$OCSPSingleResponse.revocation_reasonr*   c                 C  s   dS ©z�
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   r?   r   r   r   r0   Í   s    zOCSPSingleResponse.this_updatec                 C  s   dS ©z³
        The most recent time at which the status being indicated is known by
        the responder to have been correct. Represented as a non-naive UTC
        datetime.
        Nr   r?   r   r   r   Úthis_update_utcÕ   s    z"OCSPSingleResponse.this_update_utcc                 C  s   dS ©zC
        The time when newer information will be available
        Nr   r?   r   r   r   r1   Þ   s    zOCSPSingleResponse.next_updatec                 C  s   dS ©zu
        The time when newer information will be available. Represented as a
        non-naive UTC datetime.
        Nr   r?   r   r   r   Únext_update_utcå   s    z"OCSPSingleResponse.next_update_utcr<   c                 C  s   dS r>   r   r?   r   r   r   r@   í   s    z"OCSPSingleResponse.issuer_key_hashc                 C  s   dS rA   r   r?   r   r   r   rB   ô   s    z#OCSPSingleResponse.issuer_name_hashr   c                 C  s   dS rC   r   r?   r   r   r   rD   û   s    z!OCSPSingleResponse.hash_algorithmrE   c                 C  s   dS rF   r   r?   r   r   r   rG     s    z OCSPSingleResponse.serial_numberN)r   r   r   rO   rP   rQ   rU   r2   rX   r3   r0   r\   r1   r_   r@   rB   rD   rG   r   r   r   r   rS   ­   sH   rS   c                   @  sz  e Zd Zeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœd	d
„ƒƒZeejddœdd„ƒƒZ	eejddœdd„ƒƒZ
eejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd „ƒƒZeejd!dœd"d#„ƒƒZeejd$dœd%d&„ƒƒZeejd$dœd'd(„ƒƒZeejd)dœd*d+„ƒƒZeejddœd,d-„ƒƒZeejddœd.d/„ƒƒZeejd$dœd0d1„ƒƒZeejd$dœd2d3„ƒƒZeejddœd4d5„ƒƒZeejddœd6d7„ƒƒZeejd8dœd9d:„ƒƒZeejd;dœd<d=„ƒƒZeejd>dœd?d@„ƒƒZeejd>dœdAdB„ƒƒZejdCddDœdEdF„ƒZdGS )HÚOCSPResponsez#typing.Iterator[OCSPSingleResponse]r=   c                 C  s   dS )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   r?   r   r   r   Ú	responses  s    zOCSPResponse.responsesr   c                 C  s   dS )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   r?   r   r   r   Úresponse_status  s    zOCSPResponse.response_statuszx509.ObjectIdentifierc                 C  s   dS )zA
        The ObjectIdentifier of the signature algorithm
        Nr   r?   r   r   r   Úsignature_algorithm_oid  s    z$OCSPResponse.signature_algorithm_oidúhashes.HashAlgorithm | Nonec                 C  s   dS )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   r?   r   r   r   Úsignature_hash_algorithm"  s    z%OCSPResponse.signature_hash_algorithmr<   c                 C  s   dS )z%
        The signature bytes
        Nr   r?   r   r   r   Ú	signature+  s    zOCSPResponse.signaturec                 C  s   dS )z+
        The tbsResponseData bytes
        Nr   r?   r   r   r   Útbs_response_bytes2  s    zOCSPResponse.tbs_response_byteszlist[x509.Certificate]c                 C  s   dS )z»
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   r?   r   r   r   Úcertificates9  s    zOCSPResponse.certificateszbytes | Nonec                 C  s   dS )z2
        The responder's key hash or None
        Nr   r?   r   r   r   Úresponder_key_hashB  s    zOCSPResponse.responder_key_hashzx509.Name | Nonec                 C  s   dS )z.
        The responder's Name or None
        Nr   r?   r   r   r   Úresponder_nameI  s    zOCSPResponse.responder_namer*   c                 C  s   dS )z4
        The time the response was produced
        Nr   r?   r   r   r   Úproduced_atP  s    zOCSPResponse.produced_atc                 C  s   dS )zf
        The time the response was produced. Represented as a non-naive UTC
        datetime.
        Nr   r?   r   r   r   Úproduced_at_utcW  s    zOCSPResponse.produced_at_utcr%   c                 C  s   dS rT   r   r?   r   r   r   rU   _  s    zOCSPResponse.certificate_statusr+   c                 C  s   dS rV   r   r?   r   r   r   r2   f  s    zOCSPResponse.revocation_timec                 C  s   dS rW   r   r?   r   r   r   rX   n  s    z OCSPResponse.revocation_time_utcr,   c                 C  s   dS rY   r   r?   r   r   r   r3   v  s    zOCSPResponse.revocation_reasonc                 C  s   dS rZ   r   r?   r   r   r   r0   ~  s    zOCSPResponse.this_updatec                 C  s   dS r[   r   r?   r   r   r   r\   †  s    zOCSPResponse.this_update_utcc                 C  s   dS r]   r   r?   r   r   r   r1   �  s    zOCSPResponse.next_updatec                 C  s   dS r^   r   r?   r   r   r   r_   –  s    zOCSPResponse.next_update_utcc                 C  s   dS r>   r   r?   r   r   r   r@   ž  s    zOCSPResponse.issuer_key_hashc                 C  s   dS rA   r   r?   r   r   r   rB   ¥  s    zOCSPResponse.issuer_name_hashr   c                 C  s   dS rC   r   r?   r   r   r   rD   ¬  s    zOCSPResponse.hash_algorithmrE   c                 C  s   dS rF   r   r?   r   r   r   rG   ³  s    zOCSPResponse.serial_numberrM   c                 C  s   dS )zR
        The list of response extensions. Not single response extensions.
        Nr   r?   r   r   r   rN   º  s    zOCSPResponse.extensionsc                 C  s   dS )zR
        The list of single response extensions. Not response extensions.
        Nr   r?   r   r   r   Úsingle_extensionsÁ  s    zOCSPResponse.single_extensionsrH   rI   c                 C  s   dS )z0
        Serializes the response to DER
        Nr   rK   r   r   r   rL   È  s    zOCSPResponse.public_bytesN) r   r   r   rO   rP   rQ   ra   rb   rc   re   rf   rg   rh   ri   rj   rk   rl   rU   r2   rX   r3   r0   r\   r1   r_   r@   rB   rD   rG   rN   rm   rL   r   r   r   r   r`   
  sš   r`   c                   @  sr   e Zd Zddg fdddddœdd„Zd	d	d
d dœdd„Zdddd
d dœdd„Zddd dœdd„Zddœdd„ZdS )ÚOCSPRequestBuilderNzFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonez5tuple[bytes, bytes, int, hashes.HashAlgorithm] | Noneú(list[x509.Extension[x509.ExtensionType]]r   )ÚrequestÚrequest_hashrN   r    c                 C  s   || _ || _|| _d S ©N)Ú_requestÚ_request_hashÚ_extensions)r9   rp   rq   rN   r   r   r   r:   Õ  s    
zOCSPRequestBuilder.__init__r)   r   )r-   r.   r   r    c                 C  sZ   | j d us| jd urtdƒ‚t|ƒ t|tjƒr<t|tjƒsDtdƒ‚t|||f| j| j	ƒS )Nú.Only one certificate can be added to a requestr4   )
rs   rt   r#   r$   r!   r   r5   r6   rn   ru   )r9   r-   r.   r   r   r   r   Úadd_certificateã  s    ÿÿz"OCSPRequestBuilder.add_certificater<   rE   )rB   r@   rG   r   r    c                 C  sŠ   | j d us| jd urtdƒ‚t|tƒs.tdƒ‚t|ƒ t d|¡ t d|¡ |j	t
|ƒksj|j	t
|ƒkrrtdƒ‚t| j ||||f| jƒS )Nrv   z serial_number must be an integerrB   r@   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rs   rt   r#   r!   rE   r6   r$   r   Ú_check_bytesÚdigest_sizeÚlenrn   ru   )r9   rB   r@   rG   r   r   r   r   Úadd_certificate_by_hashö  s(    
ÿþÿ
ýz*OCSPRequestBuilder.add_certificate_by_hashúx509.ExtensionTypeÚbool©ÚextvalÚcriticalr    c                 C  sJ   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
g | j¢|‘ƒS ©Nz"extension must be an ExtensionType)r!   r   ÚExtensionTyper6   Ú	ExtensionÚoidr   ru   rn   rs   rt   ©r9   r   r€   Ú	extensionr   r   r   Úadd_extension  s    ÿz OCSPRequestBuilder.add_extensionr;   r=   c                 C  s&   | j d u r| jd u rtdƒ‚t | ¡S )Nz*You must add a certificate before building)rs   rt   r#   r   Zcreate_ocsp_requestr?   r   r   r   Úbuild!  s    zOCSPRequestBuilder.build)r   r   r   r:   rw   r{   r‡   rˆ   r   r   r   r   rn   Ô  s   ørn   c                
   @  s¢   e Zd Zdddg fdddddœdd„Zd	d	d
dddddd dœ	dd„Zdd	d dœdd„Zdd dœdd„Zddd dœdd„Zdd d!d"œd#d$„Ze	d%d!d&œd'd(„ƒZ
dS ))ÚOCSPResponseBuilderNz_SingleResponse | Nonez5tuple[x509.Certificate, OCSPResponderEncoding] | Nonezlist[x509.Certificate] | Nonero   )ÚresponseÚresponder_idÚcertsrN   c                 C  s   || _ || _|| _|| _d S rr   )Ú	_responseÚ_responder_idÚ_certsru   )r9   rŠ   r‹   rŒ   rN   r   r   r   r:   )  s    zOCSPResponseBuilder.__init__r)   r   r%   r*   r+   r,   )	r-   r.   r   r/   r0   r1   r2   r3   r    c	           
   	   C  s<   | j d urtdƒ‚t||||||||ƒ}	t|	| j| j| jƒS )Nz#Only one response per OCSPResponse.)r�   r#   r(   r‰   rŽ   r�   ru   )
r9   r-   r.   r   r/   r0   r1   r2   r3   Z
singlerespr   r   r   Úadd_response6  s$    
ø
üz OCSPResponseBuilder.add_responser   )rJ   Úresponder_certr    c                 C  sP   | j d urtdƒ‚t|tjƒs&tdƒ‚t|tƒs8tdƒ‚t| j||f| j	| j
ƒS )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)rŽ   r#   r!   r   r5   r6   r   r‰   r�   r�   ru   )r9   rJ   r‘   r   r   r   r‹   U  s    

ÿüz OCSPResponseBuilder.responder_idz!typing.Iterable[x509.Certificate])rŒ   r    c                 C  s\   | j d urtdƒ‚t|ƒ}t|ƒdkr.tdƒ‚tdd„ |D ƒƒsHtdƒ‚t| j| j|| j	ƒS )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   | ]}t |tjƒV  qd S rr   )r!   r   r5   )Ú.0Úxr   r   r   Ú	<genexpr>p  ó    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r�   r#   Úlistrz   Úallr6   r‰   r�   rŽ   ru   )r9   rŒ   r   r   r   rh   h  s    
üz OCSPResponseBuilder.certificatesr|   r}   r~   c                 C  sN   t |tjƒstdƒ‚t |j||¡}t|| jƒ t| j	| j
| jg | j¢|‘ƒS r�   )r!   r   r‚   r6   rƒ   r„   r   ru   r‰   r�   rŽ   r�   r…   r   r   r   r‡   y  s    üz!OCSPResponseBuilder.add_extensionr   rd   r`   )Úprivate_keyr   r    c                 C  s6   | j d u rtdƒ‚| jd u r$tdƒ‚t tj| ||¡S )Nz&You must add a response before signingz*You must add a responder_id before signing)r�   r#   rŽ   r   Úcreate_ocsp_responser   r   )r9   r˜   r   r   r   r   Úsign‰  s    


ÿzOCSPResponseBuilder.signr   )rb   r    c                 C  s4   t |tƒstdƒ‚|tju r$tdƒ‚t |d d d ¡S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r!   r   r6   r   r#   r   r™   )Úclsrb   r   r   r   Úbuild_unsuccessful—  s    
ÿ
z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r:   r�   r‹   rh   r‡   rš   Úclassmethodrœ   r   r   r   r   r‰   (  s   úr‰   )(Ú
__future__r   rP   r7   ÚtypingZcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser	   r
   r   ÚEnumr   r   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512r"   r$   r%   r(   ÚABCMetar;   rS   r`   Úregisterrn   r‰   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   Ú<module>   s<   
û	F+] FT}