U
    EZhQH                     @   sN  d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZmZmZ G dd dejZG d	d
 d
ejZe	je	je	je	je	jfZe	jddddZG dd dejZG dd dZG dd de jdZG dd de jdZ G dd de jdZ!G dd dZ"G dd dZ#e$edddZ%e$e!dd d!Z&dS )"    N)utilsx509)ocsp)hashesserialization) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @   s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   ]/home/aprabhat/apps/x.techxrdev.in/venv/lib/python3.8/site-packages/cryptography/x509/ocsp.pyr      s   r   c                   @   s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s   r   )	algorithmreturnc                 C   s   t | tstdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm.   s    
r!   c                   @   s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDUNKNOWNr   r   r   r   r"   5   s   r"   c                	   @   sH   e Zd Zejejejeeje	j
ej e	j
ej e	j
ej dddZdS )_SingleResponse)certissuerr   cert_statusthis_updatenext_updaterevocation_timerevocation_reasonc	           	      C   s  t |tjrt |tjs tdt| t |tjs<td|d k	rXt |tjsXtd|| _|| _|| _|| _	|| _
t |tstd|tjk	r|d k	rtd|d k	rtdnHt |tjstdt|}|tk rtd|d k	rt |tjstd	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r   r   Certificate	TypeErrorr!   datetimeZ_certZ_issuer
_algorithmZ_this_updateZ_next_updater"   r#   r    r	   r   ReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr&   r'   r   r(   r)   r*   r+   r,   r   r   r   __init__<   s`     
 


 z_SingleResponse.__init__N)r   r   r   r   r.   r   HashAlgorithmr"   r0   typingOptionalr2   r4   r   r   r   r   r%   ;   s   


r%   c                   @   s   e Zd ZeejedddZeejedddZeeje	j
dddZeejeddd	Zejejed
ddZeejejdddZdS )OCSPRequestr   c                 C   s   dS z3
        The hash of the issuer public key
        Nr   r3   r   r   r   issuer_key_hash   s    zOCSPRequest.issuer_key_hashc                 C   s   dS z-
        The hash of the issuer name
        Nr   r;   r   r   r   issuer_name_hash   s    zOCSPRequest.issuer_name_hashc                 C   s   dS zK
        The hash algorithm used in the issuer name and key hashes
        Nr   r;   r   r   r   hash_algorithm   s    zOCSPRequest.hash_algorithmc                 C   s   dS zM
        The serial number of the cert whose status is being checked
        Nr   r;   r   r   r   serial_number   s    zOCSPRequest.serial_numberencodingr   c                 C   s   dS )z/
        Serializes the request to DER
        Nr   r3   rD   r   r   r   public_bytes   s    zOCSPRequest.public_bytesc                 C   s   dS )zP
        The list of request extensions. Not single request extensions.
        Nr   r;   r   r   r   
extensions   s    zOCSPRequest.extensionsN)r   r   r   propertyabcabstractmethodbytesr<   r>   r   r5   r@   intrB   r   EncodingrF   r   
ExtensionsrG   r   r   r   r   r8      s"   r8   )	metaclassc                   @   s   e Zd ZeejedddZeejej	e
j
 dddZeejej	ej dddZeeje
j
ddd	Zeejej	e
j
 dd
dZeejedddZeejedddZeejejdddZeejedddZdS )OCSPSingleResponser9   c                 C   s   dS zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   r;   r   r   r   certificate_status   s    z%OCSPSingleResponse.certificate_statusc                 C   s   dS z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   r;   r   r   r   r+      s    z"OCSPSingleResponse.revocation_timec                 C   s   dS zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   r;   r   r   r   r,      s    z$OCSPSingleResponse.revocation_reasonc                 C   s   dS z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   r;   r   r   r   r)      s    zOCSPSingleResponse.this_updatec                 C   s   dS zC
        The time when newer information will be available
        Nr   r;   r   r   r   r*      s    zOCSPSingleResponse.next_updatec                 C   s   dS r:   r   r;   r   r   r   r<      s    z"OCSPSingleResponse.issuer_key_hashc                 C   s   dS r=   r   r;   r   r   r   r>      s    z#OCSPSingleResponse.issuer_name_hashc                 C   s   dS r?   r   r;   r   r   r   r@      s    z!OCSPSingleResponse.hash_algorithmc                 C   s   dS rA   r   r;   r   r   r   rB      s    z OCSPSingleResponse.serial_numberN)r   r   r   rH   rI   rJ   r"   rR   r6   r7   r0   r+   r   r2   r,   r)   r*   rK   r<   r>   r   r5   r@   rL   rB   r   r   r   r   rP      s6   rP   c                   @   sd  e Zd Zeejeje dddZ	eeje
dddZeejejdddZeejejej ddd	Zeejedd
dZeejedddZeejejej dddZeejeje dddZeejejej dddZeejejdddZeejedddZeejejej dddZ eejejej! dddZ"eejejdddZ#eejejej dddZ$eejedd d!Z%eejedd"d#Z&eejejdd$d%Z'eeje(dd&d'Z)eejej*dd(d)Z+eejej*dd*d+Z,eje-j.ed,d-d.Z/d/S )0OCSPResponser9   c                 C   s   dS )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   r;   r   r   r   	responses   s    zOCSPResponse.responsesc                 C   s   dS )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   r;   r   r   r   response_status   s    zOCSPResponse.response_statusc                 C   s   dS )zA
        The ObjectIdentifier of the signature algorithm
        Nr   r;   r   r   r   signature_algorithm_oid  s    z$OCSPResponse.signature_algorithm_oidc                 C   s   dS )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   r;   r   r   r   signature_hash_algorithm  s    z%OCSPResponse.signature_hash_algorithmc                 C   s   dS )z%
        The signature bytes
        Nr   r;   r   r   r   	signature  s    zOCSPResponse.signaturec                 C   s   dS )z+
        The tbsResponseData bytes
        Nr   r;   r   r   r   tbs_response_bytes  s    zOCSPResponse.tbs_response_bytesc                 C   s   dS )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   r;   r   r   r   certificates  s    zOCSPResponse.certificatesc                 C   s   dS )z2
        The responder's key hash or None
        Nr   r;   r   r   r   responder_key_hash(  s    zOCSPResponse.responder_key_hashc                 C   s   dS )z.
        The responder's Name or None
        Nr   r;   r   r   r   responder_name/  s    zOCSPResponse.responder_namec                 C   s   dS )z4
        The time the response was produced
        Nr   r;   r   r   r   produced_at6  s    zOCSPResponse.produced_atc                 C   s   dS rQ   r   r;   r   r   r   rR   =  s    zOCSPResponse.certificate_statusc                 C   s   dS rS   r   r;   r   r   r   r+   D  s    zOCSPResponse.revocation_timec                 C   s   dS rT   r   r;   r   r   r   r,   L  s    zOCSPResponse.revocation_reasonc                 C   s   dS rU   r   r;   r   r   r   r)   T  s    zOCSPResponse.this_updatec                 C   s   dS rV   r   r;   r   r   r   r*   \  s    zOCSPResponse.next_updatec                 C   s   dS r:   r   r;   r   r   r   r<   c  s    zOCSPResponse.issuer_key_hashc                 C   s   dS r=   r   r;   r   r   r   r>   j  s    zOCSPResponse.issuer_name_hashc                 C   s   dS r?   r   r;   r   r   r   r@   q  s    zOCSPResponse.hash_algorithmc                 C   s   dS rA   r   r;   r   r   r   rB   x  s    zOCSPResponse.serial_numberc                 C   s   dS )zR
        The list of response extensions. Not single response extensions.
        Nr   r;   r   r   r   rG     s    zOCSPResponse.extensionsc                 C   s   dS )zR
        The list of single response extensions. Not response extensions.
        Nr   r;   r   r   r   single_extensions  s    zOCSPResponse.single_extensionsrC   c                 C   s   dS )z0
        Serializes the response to DER
        Nr   rE   r   r   r   rF     s    zOCSPResponse.public_bytesN)0r   r   r   rH   rI   rJ   r6   IteratorrP   rX   r   rY   r   ZObjectIdentifierrZ   r7   r   r5   r[   rK   r\   r]   Listr.   r^   r_   Namer`   r0   ra   r"   rR   r+   r2   r,   r)   r*   r<   r>   r@   rL   rB   rN   rG   rb   r   rM   rF   r   r   r   r   rW      s   
rW   c                   @   s   e Zd Zddg fejejejejej	f  ejeje
e
eej	f  ejejej  ddddZejejej	d dddZe
e
eej	d dd	d
Zejed dddZedddZdS )OCSPRequestBuilderN)requestrequest_hashrG   r   c                 C   s   || _ || _|| _d S N)_request_request_hash_extensions)r3   rg   rh   rG   r   r   r   r4     s    zOCSPRequestBuilder.__init__)r&   r'   r   r   c                 C   sZ   | j d k	s| jd k	rtdt| t|tjr<t|tjsDtdt|||f| j| j	S )N.Only one certificate can be added to a requestr-   )
rj   rk   r    r!   r   r   r.   r/   rf   rl   )r3   r&   r'   r   r   r   r   add_certificate  s       z"OCSPRequestBuilder.add_certificate)r>   r<   rB   r   r   c                 C   s   | j d k	s| jd k	rtdt|ts.tdt| td| td| |j	t
|ksj|j	t
|krrtdt| j ||||f| jS )Nrm   z serial_number must be an integerr>   r<   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rj   rk   r    r   rL   r/   r!   r   _check_bytesdigest_sizelenrf   rl   )r3   r>   r<   rB   r   r   r   r   add_certificate_by_hash  s(    

z*OCSPRequestBuilder.add_certificate_by_hashextvalcriticalr   c                 C   sH   t |tjstdt|j||}t|| j t| j	| j
| j|g S Nz"extension must be an ExtensionType)r   r   ExtensionTyper/   	Extensionoidr
   rl   rf   rj   rk   r3   rt   ru   	extensionr   r   r   add_extension  s      
z OCSPRequestBuilder.add_extensionr9   c                 C   s&   | j d kr| jd krtdt| S )Nz*You must add a certificate before building)rj   rk   r    r   Zcreate_ocsp_requestr;   r   r   r   build  s    zOCSPRequestBuilder.build)r   r   r   r6   r7   Tupler   r.   r   r5   rK   rL   rd   rx   rw   r4   rn   rr   boolr|   r8   r}   r   r   r   r   rf     s>    rf   c                
   @   s
  e Zd Zdddg feje ejejeje	f  ejej
ej  ej
ejej  dddZejejejeejejej ejej ejej d d	ddZe	ejd dd	d
Zejej d dddZejed dddZeejej edddZeeedddZdS )OCSPResponseBuilderN)responseresponder_idcertsrG   c                 C   s   || _ || _|| _|| _d S ri   )	_response_responder_id_certsrl   )r3   r   r   r   rG   r   r   r   r4     s    	zOCSPResponseBuilder.__init__)	r&   r'   r   r(   r)   r*   r+   r,   r   c	           
   	   C   s<   | j d k	rtdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)r   r    r%   r   r   r   rl   )
r3   r&   r'   r   r(   r)   r*   r+   r,   Z
singlerespr   r   r   add_response  s$    

z OCSPResponseBuilder.add_response)rD   responder_certr   c                 C   sP   | j d k	rtdt|tjs&tdt|ts8tdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r   r    r   r   r.   r/   r   r   r   r   rl   )r3   rD   r   r   r   r   r     s    

z OCSPResponseBuilder.responder_id)r   r   c                 C   s\   | j d k	rtdt|}t|dkr.tdtdd |D sHtdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s   s   | ]}t |tjV  qd S ri   )r   r   r.   ).0xr   r   r   	<genexpr>3  s     z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r   r    listrq   allr/   r   r   r   rl   )r3   r   r   r   r   r^   +  s    
z OCSPResponseBuilder.certificatesrs   c                 C   sL   t |tjstdt|j||}t|| j t| j	| j
| j| j|g S rv   )r   r   rw   r/   rx   ry   r
   rl   r   r   r   r   rz   r   r   r   r|   <  s    
z!OCSPResponseBuilder.add_extension)private_keyr   r   c                 C   s6   | j d krtd| jd kr$tdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)r   r    r   r   create_ocsp_responser   r   )r3   r   r   r   r   r   signL  s    

   zOCSPResponseBuilder.sign)rY   r   c                 C   s4   t |tstd|tjkr$tdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r/   r   r    r   r   )clsrY   r   r   r   build_unsuccessfulZ  s    

z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r6   r7   r%   r~   r   r.   r   rd   rx   rw   r4   r   r5   r"   r0   r2   r   r   Iterabler^   r   r|   r   rW   r   classmethodr   r   r   r   r   r   r     sR   


  
 
r   )datar   c                 C   s
   t | S ri   )r   load_der_ocsp_requestr   r   r   r   r   h  s    r   c                 C   s
   t | S ri   )r   load_der_ocsp_responser   r   r   r   r   l  s    r   )'rI   r0   r6   Zcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser   r	   r
   Enumr   r   SHA1SHA224SHA256SHA384SHA512r   r5   r!   r"   r%   ABCMetar8   rP   rW   rf   r   rK   r   r   r   r   r   r   <module>   s4   
	F+D %V~