o
    ÖèFhÎF  ã                   @  s>  d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZmZmZ G dd	„ d	ejƒZG d
d„ dejƒZejejejejejfZd!dd„ZG dd„ dejƒZG dd„ dƒZG dd„ dejd�Z G dd„ dejd�Z!G dd„ dejd�Z"G dd„ dƒZ#G dd „ d ƒZ$e	j%Z%e	j&Z&dS )"é    )ÚannotationsN)ÚutilsÚx509)Úocsp)ÚhashesÚserialization)Ú CertificateIssuerPrivateKeyTypes)Ú_EARLIEST_UTC_TIMEÚ_convert_to_naive_utc_timeÚ_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú
__module__Ú__qualname__ÚHASHÚNAME© r   r   úO/var/www/html/loop/nvenv/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr      s    r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚOCSPResponseStatusr   é   é   é   é   é   N)	r   r   r   Ú
SUCCESSFULÚMALFORMED_REQUESTÚINTERNAL_ERRORÚ	TRY_LATERÚSIG_REQUIREDÚUNAUTHORIZEDr   r   r   r   r      s    r   Ú	algorithmúhashes.HashAlgorithmÚreturnÚNonec                 C  s   t | tƒs	tdƒ‚d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú
isinstanceÚ_ALLOWED_HASHESÚ
ValueError)r    r   r   r   Ú_verify_algorithm/   s
   
ÿÿr'   c                   @  s   e Zd ZdZdZdZdS )ÚOCSPCertStatusr   r   r   N)r   r   r   ÚGOODÚREVOKEDÚUNKNOWNr   r   r   r   r(   6   s    r(   c                   @  s   e Zd Zddd„ZdS )Ú_SingleResponseÚcertúx509.CertificateÚissuerr    r!   Úcert_statusr(   Úthis_updateúdatetime.datetimeÚnext_updateúdatetime.datetime | NoneÚrevocation_timeÚrevocation_reasonúx509.ReasonFlags | Nonec	           	      C  s  t |tjƒrt |tjƒstdƒ‚t|ƒ t |tjƒstdƒ‚|d ur,t |tjƒs,tdƒ‚|| _|| _|| _|| _	|| _
t |tƒsDtdƒ‚|tjurZ|d urQtdƒ‚|d urYtdƒ‚n$t |tjƒsdtdƒ‚t|ƒ}|tk rptdƒ‚|d ur~t |tjƒs~td	ƒ‚|| _|| _|| _d S )
Nú%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r$   r   ÚCertificateÚ	TypeErrorr'   ÚdatetimeÚ_certÚ_issuerÚ
_algorithmÚ_this_updateÚ_next_updater(   r*   r&   r
   r	   ÚReasonFlagsÚ_cert_statusÚ_revocation_timeÚ_revocation_reason)	Úselfr-   r/   r    r0   r1   r3   r5   r6   r   r   r   Ú__init__=   s\   ÿ
ÿ
ÿ
ÿÿÿÿ
ÿÿ
z_SingleResponse.__init__N)r-   r.   r/   r.   r    r!   r0   r(   r1   r2   r3   r4   r5   r4   r6   r7   )r   r   r   rF   r   r   r   r   r,   <   s    r,   c                   @  s€   e Zd Zeejddd„ƒƒZeejddd„ƒƒZeejddd	„ƒƒZeejddd„ƒƒZ	ejddd„ƒZ
eejddd„ƒƒZdS )ÚOCSPRequestr"   Úbytesc                 C  ó   dS ©z3
        The hash of the issuer public key
        Nr   ©rE   r   r   r   Úissuer_key_hashƒ   ó    zOCSPRequest.issuer_key_hashc                 C  rI   ©z-
        The hash of the issuer name
        Nr   rK   r   r   r   Úissuer_name_hashŠ   rM   zOCSPRequest.issuer_name_hashr!   c                 C  rI   ©zK
        The hash algorithm used in the issuer name and key hashes
        Nr   rK   r   r   r   Úhash_algorithm‘   rM   zOCSPRequest.hash_algorithmÚintc                 C  rI   ©zM
        The serial number of the cert whose status is being checked
        Nr   rK   r   r   r   Úserial_number˜   rM   zOCSPRequest.serial_numberÚencodingúserialization.Encodingc                 C  rI   )z/
        Serializes the request to DER
        Nr   ©rE   rU   r   r   r   Úpublic_bytesŸ   rM   zOCSPRequest.public_bytesúx509.Extensionsc                 C  rI   )zP
        The list of request extensions. Not single request extensions.
        Nr   rK   r   r   r   Ú
extensions¥   rM   zOCSPRequest.extensionsN©r"   rH   ©r"   r!   ©r"   rR   ©rU   rV   r"   rH   ©r"   rY   )r   r   r   ÚpropertyÚabcÚabstractmethodrL   rO   rQ   rT   rX   rZ   r   r   r   r   rG   ‚   s$    rG   )Ú	metaclassc                   @  sÀ   e Zd Zeejddd„ƒƒZeejddd„ƒƒZeejdd	d
„ƒƒZeejddd„ƒƒZ	eejddd„ƒƒZ
eejd dd„ƒƒZeejd dd„ƒƒZeejd!dd„ƒƒZeejd"dd„ƒƒZdS )#ÚOCSPSingleResponser"   r(   c                 C  rI   ©zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   rK   r   r   r   Úcertificate_status®   rM   z%OCSPSingleResponse.certificate_statusr4   c                 C  rI   ©z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   rK   r   r   r   r5   µ   rM   z"OCSPSingleResponse.revocation_timer7   c                 C  rI   ©zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   rK   r   r   r   r6   ½   rM   z$OCSPSingleResponse.revocation_reasonr2   c                 C  rI   ©z�
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   rK   r   r   r   r1   Å   rM   zOCSPSingleResponse.this_updatec                 C  rI   ©zC
        The time when newer information will be available
        Nr   rK   r   r   r   r3   Í   rM   zOCSPSingleResponse.next_updaterH   c                 C  rI   rJ   r   rK   r   r   r   rL   Ô   rM   z"OCSPSingleResponse.issuer_key_hashc                 C  rI   rN   r   rK   r   r   r   rO   Û   rM   z#OCSPSingleResponse.issuer_name_hashr!   c                 C  rI   rP   r   rK   r   r   r   rQ   â   rM   z!OCSPSingleResponse.hash_algorithmrR   c                 C  rI   rS   r   rK   r   r   r   rT   é   rM   z OCSPSingleResponse.serial_numberN©r"   r(   ©r"   r4   ©r"   r7   ©r"   r2   r[   r\   r]   )r   r   r   r`   ra   rb   rf   r5   r6   r1   r3   rL   rO   rQ   rT   r   r   r   r   rd   ­   s8    rd   c                   @  sÀ  e Zd Zeejd@dd„ƒƒZeejdAdd„ƒƒZeejdBd	d
„ƒƒZeejdCdd„ƒƒZ	eejdDdd„ƒƒZ
eejdDdd„ƒƒZeejdEdd„ƒƒZeejdFdd„ƒƒZeejdGdd„ƒƒZeejdHdd„ƒƒZeejdId d!„ƒƒZeejdJd#d$„ƒƒZeejdKd&d'„ƒƒZeejdHd(d)„ƒƒZeejdJd*d+„ƒƒZeejdDd,d-„ƒƒZeejdDd.d/„ƒƒZeejdLd1d2„ƒƒZeejdMd4d5„ƒƒZeejdNd7d8„ƒƒZeejdNd9d:„ƒƒZejdOd=d>„ƒZd?S )PÚOCSPResponser"   ú#typing.Iterator[OCSPSingleResponse]c                 C  rI   )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   rK   r   r   r   Ú	responsesò   rM   zOCSPResponse.responsesr   c                 C  rI   )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   rK   r   r   r   Úresponse_statusú   rM   zOCSPResponse.response_statusúx509.ObjectIdentifierc                 C  rI   )zA
        The ObjectIdentifier of the signature algorithm
        Nr   rK   r   r   r   Úsignature_algorithm_oid  rM   z$OCSPResponse.signature_algorithm_oidúhashes.HashAlgorithm | Nonec                 C  rI   )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   rK   r   r   r   Úsignature_hash_algorithm	  rM   z%OCSPResponse.signature_hash_algorithmrH   c                 C  rI   )z%
        The signature bytes
        Nr   rK   r   r   r   Ú	signature  rM   zOCSPResponse.signaturec                 C  rI   )z+
        The tbsResponseData bytes
        Nr   rK   r   r   r   Útbs_response_bytes  rM   zOCSPResponse.tbs_response_bytesúlist[x509.Certificate]c                 C  rI   )z»
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   rK   r   r   r   Úcertificates   rM   zOCSPResponse.certificatesúbytes | Nonec                 C  rI   )z2
        The responder's key hash or None
        Nr   rK   r   r   r   Úresponder_key_hash)  rM   zOCSPResponse.responder_key_hashúx509.Name | Nonec                 C  rI   )z.
        The responder's Name or None
        Nr   rK   r   r   r   Úresponder_name0  rM   zOCSPResponse.responder_namer2   c                 C  rI   )z4
        The time the response was produced
        Nr   rK   r   r   r   Úproduced_at7  rM   zOCSPResponse.produced_atr(   c                 C  rI   re   r   rK   r   r   r   rf   >  rM   zOCSPResponse.certificate_statusr4   c                 C  rI   rg   r   rK   r   r   r   r5   E  rM   zOCSPResponse.revocation_timer7   c                 C  rI   rh   r   rK   r   r   r   r6   M  rM   zOCSPResponse.revocation_reasonc                 C  rI   ri   r   rK   r   r   r   r1   U  rM   zOCSPResponse.this_updatec                 C  rI   rj   r   rK   r   r   r   r3   ]  rM   zOCSPResponse.next_updatec                 C  rI   rJ   r   rK   r   r   r   rL   d  rM   zOCSPResponse.issuer_key_hashc                 C  rI   rN   r   rK   r   r   r   rO   k  rM   zOCSPResponse.issuer_name_hashr!   c                 C  rI   rP   r   rK   r   r   r   rQ   r  rM   zOCSPResponse.hash_algorithmrR   c                 C  rI   rS   r   rK   r   r   r   rT   y  rM   zOCSPResponse.serial_numberrY   c                 C  rI   )zR
        The list of response extensions. Not single response extensions.
        Nr   rK   r   r   r   rZ   €  rM   zOCSPResponse.extensionsc                 C  rI   )zR
        The list of single response extensions. Not response extensions.
        Nr   rK   r   r   r   Úsingle_extensions‡  rM   zOCSPResponse.single_extensionsrU   rV   c                 C  rI   )z0
        Serializes the response to DER
        Nr   rW   r   r   r   rX   Ž  rM   zOCSPResponse.public_bytesN)r"   rp   )r"   r   )r"   rs   )r"   ru   r[   )r"   ry   )r"   r{   )r"   r}   rn   rk   rl   rm   r\   r]   r_   r^   )r   r   r   r`   ra   rb   rq   rr   rt   rv   rw   rx   rz   r|   r~   r   rf   r5   r6   r1   r3   rL   rO   rQ   rT   rZ   r€   rX   r   r   r   r   ro   ñ   s„    ro   c                   @  sF   e Zd Zddg fd#d
d„Zd$dd„Zd%dd„Zd&dd„Zd'd!d"„ZdS )(ÚOCSPRequestBuilderNÚrequestúFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | NoneÚrequest_hashú5tuple[bytes, bytes, int, hashes.HashAlgorithm] | NonerZ   ú(list[x509.Extension[x509.ExtensionType]]r"   r#   c                 C  s   || _ || _|| _d S ©N)Ú_requestÚ_request_hashÚ_extensions)rE   r‚   r„   rZ   r   r   r   rF   –  s   

zOCSPRequestBuilder.__init__r-   r.   r/   r    r!   c                 C  sZ   | j d us
| jd urtdƒ‚t|ƒ t|tjƒrt|tjƒs"tdƒ‚t|||f| j| j	ƒS )Nú.Only one certificate can be added to a requestr8   )
rˆ   r‰   r&   r'   r$   r   r9   r:   r�   rŠ   )rE   r-   r/   r    r   r   r   Úadd_certificate¤  s   ÿÿz"OCSPRequestBuilder.add_certificaterO   rH   rL   rT   rR   c                 C  sŠ   | j d us
| jd urtdƒ‚t|tƒstdƒ‚t|ƒ t d|¡ t d|¡ |j	t
|ƒks5|j	t
|ƒkr9tdƒ‚t| j ||||f| jƒS )Nr‹   z serial_number must be an integerrO   rL   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rˆ   r‰   r&   r$   rR   r:   r'   r   Ú_check_bytesÚdigest_sizeÚlenr�   rŠ   )rE   rO   rL   rT   r    r   r   r   Úadd_certificate_by_hash·  s&   
ÿÿ
ýz*OCSPRequestBuilder.add_certificate_by_hashÚextvalúx509.ExtensionTypeÚcriticalÚboolc                 C  sJ   t |tjƒs
tdƒ‚t |j||¡}t|| jƒ t| j	| j
g | j¢|‘ƒS ©Nz"extension must be an ExtensionType)r$   r   ÚExtensionTyper:   Ú	ExtensionÚoidr   rŠ   r�   rˆ   r‰   ©rE   r‘   r“   Ú	extensionr   r   r   Úadd_extensionÕ  s   ÿz OCSPRequestBuilder.add_extensionrG   c                 C  s&   | j d u r| jd u rtdƒ‚t | ¡S )Nz*You must add a certificate before building)rˆ   r‰   r&   r   Úcreate_ocsp_requestrK   r   r   r   Úbuildâ  s   
zOCSPRequestBuilder.build)r‚   rƒ   r„   r…   rZ   r†   r"   r#   )r-   r.   r/   r.   r    r!   r"   r�   )
rO   rH   rL   rH   rT   rR   r    r!   r"   r�   )r‘   r’   r“   r”   r"   r�   )r"   rG   )r   r   r   rF   rŒ   r�   r›   r�   r   r   r   r   r�   •  s    ø


r�   c                   @  s`   e Zd Zdddg fd5d
d„Zd6dd„Zd7d d!„Zd8d#d$„Zd9d)d*„Zd:d/d0„Ze	d;d3d4„ƒZ
dS )<ÚOCSPResponseBuilderNÚresponseú_SingleResponse | NoneÚresponder_idú5tuple[x509.Certificate, OCSPResponderEncoding] | NoneÚcertsúlist[x509.Certificate] | NonerZ   r†   c                 C  s   || _ || _|| _|| _d S r‡   )Ú	_responseÚ_responder_idÚ_certsrŠ   )rE   rŸ   r¡   r£   rZ   r   r   r   rF   ê  s   
zOCSPResponseBuilder.__init__r-   r.   r/   r    r!   r0   r(   r1   r2   r3   r4   r5   r6   r7   r"   c	           
   	   C  s<   | j d ur	tdƒ‚t||||||||ƒ}	t|	| j| j| jƒS )Nz#Only one response per OCSPResponse.)r¥   r&   r,   rž   r¦   r§   rŠ   )
rE   r-   r/   r    r0   r1   r3   r5   r6   Ú
singlerespr   r   r   Úadd_response÷  s$   
ø
üz OCSPResponseBuilder.add_responserU   r   Úresponder_certc                 C  sP   | j d ur	tdƒ‚t|tjƒstdƒ‚t|tƒstdƒ‚t| j||f| j	| j
ƒS )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r¦   r&   r$   r   r9   r:   r   rž   r¥   r§   rŠ   )rE   rU   rª   r   r   r   r¡     s   

ÿüz OCSPResponseBuilder.responder_idú!typing.Iterable[x509.Certificate]c                 C  s\   | j d ur	tdƒ‚t|ƒ}t|ƒdkrtdƒ‚tdd„ |D ƒƒs$tdƒ‚t| j| j|| j	ƒS )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   � | ]	}t |tjƒV  qd S r‡   )r$   r   r9   )Ú.0Úxr   r   r   Ú	<genexpr>1  s   € z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
r§   r&   Úlistr�   Úallr:   rž   r¥   r¦   rŠ   )rE   r£   r   r   r   rz   )  s   
üz OCSPResponseBuilder.certificatesr‘   r’   r“   r”   c                 C  sN   t |tjƒs
tdƒ‚t |j||¡}t|| jƒ t| j	| j
| jg | j¢|‘ƒS r•   )r$   r   r–   r:   r—   r˜   r   rŠ   rž   r¥   r¦   r§   r™   r   r   r   r›   :  s   üz!OCSPResponseBuilder.add_extensionÚprivate_keyr   ru   ro   c                 C  s6   | j d u r	tdƒ‚| jd u rtdƒ‚t tj| ||¡S )Nz&You must add a response before signingz*You must add a responder_id before signing)r¥   r&   r¦   r   Úcreate_ocsp_responser   r   )rE   r±   r    r   r   r   ÚsignJ  s   


ÿzOCSPResponseBuilder.signrr   r   c                 C  s4   t |tƒs	tdƒ‚|tju rtdƒ‚t |d d d ¡S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r$   r   r:   r   r&   r   r²   )Úclsrr   r   r   r   Úbuild_unsuccessfulX  s   
ÿ
z&OCSPResponseBuilder.build_unsuccessful)rŸ   r    r¡   r¢   r£   r¤   rZ   r†   )r-   r.   r/   r.   r    r!   r0   r(   r1   r2   r3   r4   r5   r4   r6   r7   r"   rž   )rU   r   rª   r.   r"   rž   )r£   r«   r"   rž   )r‘   r’   r“   r”   r"   rž   )r±   r   r    ru   r"   ro   )rr   r   r"   ro   )r   r   r   rF   r©   r¡   rz   r›   r³   Úclassmethodrµ   r   r   r   r   rž   é  s    ú




rž   )r    r!   r"   r#   )'Ú
__future__r   ra   r;   ÚtypingÚcryptographyr   r   Ú"cryptography.hazmat.bindings._rustr   Úcryptography.hazmat.primitivesr   r   Ú/cryptography.hazmat.primitives.asymmetric.typesr   Úcryptography.x509.baser	   r
   r   ÚEnumr   r   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512r%   r'   r(   r,   ÚABCMetarG   rd   ro   r�   rž   Úload_der_ocsp_requestÚload_der_ocsp_responser   r   r   r   Ú<module>   s8   
û
	F+D %T}
