
    .Ph1                       d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ  G d	 d
ej                  Z G d dej                  Zej        ej        ej        ej        ej        fZddZ G d dej                  Z G d d          Ze	j        Ze	j        Ze	j        Z G d d          Z G d d          Z e	j!        Z!e	j"        Z"dS )    )annotationsN)Iterable)utilsx509)ocsp)hashes) CertificateIssuerPrivateKeyTypes)_reject_duplicate_extensionc                      e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME     V/var/www/html/test/jupyter/venv/lib/python3.11/site-packages/cryptography/x509/ocsp.pyr   r      s        DDDDr   r   c                  &    e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULMALFORMED_REQUESTINTERNAL_ERROR	TRY_LATERSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s-        JNILLLLr   r   	algorithmhashes.HashAlgorithmreturnNonec                N    t          | t                    st          d          d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r"   s    r   _verify_algorithmr*   *   s3    i11 
G
 
 	

 
r   c                      e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   GOODREVOKEDUNKNOWNr   r   r   r,   r,   1   s        DGGGGr   r,   c                      e Zd ZddZdS )_SingleResponseresp0tuple[x509.Certificate, x509.Certificate] | None	resp_hashtuple[bytes, bytes, int] | Noner"   r#   cert_statusr,   this_updatedatetime.datetimenext_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec	                   t          |           t          |t          j                  st          d          |)t          |t          j                  st          d          || _        || _        || _        || _        || _        t          |t                    st          d          |t          j
        ur#|t          d          |t          d          nTt          |t          j                  st          d          |)t          |t          j                  st          d          || _        || _        || _        d S )Nz%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectzCrevocation_reason must be an item from the ReasonFlags enum or None)r*   r'   datetime	TypeError_resp
_resp_hash
_algorithm_this_update_next_updater,   r.   r)   r   ReasonFlags_cert_status_revocation_time_revocation_reason)	selfr2   r4   r"   r6   r7   r9   r;   r<   s	            r   __init__z_SingleResponse.__init__8   s    	)$$$+x'899 	ECDDD":*,
 ,
" KLLL
##''+~66 	J   n444* !   !, "   - ox/@AA M KLLL ,Z!4#36 6,  #  
 ( /"3r   N)r2   r3   r4   r5   r"   r#   r6   r,   r7   r8   r9   r:   r;   r:   r<   r=   )r   r   r   rK   r   r   r   r1   r1   7   s(        64 64 64 64 64 64r   r1   c                  >    e Zd Zddg fdd
ZddZd dZd!dZd"dZdS )#OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonerequest_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | None
extensions(list[x509.Extension[x509.ExtensionType]]r$   r%   c                0    || _         || _        || _        d S N)_request_request_hash_extensions)rJ   rN   rP   rR   s       r   rK   zOCSPRequestBuilder.__init__w   s!      )%r   certx509.Certificateissuerr"   r#   c                   | j         | j        t          d          t          |           t	          |t
          j                  rt	          |t
          j                  st          d          t          |||f| j        | j	                  S )N.Only one certificate can be added to a request%cert and issuer must be a Certificate)
rV   rW   r)   r*   r'   r   Certificater@   rM   rX   )rJ   rY   r[   r"   s       r   add_certificatez"OCSPRequestBuilder.add_certificate   s     =$(:(FMNNN)$$$$ 011 	ED$:
 :
 	E CDDD!69%t'94;K
 
 	
r   issuer_name_hashbytesissuer_key_hashserial_numberintc                   | j         | j        t          d          t          |t                    st          d          t          |           t          j        d|           t          j        d|           |j	        t          |          k    s|j	        t          |          k    rt          d          t          | j         ||||f| j                  S )Nr]    serial_number must be an integerra   rc   `issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rV   rW   r)   r'   re   r@   r*   r   _check_bytesdigest_sizelenrM   rX   )rJ   ra   rc   rd   r"   s        r   add_certificate_by_hashz*OCSPRequestBuilder.add_certificate_by_hash   s     =$(:(FMNNN--- 	@>???)$$$-/?@@@,o>>> C%
 %
 
 
"c/&:&:::6  
 "MyI
 
 	
r   extvalx509.ExtensionTypecriticalboolc                    t          |t          j                  st          d          t          j        |j        ||          }t          || j                   t          | j	        | j
        g | j        |          S Nz"extension must be an ExtensionType)r'   r   ExtensionTyper@   	Extensionoidr
   rX   rM   rV   rW   rJ   rm   ro   	extensions       r   add_extensionz OCSPRequestBuilder.add_extension   s}     &$"455 	B@AAAN6:x@@	#It/?@@@!M4-/M1A/M9/M
 
 	
r   OCSPRequestc                d    | j         | j        t          d          t          j        |           S )Nz*You must add a certificate before building)rV   rW   r)   r   create_ocsp_request)rJ   s    r   buildzOCSPRequestBuilder.build   s2    = T%7%?IJJJ'---r   )rN   rO   rP   rQ   rR   rS   r$   r%   )rY   rZ   r[   rZ   r"   r#   r$   rM   )
ra   rb   rc   rb   rd   re   r"   r#   r$   rM   )rm   rn   ro   rp   r$   rM   )r$   ry   )r   r   r   rK   r`   rl   rx   r|   r   r   r   rM   rM   v   s         ?A& & & & &
 
 
 
&
 
 
 
<
 
 
 
. . . . . .r   rM   c                  h    e Zd Zdddg fd4d
Zd5dZd6d Zd7d$Zd8d&Zd9d+Zd:d0Z	e
d;d3            ZdS )<OCSPResponseBuilderNresponse_SingleResponse | Noneresponder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecertslist[x509.Certificate] | NonerR   rS   c                >    || _         || _        || _        || _        d S rU   )	_response_responder_id_certsrX   )rJ   r   r   r   rR   s        r   rK   zOCSPResponseBuilder.__init__   s(     ")%r   rY   rZ   r[   r"   r#   r6   r,   r7   r8   r9   r:   r;   r<   r=   r$   c	           
     &   | j         t          d          t          |t          j                  rt          |t          j                  st          d          t          ||fd ||||||          }	t          |	| j        | j	        | j
                  S )N#Only one response per OCSPResponse.r^   )r   r)   r'   r   r_   r@   r1   r~   r   r   rX   )
rJ   rY   r[   r"   r6   r7   r9   r;   r<   
singleresps
             r   add_responsez OCSPResponseBuilder.add_response   s     >%BCCC$ 011 	ED$:
 :
 	E CDDD$6N	
 	

 #K	
 
 	
r   ra   rb   rc   rd   re   c
           
        | j         t          d          t          |t                    st	          d          t          j        d|           t          j        d|           t          |           |j        t          |          k    s|j        t          |          k    rt          d          t          d |||f||||||	          }
t          |
| j        | j        | j                  S )Nr   rg   ra   rc   rh   )r   r)   r'   re   r@   r   ri   r*   rj   rk   r1   r~   r   r   rX   )rJ   ra   rc   rd   r"   r6   r7   r9   r;   r<   r   s              r   add_response_by_hashz(OCSPResponseBuilder.add_response_by_hash   s    >%BCCC--- 	@>???-/?@@@,o>>>)$$$ C%
 %
 
 
"c/&:&:::6  
 %>	
 	

 #K	
 
 	
r   encodingr   responder_certc                   | j         t          d          t          |t          j                  st          d          t          |t                    st          d          t          | j        ||f| j	        | j
                  S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)r   r)   r'   r   r_   r@   r   r~   r   r   rX   )rJ   r   r   s      r   r   z OCSPResponseBuilder.responder_id*  s     )@AAA.$*:;; 	DBCCC($9:: 	H   #NX&K	
 
 	
r   Iterable[x509.Certificate]c                "   | j         t          d          t          |          }t          |          dk    rt          d          t	          d |D                       st          d          t          | j        | j        || j	                  S )Nz!certificates may only be set oncer   zcerts must not be an empty listc              3  J   K   | ]}t          |t          j                  V  d S rU   )r'   r   r_   ).0xs     r   	<genexpr>z3OCSPResponseBuilder.certificates.<locals>.<genexpr>E  s/      BBq:a!122BBBBBBr   z$certs must be a list of Certificates)
r   r)   listrk   allr@   r~   r   r   rX   )rJ   r   s     r   certificatesz OCSPResponseBuilder.certificates=  s     ;"@AAAUu::??>???BBEBBBBB 	DBCCC"N	
 
 	
r   rm   rn   ro   rp   c                   t          |t          j                  st          d          t          j        |j        ||          }t          || j                   t          | j	        | j
        | j        g | j        |          S rr   )r'   r   rs   r@   rt   ru   r
   rX   r~   r   r   r   rv   s       r   rx   z!OCSPResponseBuilder.add_extensionN  s     &$"455 	B@AAAN6:x@@	#It/?@@@"NK*d*	*	
 
 	
r   private_keyr	   hashes.HashAlgorithm | NoneOCSPResponsec                    | j         t          d          | j        t          d          t          j        t
          j        | ||          S )Nz&You must add a response before signingz*You must add a responder_id before signing)r   r)   r   r   create_ocsp_responser   r   )rJ   r   r"   s      r   signzOCSPResponseBuilder.sign^  sT    
 >!EFFF%IJJJ()4i
 
 	
r   response_statusr   c                    t          |t                    st          d          |t          j        u rt	          d          t          j        |d d d           S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r'   r   r@   r   r)   r   r   )clsr   s     r   build_unsuccessfulz&OCSPResponseBuilder.build_unsuccessfull  sc     /+=>> 	I   0;;;CDDD($dKKKr   )r   r   r   r   r   r   rR   rS   )rY   rZ   r[   rZ   r"   r#   r6   r,   r7   r8   r9   r:   r;   r:   r<   r=   r$   r~   )ra   rb   rc   rb   rd   re   r"   r#   r6   r,   r7   r8   r9   r:   r;   r:   r<   r=   r$   r~   )r   r   r   rZ   r$   r~   )r   r   r$   r~   )rm   rn   ro   rp   r$   r~   )r   r	   r"   r   r$   r   )r   r   r$   r   )r   r   r   rK   r   r   r   r   rx   r   classmethodr   r   r   r   r~   r~      s         ,0/3?A& & & & &"
 "
 "
 "
H,
 ,
 ,
 ,
\
 
 
 
&
 
 
 
"
 
 
 
 
 
 
 
 
L 
L 
L [
L 
L 
Lr   r~   )r"   r#   r$   r%   )#
__future__r   r?   collections.abcr   cryptographyr   r   "cryptography.hazmat.bindings._rustr   cryptography.hazmat.primitivesr   /cryptography.hazmat.primitives.asymmetric.typesr	   cryptography.x509.baser
   Enumr   r   SHA1SHA224SHA256SHA384SHA512r(   r*   r,   r1   ry   r   OCSPSingleResponserM   r~   load_der_ocsp_requestload_der_ocsp_responser   r   r   <module>r      s$  
 # " " " " "  $ $ $ $ $ $ $ $ $ $ $ $ $ $ 3 3 3 3 3 3 1 1 1 1 1 1      ? > > > > >    EJ   
        K
M
M
M
M
 
 
 
    UZ   74 74 74 74 74 74 74 74t  , Q. Q. Q. Q. Q. Q. Q. Q.hmL mL mL mL mL mL mL mL` 2 4   r   