o
    àý°j›1  ã                   @  s  d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ G d	d
„ d
ejƒZG dd„ dejƒZejejejejejfZddd„ZG dd„ dejƒZG dd„ dƒZe	jZe	jZe	jZG dd„ dƒZG dd„ dƒZ e	j!Z!e	j"Z"dS )é    )ÚannotationsN)ÚIterable)ÚutilsÚx509)Úocsp)Úhashes)Ú CertificateIssuerPrivateKeyTypes)Ú_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )ÚOCSPResponderEncodingzBy HashzBy NameN)Ú__name__Ú
__module__Ú__qualname__ÚHASHÚNAME© r   r   ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr
      s    r
   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚOCSPResponseStatusr   é   é   é   é   é   N)	r   r   r   Ú
SUCCESSFULÚMALFORMED_REQUESTÚINTERNAL_ERRORÚ	TRY_LATERÚSIG_REQUIREDÚUNAUTHORIZEDr   r   r   r   r      s    r   Ú	algorithmúhashes.HashAlgorithmÚreturnÚNonec                 C  s   t | tƒs	tdƒ‚d S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)Ú
isinstanceÚ_ALLOWED_HASHESÚ
ValueError)r   r   r   r   Ú_verify_algorithm*   s
   
ÿÿr%   c                   @  s   e Zd ZdZdZdZdS )ÚOCSPCertStatusr   r   r   N)r   r   r   ÚGOODÚREVOKEDÚUNKNOWNr   r   r   r   r&   1   s    r&   c                   @  s   e Zd Zddd„ZdS )Ú_SingleResponseÚrespú0tuple[x509.Certificate, x509.Certificate] | NoneÚ	resp_hashútuple[bytes, bytes, int] | Noner   r   Úcert_statusr&   Úthis_updateúdatetime.datetimeÚnext_updateúdatetime.datetime | NoneÚrevocation_timeÚrevocation_reasonúx509.ReasonFlags | Nonec	           	      C  sÚ   t |ƒ t|tjƒstdƒ‚|d urt|tjƒstdƒ‚|| _|| _|| _|| _|| _t|t	ƒs4tdƒ‚|t	j
urJ|d urAtdƒ‚|d urItdƒ‚nt|tjƒsTtdƒ‚|d urbt|tjƒsbtdƒ‚|| _|| _|| _d S )Nz%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectzCrevocation_reason must be an item from the ReasonFlags enum or None)r%   r"   ÚdatetimeÚ	TypeErrorÚ_respÚ
_resp_hashÚ
_algorithmÚ_this_updateÚ_next_updater&   r(   r$   r   ÚReasonFlagsÚ_cert_statusÚ_revocation_timeÚ_revocation_reason)	Úselfr+   r-   r   r/   r0   r2   r4   r5   r   r   r   Ú__init__8   sJ   
ÿ
ÿ
ÿÿÿ
ÿÿ
z_SingleResponse.__init__N)r+   r,   r-   r.   r   r   r/   r&   r0   r1   r2   r3   r4   r3   r5   r6   )r   r   r   rC   r   r   r   r   r*   7   s    r*   c                   @  sF   e Zd Zddg fd#d
d„Zd$dd„Zd%dd„Zd&dd„Zd'd!d"„ZdS )(ÚOCSPRequestBuilderNÚrequestúFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | NoneÚrequest_hashú5tuple[bytes, bytes, int, hashes.HashAlgorithm] | NoneÚ
extensionsú(list[x509.Extension[x509.ExtensionType]]r    r!   c                 C  s   || _ || _|| _d S ©N)Ú_requestÚ_request_hashÚ_extensions)rB   rE   rG   rI   r   r   r   rC   w   s   

zOCSPRequestBuilder.__init__Úcertúx509.CertificateÚissuerr   r   c                 C  sZ   | j d us
| jd urtdƒ‚t|ƒ t|tjƒrt|tjƒs"tdƒ‚t|||f| j| j	ƒS )Nú.Only one certificate can be added to a requestú%cert and issuer must be a Certificate)
rL   rM   r$   r%   r"   r   ÚCertificater8   rD   rN   )rB   rO   rQ   r   r   r   r   Úadd_certificate…   s   ÿÿz"OCSPRequestBuilder.add_certificateÚissuer_name_hashÚbytesÚissuer_key_hashÚserial_numberÚintc                 C  sŠ   | j d us
| jd urtdƒ‚t|tƒstdƒ‚t|ƒ t d|¡ t d|¡ |j	t
|ƒks5|j	t
|ƒkr9tdƒ‚t| j ||||f| jƒS )NrR   ú serial_number must be an integerrV   rX   ú`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rL   rM   r$   r"   rZ   r8   r%   r   Ú_check_bytesÚdigest_sizeÚlenrD   rN   )rB   rV   rX   rY   r   r   r   r   Úadd_certificate_by_hash˜   s&   
ÿÿ
ýz*OCSPRequestBuilder.add_certificate_by_hashÚextvalúx509.ExtensionTypeÚcriticalÚboolc                 C  sJ   t |tjƒs
tdƒ‚t |j||¡}t|| jƒ t| j	| j
g | j¢|‘ƒS ©Nz"extension must be an ExtensionType)r"   r   ÚExtensionTyper8   Ú	ExtensionÚoidr	   rN   rD   rL   rM   ©rB   ra   rc   Ú	extensionr   r   r   Úadd_extension¶   s   ÿz OCSPRequestBuilder.add_extensionÚOCSPRequestc                 C  s&   | j d u r| jd u rtdƒ‚t | ¡S )Nz*You must add a certificate before building)rL   rM   r$   r   Úcreate_ocsp_request)rB   r   r   r   ÚbuildÃ   s   
zOCSPRequestBuilder.build)rE   rF   rG   rH   rI   rJ   r    r!   )rO   rP   rQ   rP   r   r   r    rD   )
rV   rW   rX   rW   rY   rZ   r   r   r    rD   )ra   rb   rc   rd   r    rD   )r    rl   )r   r   r   rC   rU   r`   rk   rn   r   r   r   r   rD   v   s    ø


rD   c                   @  sj   e Zd Zdddg fd<d
d„Zd=dd„Zd>d"d#„Zd?d'd(„Zd@d*d+„ZdAd0d1„ZdBd6d7„Z	e
dCd:d;„ƒZdS )DÚOCSPResponseBuilderNÚresponseú_SingleResponse | NoneÚresponder_idú5tuple[x509.Certificate, OCSPResponderEncoding] | NoneÚcertsúlist[x509.Certificate] | NonerI   rJ   c                 C  s   || _ || _|| _|| _d S rK   )Ú	_responseÚ_responder_idÚ_certsrN   )rB   rp   rr   rt   rI   r   r   r   rC   Ë   s   
zOCSPResponseBuilder.__init__rO   rP   rQ   r   r   r/   r&   r0   r1   r2   r3   r4   r5   r6   r    c	           
   	   C  s`   | j d ur	tdƒ‚t|tjƒrt|tjƒstdƒ‚t||fd ||||||ƒ}	t|	| j| j	| j
ƒS )Nú#Only one response per OCSPResponse.rS   )rv   r$   r"   r   rT   r8   r*   ro   rw   rx   rN   )
rB   rO   rQ   r   r/   r0   r2   r4   r5   Ú
singlerespr   r   r   Úadd_responseØ   s,   
ÿø
üz OCSPResponseBuilder.add_responserV   rW   rX   rY   rZ   c
              	   C  s˜   | j d ur	tdƒ‚t|tƒstdƒ‚t d|¡ t d|¡ t|ƒ |jt	|ƒks0|jt	|ƒkr4tdƒ‚t
d |||f||||||	ƒ}
t|
| j| j| jƒS )Nry   r[   rV   rX   r\   )rv   r$   r"   rZ   r8   r   r]   r%   r^   r_   r*   ro   rw   rx   rN   )rB   rV   rX   rY   r   r/   r0   r2   r4   r5   rz   r   r   r   Úadd_response_by_hashü   s<   

ÿÿø
üz(OCSPResponseBuilder.add_response_by_hashÚencodingr
   Úresponder_certc                 C  sP   | j d ur	tdƒ‚t|tjƒstdƒ‚t|tƒstdƒ‚t| j||f| j	| j
ƒS )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)rw   r$   r"   r   rT   r8   r
   ro   rv   rx   rN   )rB   r}   r~   r   r   r   rr   *  s   

ÿüz OCSPResponseBuilder.responder_idúIterable[x509.Certificate]c                 C  s\   | j d ur	tdƒ‚t|ƒ}t|ƒdkrtdƒ‚tdd„ |D ƒƒs$tdƒ‚t| j| j|| j	ƒS )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s   � | ]	}t |tjƒV  qd S rK   )r"   r   rT   )Ú.0Úxr   r   r   Ú	<genexpr>E  s   € z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rx   r$   Úlistr_   Úallr8   ro   rv   rw   rN   )rB   rt   r   r   r   Úcertificates=  s   
üz OCSPResponseBuilder.certificatesra   rb   rc   rd   c                 C  sN   t |tjƒs
tdƒ‚t |j||¡}t|| jƒ t| j	| j
| jg | j¢|‘ƒS re   )r"   r   rf   r8   rg   rh   r	   rN   ro   rv   rw   rx   ri   r   r   r   rk   N  s   üz!OCSPResponseBuilder.add_extensionÚprivate_keyr   úhashes.HashAlgorithm | NoneÚOCSPResponsec                 C  s6   | j d u r	tdƒ‚| jd u rtdƒ‚t tj| ||¡S )Nz&You must add a response before signingz*You must add a responder_id before signing)rv   r$   rw   r   Úcreate_ocsp_responser   r   )rB   r†   r   r   r   r   Úsign^  s   


ÿzOCSPResponseBuilder.signÚresponse_statusr   c                 C  s4   t |tƒs	tdƒ‚|tju rtdƒ‚t |d d d ¡S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r"   r   r8   r   r$   r   r‰   )Úclsr‹   r   r   r   Úbuild_unsuccessfull  s   
ÿ
z&OCSPResponseBuilder.build_unsuccessful)rp   rq   rr   rs   rt   ru   rI   rJ   )rO   rP   rQ   rP   r   r   r/   r&   r0   r1   r2   r3   r4   r3   r5   r6   r    ro   )rV   rW   rX   rW   rY   rZ   r   r   r/   r&   r0   r1   r2   r3   r4   r3   r5   r6   r    ro   )r}   r
   r~   rP   r    ro   )rt   r   r    ro   )ra   rb   rc   rd   r    ro   )r†   r   r   r‡   r    rˆ   )r‹   r   r    rˆ   )r   r   r   rC   r{   r|   rr   r…   rk   rŠ   Úclassmethodr�   r   r   r   r   ro   Ê   s    ú

$
.


ro   )r   r   r    r!   )#Ú
__future__r   r7   Úcollections.abcr   Úcryptographyr   r   Ú"cryptography.hazmat.bindings._rustr   Úcryptography.hazmat.primitivesr   Ú/cryptography.hazmat.primitives.asymmetric.typesr   Úcryptography.x509.baser	   ÚEnumr
   r   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512r#   r%   r&   r*   rl   rˆ   ÚOCSPSingleResponserD   ro   Úload_der_ocsp_requestÚload_der_ocsp_responser   r   r   r   Ú<module>   s6   
û
	:T 1
