B
    QUc3A                 @   sV  d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZe	je	je	je	je	jfZe	jddddZG dd dejZG dd dZG dd de jdZG dd de jdZ G dd de jdZ!G dd dZ"G dd dZ#e$eddd Z%e$e!dd!d"Z&dS )#    N)utils)x509)ocsp)hashesserialization)CERTIFICATE_PRIVATE_KEY_TYPES)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc               @   s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__ZHASHNAME r   r   5lib/python3.7/site-packages/cryptography/x509/ocsp.pyr      s   r   c               @   s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDZUNAUTHORIZEDr   r   r   r   r      s   r   )	algorithmreturnc             C   s   t | tstdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm/   s    
r   c               @   s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDZUNKNOWNr   r   r   r   r   6   s   r   c            	   @   sH   e Zd Zejejejeeje	j
ej e	j
ej e	j
ej dddZdS )_SingleResponse)certissuerr   cert_statusthis_updatenext_updaterevocation_timerevocation_reasonc	       	      C   s  t |tjrt |tjs tdt| t |tjs<td|d k	rXt |tjsXtd|| _|| _|| _|| _	|| _
t |tstd|tjk	r|d k	rtd|d k	rtdnHt |tjstdt|}|tk rtd|d k	rt |tjstd	|| _|| _|| _d S )
Nz%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r   r   Certificate	TypeErrorr   datetimeZ_certZ_issuerZ
_algorithmZ_this_updateZ_next_updater   r    r   r	   r   ReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr"   r#   r   r$   r%   r&   r'   r(   r   r   r   __init__=   sJ    






z_SingleResponse.__init__N)r   r   r   r   r)   r   HashAlgorithmr   r+   typingOptionalr,   r.   r   r   r   r   r!   <   s   

r!   c               @   s   e Zd ZejedddZejedddZejej	dddZ
ejeddd	Zejejed
ddZejejdddZdS )OCSPRequest)r   c             C   s   dS )z3
        The hash of the issuer public key
        Nr   )r-   r   r   r   issuer_key_hash   s    zOCSPRequest.issuer_key_hashc             C   s   dS )z-
        The hash of the issuer name
        Nr   )r-   r   r   r   issuer_name_hash   s    zOCSPRequest.issuer_name_hashc             C   s   dS )zK
        The hash algorithm used in the issuer name and key hashes
        Nr   )r-   r   r   r   hash_algorithm   s    zOCSPRequest.hash_algorithmc             C   s   dS )zM
        The serial number of the cert whose status is being checked
        Nr   )r-   r   r   r   serial_number   s    zOCSPRequest.serial_number)encodingr   c             C   s   dS )z/
        Serializes the request to DER
        Nr   )r-   r7   r   r   r   public_bytes   s    zOCSPRequest.public_bytesc             C   s   dS )zP
        The list of request extensions. Not single request extensions.
        Nr   )r-   r   r   r   
extensions   s    zOCSPRequest.extensionsN)r   r   r   abcabstractpropertybytesr3   r4   r   r/   r5   intr6   abstractmethodr   Encodingr8   r   
Extensionsr9   r   r   r   r   r2      s   r2   )	metaclassc               @   s   e Zd ZejedddZejeje	j	 dddZ
ejejej dddZeje	j	ddd	Zejeje	j	 dd
dZejedddZejedddZejejdddZejedddZdS )OCSPSingleResponse)r   c             C   s   dS )zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   )r-   r   r   r   certificate_status   s    z%OCSPSingleResponse.certificate_statusc             C   s   dS )z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   )r-   r   r   r   r'      s    z"OCSPSingleResponse.revocation_timec             C   s   dS )zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   )r-   r   r   r   r(      s    z$OCSPSingleResponse.revocation_reasonc             C   s   dS )z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   )r-   r   r   r   r%      s    zOCSPSingleResponse.this_updatec             C   s   dS )zC
        The time when newer information will be available
        Nr   )r-   r   r   r   r&      s    zOCSPSingleResponse.next_updatec             C   s   dS )z3
        The hash of the issuer public key
        Nr   )r-   r   r   r   r3      s    z"OCSPSingleResponse.issuer_key_hashc             C   s   dS )z-
        The hash of the issuer name
        Nr   )r-   r   r   r   r4      s    z#OCSPSingleResponse.issuer_name_hashc             C   s   dS )zK
        The hash algorithm used in the issuer name and key hashes
        Nr   )r-   r   r   r   r5      s    z!OCSPSingleResponse.hash_algorithmc             C   s   dS )zM
        The serial number of the cert whose status is being checked
        Nr   )r-   r   r   r   r6      s    z OCSPSingleResponse.serial_numberN)r   r   r   r:   r;   r   rC   r0   r1   r+   r'   r   r,   r(   r%   r&   r<   r3   r4   r   r/   r5   r=   r6   r   r   r   r   rB      s$   rB   c               @   s  e Zd Zejeje dddZeje	dddZ
ejejdddZejejej ddd	Zejedd
dZejedddZejejej dddZejeje dddZejejej dddZejejdddZejedddZejejej dddZejejej  dddZ!ejejdddZ"ejejej dddZ#ejedd d!Z$ejedd"d#Z%ejejdd$d%Z&eje'dd&d'Z(ejej)dd(d)Z*ejej)dd*d+Z+ej,e-j.ed,d-d.Z/d/S )0OCSPResponse)r   c             C   s   dS )z_
        An iterator over the individual SINGLERESP structures in the
        response
        Nr   )r-   r   r   r   	responses   s    zOCSPResponse.responsesc             C   s   dS )zm
        The status of the response. This is a value from the OCSPResponseStatus
        enumeration
        Nr   )r-   r   r   r   response_status   s    zOCSPResponse.response_statusc             C   s   dS )zA
        The ObjectIdentifier of the signature algorithm
        Nr   )r-   r   r   r   signature_algorithm_oid   s    z$OCSPResponse.signature_algorithm_oidc             C   s   dS )zX
        Returns a HashAlgorithm corresponding to the type of the digest signed
        Nr   )r-   r   r   r   signature_hash_algorithm   s    z%OCSPResponse.signature_hash_algorithmc             C   s   dS )z%
        The signature bytes
        Nr   )r-   r   r   r   	signature   s    zOCSPResponse.signaturec             C   s   dS )z+
        The tbsResponseData bytes
        Nr   )r-   r   r   r   tbs_response_bytes  s    zOCSPResponse.tbs_response_bytesc             C   s   dS )z
        A list of certificates used to help build a chain to verify the OCSP
        response. This situation occurs when the OCSP responder uses a delegate
        certificate.
        Nr   )r-   r   r   r   certificates  s    zOCSPResponse.certificatesc             C   s   dS )z2
        The responder's key hash or None
        Nr   )r-   r   r   r   responder_key_hash  s    zOCSPResponse.responder_key_hashc             C   s   dS )z.
        The responder's Name or None
        Nr   )r-   r   r   r   responder_name  s    zOCSPResponse.responder_namec             C   s   dS )z4
        The time the response was produced
        Nr   )r-   r   r   r   produced_at   s    zOCSPResponse.produced_atc             C   s   dS )zY
        The status of the certificate (an element from the OCSPCertStatus enum)
        Nr   )r-   r   r   r   rC   &  s    zOCSPResponse.certificate_statusc             C   s   dS )z^
        The date of when the certificate was revoked or None if not
        revoked.
        Nr   )r-   r   r   r   r'   ,  s    zOCSPResponse.revocation_timec             C   s   dS )zi
        The reason the certificate was revoked or None if not specified or
        not revoked.
        Nr   )r-   r   r   r   r(   3  s    zOCSPResponse.revocation_reasonc             C   s   dS )z
        The most recent time at which the status being indicated is known by
        the responder to have been correct
        Nr   )r-   r   r   r   r%   :  s    zOCSPResponse.this_updatec             C   s   dS )zC
        The time when newer information will be available
        Nr   )r-   r   r   r   r&   A  s    zOCSPResponse.next_updatec             C   s   dS )z3
        The hash of the issuer public key
        Nr   )r-   r   r   r   r3   G  s    zOCSPResponse.issuer_key_hashc             C   s   dS )z-
        The hash of the issuer name
        Nr   )r-   r   r   r   r4   M  s    zOCSPResponse.issuer_name_hashc             C   s   dS )zK
        The hash algorithm used in the issuer name and key hashes
        Nr   )r-   r   r   r   r5   S  s    zOCSPResponse.hash_algorithmc             C   s   dS )zM
        The serial number of the cert whose status is being checked
        Nr   )r-   r   r   r   r6   Y  s    zOCSPResponse.serial_numberc             C   s   dS )zR
        The list of response extensions. Not single response extensions.
        Nr   )r-   r   r   r   r9   _  s    zOCSPResponse.extensionsc             C   s   dS )zR
        The list of single response extensions. Not response extensions.
        Nr   )r-   r   r   r   single_extensionse  s    zOCSPResponse.single_extensions)r7   r   c             C   s   dS )z0
        Serializes the response to DER
        Nr   )r-   r7   r   r   r   r8   k  s    zOCSPResponse.public_bytesN)0r   r   r   r:   r;   r0   IteratorrB   rE   r   rF   r   ZObjectIdentifierrG   r1   r   r/   rH   r<   rI   rJ   Listr)   rK   rL   NamerM   r+   rN   r   rC   r'   r,   r(   r%   r&   r3   r4   r5   r=   r6   r@   r9   rO   r>   r   r?   r8   r   r   r   r   rD      sX   rD   c               @   s   e Zd Zdg fejejejejej	f  ej
ejej  ddddZejejej	d dddZejed dd	d
ZedddZdS )OCSPRequestBuilderN)requestr9   r   c             C   s   || _ || _d S )N)_request_extensions)r-   rT   r9   r   r   r   r.   s  s    	zOCSPRequestBuilder.__init__)r"   r#   r   r   c             C   sL   | j d k	rtdt| t|tjr2t|tjs:tdt|||f| jS )Nz.Only one certificate can be added to a requestz%cert and issuer must be a Certificate)	rU   r   r   r   r   r)   r*   rS   rV   )r-   r"   r#   r   r   r   r   add_certificate  s    

z"OCSPRequestBuilder.add_certificate)extvalcriticalr   c             C   sD   t |tjstdt|j||}t|| j t| j	| j|g S )Nz"extension must be an ExtensionType)
r   r   ExtensionTyper*   	Extensionoidr
   rV   rS   rU   )r-   rX   rY   	extensionr   r   r   add_extension  s    z OCSPRequestBuilder.add_extension)r   c             C   s   | j d krtdt| S )Nz*You must add a certificate before building)rU   r   r   Zcreate_ocsp_request)r-   r   r   r   build  s    
zOCSPRequestBuilder.build)r   r   r   r0   r1   Tupler   r)   r   r/   rQ   r[   rZ   r.   rW   boolr^   r2   r_   r   r   r   r   rS   r  s   .rS   c            
   @   s
  e Zd Zdddg feje ejejeje	f  ejej
ej  ej
ejej  dddZejejejeejejej ejej ejej d d	ddZe	ejd dd	d
Zejej d dddZejed dddZeejej edddZeeedddZdS )OCSPResponseBuilderN)responseresponder_idcertsr9   c             C   s   || _ || _|| _|| _d S )N)	_response_responder_id_certsrV   )r-   rc   rd   re   r9   r   r   r   r.     s    	zOCSPResponseBuilder.__init__)	r"   r#   r   r$   r%   r&   r'   r(   r   c	       
   	   C   s<   | j d k	rtdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)rf   r   r!   rb   rg   rh   rV   )
r-   r"   r#   r   r$   r%   r&   r'   r(   Z
singlerespr   r   r   add_response  s     
z OCSPResponseBuilder.add_response)r7   responder_certr   c             C   sP   | j d k	rtdt|tjs&tdt|ts8tdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)rg   r   r   r   r)   r*   r   rb   rf   rh   rV   )r-   r7   rj   r   r   r   rd     s    

z OCSPResponseBuilder.responder_id)re   r   c             C   s\   | j d k	rtdt|}t|dkr.tdtdd |D sHtdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc             s   s   | ]}t |tjV  qd S )N)r   r   r)   ).0xr   r   r   	<genexpr>  s    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rh   r   listlenallr*   rb   rf   rg   rV   )r-   re   r   r   r   rK     s    
z OCSPResponseBuilder.certificates)rX   rY   r   c             C   sL   t |tjstdt|j||}t|| j t| j	| j
| j| j|g S )Nz"extension must be an ExtensionType)r   r   rZ   r*   r[   r\   r
   rV   rb   rf   rg   rh   )r-   rX   rY   r]   r   r   r   r^     s    z!OCSPResponseBuilder.add_extension)private_keyr   r   c             C   s6   | j d krtd| jd kr$tdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)rf   r   rg   r   create_ocsp_responser   r   )r-   rq   r   r   r   r   sign  s    

zOCSPResponseBuilder.sign)rF   r   c             C   s4   t |tstd|tjkr$tdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r*   r   r   r   rr   )clsrF   r   r   r   build_unsuccessful  s    

z&OCSPResponseBuilder.build_unsuccessful)r   r   r   r0   r1   r!   r`   r   r)   r   rQ   r[   rZ   r.   r   r/   r   r+   r,   ri   rd   IterablerK   ra   r^   r   rD   rs   classmethodr   ru   r   r   r   r   rb     s2   L	





rb   )datar   c             C   s
   t | S )N)r   load_der_ocsp_request)rx   r   r   r   ry   "  s    ry   c             C   s
   t | S )N)r   load_der_ocsp_response)rx   r   r   r   rz   &  s    rz   )'r:   r+   r0   Zcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser   r	   r
   Enumr   r   ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512r   r/   r   r   r!   ABCMetar2   rB   rD   rS   rb   r<   ry   rz   r   r   r   r   <module>   s4   
F&; 2~