o
    bi1                     @  s  d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ G d	d
 d
ejZG dd dejZejejejejejfZdddZG dd dejZG dd dZe	jZe	jZe	jZG dd dZG dd dZ e	j!Z!e	j"Z"dS )    )annotationsN)Iterable)utilsx509)ocsp)hashes) CertificateIssuerPrivateKeyTypes)_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   P/home/kim/smarthome/.venv/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr
      s    r
   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULZMALFORMED_REQUESTINTERNAL_ERRORZ	TRY_LATERZSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s    r   	algorithmhashes.HashAlgorithmreturnNonec                 C  s   t | ts	tdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm*   s
   
r"   c                   @  s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   ZGOODREVOKEDUNKNOWNr   r   r   r   r#   1   s    r#   c                   @  s   e Zd ZdddZdS )_SingleResponseresp0tuple[x509.Certificate, x509.Certificate] | None	resp_hashtuple[bytes, bytes, int] | Noner   r   cert_statusr#   this_updatedatetime.datetimenext_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec	           	      C  s   t | t|tjstd|d urt|tjstd|| _|| _|| _|| _|| _t|t	s4td|t	j
urJ|d urAtd|d urItdnt|tjsTtd|d urbt|tjsbtd|| _|| _|| _d S )Nz%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectzCrevocation_reason must be an item from the ReasonFlags enum or None)r"   r   datetime	TypeErrorZ_respZ
_resp_hash
_algorithmZ_this_updateZ_next_updater#   r$   r!   r   ZReasonFlagsZ_cert_statusZ_revocation_timeZ_revocation_reason)	selfr'   r)   r   r+   r,   r.   r0   r1   r   r   r   __init__8   sJ   




z_SingleResponse.__init__N)r'   r(   r)   r*   r   r   r+   r#   r,   r-   r.   r/   r0   r/   r1   r2   )r   r   r   r7   r   r   r   r   r&   7   s    r&   c                   @  sF   e Zd Zddg fd#d
dZd$ddZd%ddZd&ddZd'd!d"ZdS )(OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonerequest_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | None
extensions(list[x509.Extension[x509.ExtensionType]]r   r   c                 C  s   || _ || _|| _d S N)_request_request_hash_extensions)r6   r9   r;   r=   r   r   r   r7   w   s   

zOCSPRequestBuilder.__init__certx509.Certificateissuerr   r   c                 C  sZ   | j d us
| jd urtdt| t|tjrt|tjs"tdt|||f| j| j	S )N.Only one certificate can be added to a request%cert and issuer must be a Certificate)
r@   rA   r!   r"   r   r   Certificater4   r8   rB   )r6   rC   rE   r   r   r   r   add_certificate   s   z"OCSPRequestBuilder.add_certificateissuer_name_hashbytesissuer_key_hashserial_numberintc                 C  s   | j d us
| jd urtdt|tstdt| td| td| |j	t
|ks5|j	t
|kr9tdt| j ||||f| jS )NrF    serial_number must be an integerrJ   rL   `issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)r@   rA   r!   r   rN   r4   r"   r   _check_bytesdigest_sizelenr8   rB   )r6   rJ   rL   rM   r   r   r   r   add_certificate_by_hash   s&   

z*OCSPRequestBuilder.add_certificate_by_hashextvalx509.ExtensionTypecriticalboolc                 C  sJ   t |tjs
tdt|j||}t|| j t| j	| j
g | j|S Nz"extension must be an ExtensionType)r   r   ExtensionTyper4   	Extensionoidr	   rB   r8   r@   rA   r6   rU   rW   	extensionr   r   r   add_extension   s   z OCSPRequestBuilder.add_extensionOCSPRequestc                 C  s&   | j d u r| jd u rtdt| S )Nz*You must add a certificate before building)r@   rA   r!   r   Zcreate_ocsp_request)r6   r   r   r   build   s   
zOCSPRequestBuilder.build)r9   r:   r;   r<   r=   r>   r   r   )rC   rD   rE   rD   r   r   r   r8   )
rJ   rK   rL   rK   rM   rN   r   r   r   r8   )rU   rV   rW   rX   r   r8   )r   r`   )r   r   r   r7   rI   rT   r_   ra   r   r   r   r   r8   v   s    


r8   c                   @  sj   e Zd Zdddg fd<d
dZd=ddZd>d"d#Zd?d'd(Zd@d*d+ZdAd0d1ZdBd6d7Z	e
dCd:d;ZdS )DOCSPResponseBuilderNresponse_SingleResponse | Noneresponder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecertslist[x509.Certificate] | Noner=   r>   c                 C  s   || _ || _|| _|| _d S r?   )	_response_responder_id_certsrB   )r6   rc   re   rg   r=   r   r   r   r7      s   
zOCSPResponseBuilder.__init__rC   rD   rE   r   r   r+   r#   r,   r-   r.   r/   r0   r1   r2   r   c	           
   	   C  s`   | j d ur	tdt|tjrt|tjstdt||fd ||||||}	t|	| j| j	| j
S )N#Only one response per OCSPResponse.rG   )ri   r!   r   r   rH   r4   r&   rb   rj   rk   rB   )
r6   rC   rE   r   r+   r,   r.   r0   r1   
singlerespr   r   r   add_response   s,   

z OCSPResponseBuilder.add_responserJ   rK   rL   rM   rN   c
              	   C  s   | j d ur	tdt|tstdtd| td| t| |jt	|ks0|jt	|kr4tdt
d |||f||||||	}
t|
| j| j| jS )Nrl   rO   rJ   rL   rP   )ri   r!   r   rN   r4   r   rQ   r"   rR   rS   r&   rb   rj   rk   rB   )r6   rJ   rL   rM   r   r+   r,   r.   r0   r1   rm   r   r   r   add_response_by_hash   s<   


z(OCSPResponseBuilder.add_response_by_hashencodingr
   responder_certc                 C  sP   | j d ur	tdt|tjstdt|tstdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)rj   r!   r   r   rH   r4   r
   rb   ri   rk   rB   )r6   rp   rq   r   r   r   re   *  s   

z OCSPResponseBuilder.responder_idIterable[x509.Certificate]c                 C  s\   | j d ur	tdt|}t|dkrtdtdd |D s$tdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s    | ]	}t |tjV  qd S r?   )r   r   rH   ).0xr   r   r   	<genexpr>E  s    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rk   r!   listrS   allr4   rb   ri   rj   rB   )r6   rg   r   r   r   certificates=  s   
z OCSPResponseBuilder.certificatesrU   rV   rW   rX   c                 C  sN   t |tjs
tdt|j||}t|| j t| j	| j
| jg | j|S rY   )r   r   rZ   r4   r[   r\   r	   rB   rb   ri   rj   rk   r]   r   r   r   r_   N  s   z!OCSPResponseBuilder.add_extensionprivate_keyr   hashes.HashAlgorithm | NoneOCSPResponsec                 C  s6   | j d u r	td| jd u rtdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)ri   r!   rj   r   create_ocsp_responser   r   )r6   ry   r   r   r   r   sign^  s   


zOCSPResponseBuilder.signresponse_statusr   c                 C  s4   t |ts	td|tju rtdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r   r   r4   r   r!   r   r|   )clsr~   r   r   r   build_unsuccessfull  s   

z&OCSPResponseBuilder.build_unsuccessful)rc   rd   re   rf   rg   rh   r=   r>   )rC   rD   rE   rD   r   r   r+   r#   r,   r-   r.   r/   r0   r/   r1   r2   r   rb   )rJ   rK   rL   rK   rM   rN   r   r   r+   r#   r,   r-   r.   r/   r0   r/   r1   r2   r   rb   )rp   r
   rq   rD   r   rb   )rg   rr   r   rb   )rU   rV   rW   rX   r   rb   )ry   r   r   rz   r   r{   )r~   r   r   r{   )r   r   r   r7   rn   ro   re   rx   r_   r}   classmethodr   r   r   r   r   rb      s    

$
.


rb   )r   r   r   r   )#
__future__r   r3   collections.abcr   Zcryptographyr   r   Z"cryptography.hazmat.bindings._rustr   Zcryptography.hazmat.primitivesr   Z/cryptography.hazmat.primitives.asymmetric.typesr   Zcryptography.x509.baser	   Enumr
   r   SHA1SHA224SHA256SHA384SHA512r    r"   r#   r&   r`   r{   ZOCSPSingleResponser8   rb   Zload_der_ocsp_requestZload_der_ocsp_responser   r   r   r   <module>   s6   

	:T 1
