o
    àý°j®6  ã                   @  sˆ  d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZmZ d dlmZmZ d dlmZ d dlmZmZ d dlmZmZmZ d d	lmZ d d
lmZ ejZej Z ej!Z!ej"ej#ej$ej%ej&f Z'ej"ej(ej)f Z*ej"e+ej, e+ej- f Z.G dd„ dej/ƒZ0G dd„ dƒZ1G dd„ dƒZ2ej3Z4ej5Z6ej7Z8d#dd„Z9d$dd„Z:d$dd„Z;d$dd „Z<G d!d"„ d"ej=j>ƒZ?dS )%é    )ÚannotationsN)ÚIterable)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)Úpkcs7)ÚhashesÚserialization)ÚecÚpaddingÚrsa)Ú
algorithms)Ú_check_byteslikec                   @  s$   e Zd ZdZdZdZdZdZdZdS )ÚPKCS7OptionszAdd text/plain MIME typez5Don't translate input data into canonical MIME formatz'Don't embed data in the PKCS7 structurezDon't embed SMIME capabilitiesz#Don't embed authenticatedAttributeszDon't embed signer certificateN)	Ú__name__Ú
__module__Ú__qualname__ÚTextÚBinaryÚDetachedSignatureÚNoCapabilitiesÚNoAttributesÚNoCerts© r   r   ú¥/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/cryptography/hazmat/primitives/serialization/pkcs7.pyr   /   s    r   c                   @  sP   e Zd Zdg g fd$dd	„Zd%dd„Zddœd&dd„Zd'dd„Z	d(d)d"d#„ZdS )*ÚPKCS7SignatureBuilderNÚdataúutils.Buffer | NoneÚsignersújlist[tuple[x509.Certificate, PKCS7PrivateKeyTypes, PKCS7HashTypes, padding.PSS | padding.PKCS1v15 | None]]Úadditional_certsúlist[x509.Certificate]c                 C  s   || _ || _|| _d S ©N)Ú_dataÚ_signersÚ_additional_certs)Úselfr   r   r!   r   r   r   Ú__init__9   s   
zPKCS7SignatureBuilder.__init__úutils.BufferÚreturnc                 C  s(   t d|ƒ | jd urtdƒ‚t|| jƒS )Nr   údata may only be set once)r   r$   Ú
ValueErrorr   r%   ©r'   r   r   r   r   Úset_dataJ   s   

zPKCS7SignatureBuilder.set_data)Úrsa_paddingÚcertificateúx509.CertificateÚprivate_keyÚPKCS7PrivateKeyTypesÚhash_algorithmÚPKCS7HashTypesr/   ú%padding.PSS | padding.PKCS1v15 | Nonec                C  s¤   t |tjtjtjtjfƒstdƒ‚t |tjƒstdƒ‚t |t	j
tjfƒs(tdƒ‚|d urCt |tjtjfƒs9tdƒ‚t |t	j
ƒsCtdƒ‚t| jg | j¢||||f‘ƒS )NzFhash_algorithm must be one of hashes.SHA224, SHA256, SHA384, or SHA512ú&certificate must be a x509.Certificatez.Only RSA & EC keys are supported at this time.zPadding must be PSS or PKCS1v15z&Padding is only supported for RSA keys)Ú
isinstancer	   ÚSHA224ÚSHA256ÚSHA384ÚSHA512Ú	TypeErrorr   ÚCertificater   ÚRSAPrivateKeyr   ÚEllipticCurvePrivateKeyr   ÚPSSÚPKCS1v15r   r$   r%   )r'   r0   r2   r4   r/   r   r   r   Ú
add_signerQ   s<   üþ	ÿÿÿ
þþz PKCS7SignatureBuilder.add_signerc                 C  s.   t |tjƒs
tdƒ‚t| j| jg | j¢|‘ƒS )Nr7   )r8   r   r>   r=   r   r$   r%   r&   ©r'   r0   r   r   r   Úadd_certificate|   s
   ÿz%PKCS7SignatureBuilder.add_certificateÚencodingúserialization.EncodingÚoptionsúIterable[PKCS7Options]Úbackendú
typing.AnyÚbytesc                 C  sØ   t | jƒdkrtdƒ‚| jd u rtdƒ‚t|ƒ}tdd„ |D ƒƒs%tdƒ‚|tjjtjj	tjj
fvr6tdƒ‚tj|v rDtj|vrDtdƒ‚tj|v rW|tjj	tjjfv rWtd	ƒ‚tj|v retj|v retd
ƒ‚t | ||¡S )Nr   zMust have at least one signerzYou must add data to signc                 s  ó   � | ]}t |tƒV  qd S r#   ©r8   r   ©Ú.0Úxr   r   r   Ú	<genexpr>‘   ó   € z-PKCS7SignatureBuilder.sign.<locals>.<genexpr>ú*options must be from the PKCS7Options enumú1Must be PEM, DER, or SMIME from the Encoding enumzAWhen passing the Text option you must also pass DetachedSignaturez9The Text option is only available for SMIME serializationzFNoAttributes is a superset of NoCapabilities. Do not pass both values.)Úlenr%   r,   r$   ÚlistÚallr
   ÚEncodingÚPEMÚDERÚSMIMEr   r   r   r   r   Ú
rust_pkcs7Úsign_and_serialize)r'   rF   rH   rJ   r   r   r   Úsign†   sB   
ýÿ

ÿþÿ

ÿzPKCS7SignatureBuilder.sign)r   r   r   r    r!   r"   )r   r)   r*   r   )
r0   r1   r2   r3   r4   r5   r/   r6   r*   r   )r0   r1   r*   r   r#   )rF   rG   rH   rI   rJ   rK   r*   rL   )r   r   r   r(   r.   rC   rE   r_   r   r   r   r   r   8   s    õ
ú
+ür   c                   @  sH   e Zd Zddddœdd	d
„Zddd„Zd dd„Zd!dd„Zd"dd„ZdS )#ÚPKCS7EnvelopeBuilderN©r$   Ú_recipientsÚ_content_encryption_algorithmr$   úbytes | Nonerb   úlist[x509.Certificate] | Nonerc   ú!ContentEncryptionAlgorithm | Nonec                C  sJ   ddl m} |jt ¡ d�stdtjƒ‚|| _|d ur|ng | _	|| _
d S )Nr   )rJ   )r   zHRSA with PKCS1 v1.5 padding is not supported by this version of OpenSSL.)Ú,cryptography.hazmat.backends.openssl.backendrJ   Úrsa_encryption_supportedr   rB   r   r   ÚUNSUPPORTED_PADDINGr$   rb   rc   )r'   r$   rb   rc   Úosslr   r   r   r(   ¾   s   ý
zPKCS7EnvelopeBuilder.__init__r   rL   r*   c                 C  s.   t d|ƒ | jd urtdƒ‚t|| j| jd�S )Nr   r+   ra   )r   r$   r,   r`   rb   rc   r-   r   r   r   r.   Ô   s   

ýzPKCS7EnvelopeBuilder.set_datar0   r1   c                 C  sH   t |tjƒs
tdƒ‚t | ¡ tjƒstdƒ‚t| jg | j	¢|‘| j
d�S )Nr7   z)Only RSA keys are supported at this time.ra   )r8   r   r>   r=   Ú
public_keyr   ÚRSAPublicKeyr`   r$   rb   rc   rD   r   r   r   Úadd_recipientß   s   ÿþúz"PKCS7EnvelopeBuilder.add_recipientÚcontent_encryption_algorithmÚContentEncryptionAlgorithmc                 C  s<   | j d ur	tdƒ‚|tjtjhvrtdƒ‚t| j| j|d�S )Nz,Content encryption algo may only be set oncez$Only AES128 and AES256 are supportedra   )	rc   r,   r   ÚAES128ÚAES256r=   r`   r$   rb   )r'   rn   r   r   r   Ú set_content_encryption_algorithmò   s   
þýz5PKCS7EnvelopeBuilder.set_content_encryption_algorithmrF   rG   rH   rI   c                 C  s¾   t | jƒdkrtdƒ‚| jd u rtdƒ‚| jptj}t|ƒ}tdd„ |D ƒƒs+tdƒ‚|t	j
jt	j
jt	j
jfvr<tdƒ‚tdd„ |D ƒƒrItd	ƒ‚tj|v rWtj|v rWtd
ƒ‚t | |||¡S )Nr   z Must have at least one recipientzYou must add data to encryptc                 s  rM   r#   rN   rO   r   r   r   rR     rS   z/PKCS7EnvelopeBuilder.encrypt.<locals>.<genexpr>rT   rU   c                 s  s    � | ]}|t jt jfvV  qd S r#   )r   r   r   )rP   Úoptr   r   r   rR   !  s
   € ÿ
ÿzEOnly the following options are supported for encryption: Text, Binaryz3Cannot use Binary and Text options at the same time)rV   rb   r,   r$   rc   r   rp   rW   rX   r
   rY   rZ   r[   r\   Úanyr   r   r   r]   Úencrypt_and_serialize)r'   rF   rH   rn   r   r   r   Úencrypt  s<   

ÿýÿþÿÿÿzPKCS7EnvelopeBuilder.encrypt)r$   rd   rb   re   rc   rf   )r   rL   r*   r`   )r0   r1   r*   r`   )rn   ro   r*   r`   )rF   rG   rH   rI   r*   rL   )r   r   r   r(   r.   rm   rr   rv   r   r   r   r   r`   ½   s    ú


r`   r   rL   Ú	signatureÚmicalgÚstrÚ	text_modeÚboolr*   c           	      C  sì   t j ¡ }| dd¡ |jddd|d� d|_tƒ }| | ¡ |r'| dd¡ | |¡ t j ¡ }|jddd	d
� | dd¡ |jddd	d� | t j	j
|dd�¡ |d= | |¡ t ¡ }t jj|dd|jjdd�d�}| |¡ | ¡ S )NúMIME-Versionú1.0úContent-Typezmultipart/signedzapplication/x-pkcs7-signature)Úprotocolrx   z!This is an S/MIME signed message
ú
text/plainz	smime.p7s)ÚnameúContent-Transfer-EncodingÚbase64úContent-DispositionÚ
attachment©ÚfilenameéA   ©Ú
maxlinelenr   Fz
)Úlinesep)ÚmaxheaderlenÚmangle_from_Úpolicy)ÚemailÚmessageÚMessageÚ
add_headerÚpreambleÚOpenSSLMimePartÚset_payloadÚattachÚMIMEPartÚ
base64mimeÚbody_encodeÚioÚBytesIOÚ	generatorÚBytesGeneratorrŽ   ÚcloneÚflattenÚgetvalue)	r   rw   rx   rz   ÚmÚmsg_partÚsig_partÚfpÚgr   r   r   Ú_smime_signed_encode:  sH   
ü


ÿÿÿ
ü
r¦   c                 C  sr   t j ¡ }| dd¡ |jdddd� |jddd	dd
� | dd¡ | t jj| dd�¡ |j|jj	ddd�d�S )Nr|   r}   r„   r…   z	smime.p7mr†   r~   úapplication/pkcs7-mimezenveloped-data)Ú
smime_typer�   r‚   rƒ   rˆ   r‰   Ú
r   )r‹   Úmax_line_length)rŽ   )
r�   r�   r‘   r’   r•   r˜   r™   Úas_bytesrŽ   rž   ©r   r¡   r   r   r   Ú_smime_enveloped_encodej  s   
ür­   c                 C  s.   t  | ¡}| ¡ dvrtdƒ‚t|jdd�ƒS )N>   úapplication/x-pkcs7-mimer§   zNot an S/MIME enveloped messageT©Údecode)r�   Úmessage_from_bytesÚget_content_typer,   rL   Úget_payloadr¬   r   r   r   Ú_smime_enveloped_decode{  s   
r´   c                 C  sL   t  | ¡}| d¡}|d u rtdƒ‚d|vrtd|› d�ƒ‚t|jdd�ƒS )Nzcontent-typezgDecrypted MIME data has no 'Content-Type' header. Please remove the 'Text' option to parse it manually.r€   z%Decrypted MIME data content type is 'zC', not 'text/plain'. Remove the 'Text' option to parse it manually.Tr¯   )r�   r±   Úgetr,   rL   r³   )r   r¡   Úcontent_typer   r   r   Ú_smime_remove_text_headers…  s   

ÿ
ÿr·   c                   @  s   e Zd Zddd„ZdS )r”   r*   ÚNonec                 C  s   t |  ¡ ƒr| | ¡ d S d S r#   )rW   Ú	raw_itemsÚ_write_headers)r'   rœ   r   r   r   rº   š  s   ÿzOpenSSLMimePart._write_headersN)r*   r¸   )r   r   r   rº   r   r   r   r   r”   —  s    r”   )
r   rL   rw   rL   rx   ry   rz   r{   r*   rL   )r   rL   r*   rL   )@Ú
__future__r   Úemail.base64mimer�   Úemail.generatorÚemail.messageÚemail.policyrš   ÚtypingÚcollections.abcr   Úcryptographyr   r   Úcryptography.exceptionsr   r   Ú"cryptography.hazmat.bindings._rustr   r]   Úcryptography.hazmat.primitivesr	   r
   Ú)cryptography.hazmat.primitives.asymmetricr   r   r   Ú&cryptography.hazmat.primitives.ciphersr   Úcryptography.utilsr   Úload_pem_pkcs7_certificatesÚload_der_pkcs7_certificatesÚserialize_certificatesÚUnionr9   r:   r;   r<   r5   r?   r@   r3   Útyperp   rq   ro   ÚEnumr   r   r`   Údecrypt_derÚpkcs7_decrypt_derÚdecrypt_pemÚpkcs7_decrypt_pemÚdecrypt_smimeÚpkcs7_decrypt_smimer¦   r­   r´   r·   r�   r—   r”   r   r   r   r   Ú<module>   sV   ýÿ
ÿÿ	 x

0


