o
    0³´jmZ  ã                   @   s¦  d dl Z d dlZd dlZddlmZ ddlmZmZmZm	Z	m
Z
mZmZmZmZ zZd dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZmZ d d
lmZmZ d dl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 dZ1W n e2y�   dZ1Y nw h d£Z3dd„ Z4G dd„ dƒZ5G dd„ de5ƒZ6G dd„ de5ƒZ7e1rÑG dd„ de5ƒZ8G dd„ de5ƒZ9G dd„ de8ƒZ:G dd„ de5ƒZ;dS dS ) é    Né   ©ÚInvalidKeyError)	Úbase64url_decodeÚbase64url_encodeÚder_to_raw_signatureÚforce_bytesÚfrom_base64url_uintÚis_pem_formatÚ
is_ssh_keyÚraw_to_der_signatureÚto_base64url_uint)ÚInvalidSignature)Úhashes)ÚecÚpadding)ÚEllipticCurvePrivateKeyÚEllipticCurvePublicKey)ÚEd448PrivateKeyÚEd448PublicKey)ÚEd25519PrivateKeyÚEd25519PublicKey)ÚRSAPrivateKeyÚRSAPrivateNumbersÚRSAPublicKeyÚRSAPublicNumbersÚrsa_crt_dmp1Úrsa_crt_dmq1Úrsa_crt_iqmpÚrsa_recover_prime_factors)ÚEncodingÚNoEncryptionÚPrivateFormatÚPublicFormatÚload_pem_private_keyÚload_pem_public_keyÚload_ssh_public_keyTF>   ÚES256ÚES384ÚES512ÚES521ÚEdDSAÚPS256ÚPS384ÚPS512ÚRS256ÚRS384ÚRS512ÚES256Kc                  C   s’   t ƒ ttjƒttjƒttjƒdœ} trG|  ttjƒttjƒttjƒttjƒttjƒttjƒttjƒttjƒt	t	jƒt	t	jƒt	t	jƒt
ƒ dœ¡ | S )zE
    Returns the algorithms that are implemented by the library.
    )ÚnoneÚHS256ÚHS384ÚHS512)r/   r0   r1   r'   r2   r(   r*   r)   r,   r-   r.   r+   )ÚNoneAlgorithmÚHMACAlgorithmÚSHA256ÚSHA384ÚSHA512Ú
has_cryptoÚupdateÚRSAAlgorithmÚECAlgorithmÚRSAPSSAlgorithmÚOKPAlgorithm)Údefault_algorithms© rC   ú0/usr/lib/python3/dist-packages/jwt/algorithms.pyÚget_default_algorithmsK   s0   üÿòÿrE   c                   @   s@   e Zd ZdZdd„ Zdd„ Zdd„ Zedd	„ ƒZed
d„ ƒZ	dS )Ú	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    c                 C   ó   t ‚)zš
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        ©ÚNotImplementedError©ÚselfÚkeyrC   rC   rD   Úprepare_keyr   ó   zAlgorithm.prepare_keyc                 C   rG   )zn
        Returns a digital signature for the specified message
        using the specified key value.
        rH   ©rK   ÚmsgrL   rC   rC   rD   Úsigny   rN   zAlgorithm.signc                 C   rG   )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        rH   ©rK   rP   rL   ÚsigrC   rC   rD   Úverify€   rN   zAlgorithm.verifyc                 C   rG   )z7
        Serializes a given RSA key into a JWK
        rH   ©Úkey_objrC   rC   rD   Úto_jwk‡   rN   zAlgorithm.to_jwkc                 C   rG   )zb
        Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
        rH   )ÚjwkrC   rC   rD   Úfrom_jwkŽ   rN   zAlgorithm.from_jwkN)
Ú__name__Ú
__module__Ú__qualname__Ú__doc__rM   rQ   rT   ÚstaticmethodrW   rY   rC   rC   rC   rD   rF   m   s    
rF   c                   @   s(   e Zd ZdZdd„ Zdd„ Zdd„ ZdS )	r7   zZ
    Placeholder for use when no signing or verification
    operations are required.
    c                 C   s    |dkrd }|d urt dƒ‚|S )NÚ z*When alg = "none", key value must be None.r   rJ   rC   rC   rD   rM   œ   s
   zNoneAlgorithm.prepare_keyc                 C   ó   dS )Nó    rC   rO   rC   rC   rD   rQ   ¥   ó   zNoneAlgorithm.signc                 C   r`   )NFrC   rR   rC   rC   rD   rT   ¨   rb   zNoneAlgorithm.verifyN)rZ   r[   r\   r]   rM   rQ   rT   rC   rC   rC   rD   r7   –   s
    	r7   c                   @   sZ   e Zd ZdZejZejZej	Z
dd„ Zdd„ Zedd„ ƒZedd	„ ƒZd
d„ Zdd„ ZdS )r8   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                 C   ó
   || _ d S ©N©Úhash_alg©rK   rf   rC   rC   rD   Ú__init__¶   ó   
zHMACAlgorithm.__init__c                 C   sŠ   t |ƒ}t|ƒdkrtdƒ‚t|ƒst|ƒrtdƒ‚| ¡ }| d¡rCzt |¡}W n t	y5   d }Y nw t
|tƒrCd|v rCtdƒ‚|S )Nr   zHMAC key must not be empty.zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.ó   {Úktyz‡The specified key looks like a JWK and should not be used directly as an HMAC secret. Load it via PyJWK / HMACAlgorithm.from_jwk first.)r   Úlenr   r
   r   ÚlstripÚ
startswithÚjsonÚloadsÚ
ValueErrorÚ
isinstanceÚdict)rK   rL   ÚstrippedÚjwk_objrC   rC   rD   rM   ¹   s&   ÿ
ÿÿzHMACAlgorithm.prepare_keyc                 C   s   t  tt| ƒƒ ¡ ddœ¡S )NÚoct)Úkrk   )ro   Údumpsr   r   ÚdecoderU   rC   rC   rD   rW   Ú   s
   þÿzHMACAlgorithm.to_jwkc                 C   sh   zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty"   tdƒ‚w | d¡dkr.tdƒ‚t|d ƒS )NúKey is not valid JSONrk   rv   zNot an HMAC keyrw   )	rr   Ústrro   rp   rs   rq   r   Úgetr   )rX   ÚobjrC   rC   rD   rY   ã   s   

€ÿzHMACAlgorithm.from_jwkc                 C   s   t  ||| j¡ ¡ S rd   )ÚhmacÚnewrf   ÚdigestrO   rC   rC   rD   rQ   ô   ó   zHMACAlgorithm.signc                 C   s   t  ||  ||¡¡S rd   )r~   Úcompare_digestrQ   rR   rC   rC   rD   rT   ÷   r�   zHMACAlgorithm.verifyN)rZ   r[   r\   r]   ÚhashlibÚsha256r9   Úsha384r:   Úsha512r;   rh   rM   r^   rW   rY   rQ   rT   rC   rC   rC   rD   r8   ¬   s    !

r8   c                   @   sZ   e Zd ZdZejZejZejZdd„ Zdd„ Z	e
dd„ ƒZe
dd	„ ƒZd
d„ Zdd„ ZdS )r>   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        c                 C   rc   rd   re   rg   rC   rC   rD   rh     ri   zRSAAlgorithm.__init__c                 C   sx   t |ttfƒr	|S t |ttfƒstdƒ‚t|ƒ}z| d¡r%t|ƒ}W |S t	|d d�}W |S  t
y;   t|ƒ}Y |S w )NúExpecting a PEM-formatted key.s   ssh-rsa©Úpassword)rr   r   r   Úbytesr{   Ú	TypeErrorr   rn   r&   r$   rq   r%   rJ   rC   rC   rD   rM   
  s   

ýþ
þzRSAAlgorithm.prepare_keyc                 C   sÖ   d }t | dd ƒrE|  ¡ }ddgt|jjƒ ¡ t|jjƒ ¡ t|jƒ ¡ t|jƒ ¡ t|j	ƒ ¡ t|j
ƒ ¡ t|jƒ ¡ t|jƒ ¡ dœ
}n!t | dd ƒrb|  ¡ }ddgt|jƒ ¡ t|jƒ ¡ dœ}ntdƒ‚t |¡S )NÚprivate_numbersÚRSArQ   )
rk   Úkey_opsÚnÚeÚdÚpÚqÚdpÚdqÚqirT   )rk   rŽ   r�   r�   úNot a public or private key)ÚgetattrrŒ   r   Úpublic_numbersr�   ry   r�   r‘   r’   r“   Údmp1Údmq1Úiqmpr   ro   rx   )rV   r}   ÚnumbersrC   rC   rD   rW     s.   öü
zRSAAlgorithm.to_jwkc           	   	      s°  zt | tƒrt | ¡‰ n
t | tƒr| ‰ nt‚W n ty"   tdƒ‚w ˆ  d¡dkr.tdƒ‚dˆ v r»dˆ v r»dˆ v r»dˆ v rBtd	ƒ‚g d
¢}‡ fdd„|D ƒ}t|ƒ}|r]t	|ƒs]tdƒ‚t
tˆ d ƒtˆ d ƒƒ}|r“ttˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒ|d�}| ¡ S tˆ d ƒ}t|j||jƒ\}}t|||t||ƒt||ƒt||ƒ|d�}| ¡ S dˆ v rÔdˆ v rÔt
tˆ d ƒtˆ d ƒƒ}| ¡ S tdƒ‚)Nrz   rk   r�   zNot an RSA keyr‘   r�   r�   Úothz5Unsupported RSA private key: > 2 primes not supported)r’   r“   r”   r•   r–   c                    s   g | ]}|ˆ v ‘qS rC   rC   )Ú.0Úprop©r}   rC   rD   Ú
<listcomp>W  s    z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides dr’   r“   r”   r•   r–   )r‘   r’   r“   rš   r›   rœ   r™   r—   )rr   r{   ro   rp   rs   rq   r   r|   ÚanyÚallr   r	   r   r   r�   r�   r   r   r   Úprivate_keyÚ
public_key)	rX   Úother_propsÚprops_foundÚany_props_foundr™   r�   r‘   r’   r“   rC   r¡   rD   rY   @  sx   

€ÿÿÿ

þ





ùñ
ÿù


þzRSAAlgorithm.from_jwkc                 C   s   |  |t ¡ |  ¡ ¡S rd   )rQ   r   ÚPKCS1v15rf   rO   rC   rC   rD   rQ   Š  s   zRSAAlgorithm.signc                 C   s4   z|  ||t ¡ |  ¡ ¡ W dS  ty   Y dS w )NTF)rT   r   rª   rf   r   rR   rC   rC   rD   rT   �  s   ÿzRSAAlgorithm.verifyN)rZ   r[   r\   r]   r   r9   r:   r;   rh   rM   r^   rW   rY   rQ   rT   rC   rC   rC   rD   r>   ý   s    
#
Ir>   c                   @   sN   e Zd ZdZejZejZejZdd„ Zdd„ Z	dd„ Z
dd	„ Zed
d„ ƒZdS )r?   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        c                 C   rc   rd   re   rg   rC   rC   rD   rh   ž  ri   zECAlgorithm.__init__c                 C   sx   t |ttfƒr	|S t |ttfƒstdƒ‚t|ƒ}z| d¡r%t|ƒ}W |S t	|ƒ}W |S  t
y;   t|d d�}Y |S w )Nr‡   s   ecdsa-sha2-rˆ   )rr   r   r   rŠ   r{   r‹   r   rn   r&   r%   rq   r$   rJ   rC   rC   rD   rM   ¡  s   


üýýzECAlgorithm.prepare_keyc                 C   s"   |  |t |  ¡ ¡¡}t||jƒS rd   )rQ   r   ÚECDSArf   r   Úcurve)rK   rP   rL   Úder_sigrC   rC   rD   rQ   ·  s   zECAlgorithm.signc                 C   sl   zt ||jƒ}W n
 ty   Y dS w zt|tƒr| ¡ }| ||t |  	¡ ¡¡ W dS  t
y5   Y dS w )NFT)r   r¬   rq   rr   r   r¦   rT   r   r«   rf   r   )rK   rP   rL   rS   r­   rC   rC   rD   rT   ¼  s   ÿ
ÿzECAlgorithm.verifyc                 C   s&  zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty"   tdƒ‚w | d¡dkr.tdƒ‚d|vs6d|vr:tdƒ‚t| d¡ƒ}t| d¡ƒ}| d¡}|dkrmt	|ƒt	|ƒ  kr_d	krin td
ƒ‚t
 ¡ }nktd
ƒ‚|dkr�t	|ƒt	|ƒ  krdkr‰n tdƒ‚t
 ¡ }nKtdƒ‚|dkr­t	|ƒt	|ƒ  krŸdkr©n tdƒ‚t
 ¡ }n+tdƒ‚|dkrÍt	|ƒt	|ƒ  kr¿d	krÉn tdƒ‚t
 ¡ }ntdƒ‚td|› �ƒ‚t
jtj|dd�tj|dd�|d�}d|vrî| ¡ S t| d¡ƒ}t	|ƒt	|ƒk�rtdt	|ƒ|ƒ‚t
 tj|dd�|¡ ¡ S )Nrz   rk   ÚECzNot an Elliptic curve keyÚxÚyÚcrvzP-256é    z)Coords should be 32 bytes for curve P-256zP-384é0   z)Coords should be 48 bytes for curve P-384zP-521éB   z)Coords should be 66 bytes for curve P-521Ú	secp256k1z-Coords should be 32 bytes for curve secp256k1úInvalid curve: Úbig)Ú	byteorder)r¯   r°   r¬   r‘   z!D should be {} bytes for curve {})rr   r{   ro   rp   rs   rq   r   r|   r   rl   r   Ú	SECP256R1Ú	SECP384R1Ú	SECP521R1Ú	SECP256K1ÚEllipticCurvePublicNumbersÚintÚ
from_bytesr¦   ÚEllipticCurvePrivateNumbersr¥   )rX   r}   r¯   r°   r¬   Ú	curve_objr™   r‘   rC   rC   rD   rY   Ê  sv   

€ÿ

þ
þ
þÿ
þÿý
ÿÿþzECAlgorithm.from_jwkN)rZ   r[   r\   r]   r   r9   r:   r;   rh   rM   rQ   rT   r^   rY   rC   rC   rC   rD   r?   ”  s    r?   c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )r@   zA
        Performs a signature using RSASSA-PSS with MGF1
        c                 C   s*   |  |tjt |  ¡ ¡| jjd�|  ¡ ¡S )N©ÚmgfÚsalt_length)rQ   r   ÚPSSÚMGF1rf   Údigest_sizerO   rC   rC   rD   rQ     s   þúzRSAPSSAlgorithm.signc              	   C   sH   z|  ||tjt |  ¡ ¡| jjd�|  ¡ ¡ W dS  ty#   Y dS w )NrÂ   TF)rT   r   rÅ   rÆ   rf   rÇ   r   rR   rC   rC   rD   rT     s   þù	ÿzRSAPSSAlgorithm.verifyN)rZ   r[   r\   r]   rQ   rT   rC   rC   rC   rD   r@     s    
r@   c                   @   sH   e Zd ZdZdd„ Zdd„ Zdd„ Zdd	„ Zed
d„ ƒZ	edd„ ƒZ
dS )rA   zŽ
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        c                 K   s   d S rd   rC   )rK   ÚkwargsrC   rC   rD   rh   1  rb   zOKPAlgorithm.__init__c                 C   sŠ   t |ttfƒr6t |tƒr| d¡}| d¡}d|v rt|ƒ}nd|v r*t|d d�}n|dd… dkr6t|ƒ}t |tt	t
tfƒsCtdƒ‚|S )	Núutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATErˆ   r   é   zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)rr   rŠ   r{   Úencodery   r%   r$   r&   r   r   r   r   r   )rK   rL   Ústr_keyrC   rC   rD   rM   4  s$   




þÿzOKPAlgorithm.prepare_keyc                 C   s$   t |ƒturt|dƒn|}| |¡S )aR  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` iinstance
            :return bytes signature: The signature, as bytes
            rÉ   )ÚtyperŠ   rQ   rO   rC   rC   rD   rQ   L  s   
zOKPAlgorithm.signc                 C   sv   z.t |ƒturt|dƒn|}t |ƒturt|dƒn|}t|ttfƒr&| ¡ }| ||¡ W dS  tjj	y:   Y dS w )aÄ  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            rÉ   TF)
rÍ   rŠ   rr   r   r   r¦   rT   ÚcryptographyÚ
exceptionsr   rR   rC   rC   rD   rT   W  s   
ÿzOKPAlgorithm.verifyc                 C   sÐ   t | ttfƒr(| jtjtjd�}t | tƒrdnd}t t	t
|ƒƒ ¡ d|dœ¡S t | ttfƒrd| jtjtjtƒ d�}|  ¡ jtjtjd�}t | tƒrLdnd}t t	t
|ƒƒ ¡ t	t
|ƒƒ ¡ d|dœ¡S tdƒ‚)	N)ÚencodingÚformatÚEd25519ÚEd448ÚOKP)r¯   rk   r±   )rÐ   rÑ   Úencryption_algorithm)r¯   r‘   rk   r±   r—   )rr   r   r   Úpublic_bytesr    ÚRawr#   ro   rx   r   r   ry   r   r   Úprivate_bytesr"   r!   r¦   r   )rL   r¯   r±   r‘   rC   rC   rD   rW   l  s>   þýÿýþüÿ	zOKPAlgorithm.to_jwkc              
   C   s  zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty"   tdƒ‚w | d¡dkr.tdƒ‚| d¡}|dkrB|dkrBtd|› �ƒ‚d	|vrJtd
ƒ‚t| d	¡ƒ}z+d|vrf|dkr`t	 
|¡W S t 
|¡W S t| d¡ƒ}|dkrwt |¡W S t |¡W S  ty� } ztdƒ|‚d }~ww )Nrz   rk   rÔ   zNot an Octet Key Pairr±   rÒ   rÓ   r¶   r¯   zOKP should have "x" parameterr‘   zInvalid key parameter)rr   r{   ro   rp   rs   rq   r   r|   r   r   Úfrom_public_bytesr   r   Úfrom_private_bytesr   )rX   r}   r¬   r¯   r‘   ÚerrrC   rC   rD   rY   ”  s>   

€ÿ

€ÿzOKPAlgorithm.from_jwkN)rZ   r[   r\   r]   rh   rM   rQ   rT   r^   rW   rY   rC   rC   rC   rD   rA   *  s    
'rA   )<rƒ   r~   ro   rÏ   r   Úutilsr   r   r   r   r	   r
   r   r   r   Úcryptography.exceptionsrÎ   r   Úcryptography.hazmat.primitivesr   Ú)cryptography.hazmat.primitives.asymmetricr   r   Ú,cryptography.hazmat.primitives.asymmetric.ecr   r   Ú/cryptography.hazmat.primitives.asymmetric.ed448r   r   Ú1cryptography.hazmat.primitives.asymmetric.ed25519r   r   Ú-cryptography.hazmat.primitives.asymmetric.rsar   r   r   r   r   r   r   r   Ú,cryptography.hazmat.primitives.serializationr    r!   r"   r#   r$   r%   r&   r<   ÚModuleNotFoundErrorÚrequires_cryptographyrE   rF   r7   r8   r>   r?   r@   rA   rC   rC   rC   rD   Ú<module>   sB    ,($

ÿ")O x � �Ï