3
ãdexW  ã               @   s¼  d dl Z d dlZd dlZddlmZ ddlmZmZmZm	Z	m
Z
mZmZmZmZ y´d dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZmZ d d
lmZmZ d dl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 dZ1W n e2k
�r   dZ1Y nX ddddddddddddhZ3dd„ Z4G dd„ dƒZ5G dd „ d e5ƒZ6G d!d"„ d"e5ƒZ7e1�r¸G d#d$„ d$e5ƒZ8G d%d&„ d&e5ƒZ9G d'd(„ d(e8ƒZ:G d)d*„ d*e5ƒZ;dS )+é    Né   )ÚInvalidKeyError)	Úbase64url_decodeÚbase64url_encodeÚder_to_raw_signatureÚforce_bytesÚfrom_base64url_uintÚis_pem_formatÚ
is_ssh_keyÚraw_to_der_signatureÚto_base64url_uint)ÚInvalidSignature)Úhashes)ÚecÚpadding)ÚEllipticCurvePrivateKeyÚEllipticCurvePublicKey)ÚEd448PrivateKeyÚEd448PublicKey)ÚEd25519PrivateKeyÚEd25519PublicKey)ÚRSAPrivateKeyÚRSAPrivateNumbersÚRSAPublicKeyÚRSAPublicNumbersÚrsa_crt_dmp1Úrsa_crt_dmq1Úrsa_crt_iqmpÚrsa_recover_prime_factors)ÚEncodingÚNoEncryptionÚPrivateFormatÚPublicFormatÚload_pem_private_keyÚload_pem_public_keyÚload_ssh_public_keyTFÚRS256ÚRS384ÚRS512ÚES256ÚES256KÚES384ÚES521ÚES512ÚPS256ÚPS384ÚPS512ÚEdDSAc              C   s’   t ƒ ttjƒttjƒttjƒdœ} trŽ| jttjƒttjƒttjƒttjƒttjƒttjƒttjƒttjƒt	t	jƒt	t	jƒt	t	jƒt
ƒ dœƒ | S )zE
    Returns the algorithms that are implemented by the library.
    )ÚnoneZHS256ZHS384ZHS512)r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   )ÚNoneAlgorithmÚHMACAlgorithmÚSHA256ÚSHA384ÚSHA512Ú
has_cryptoÚupdateÚRSAAlgorithmÚECAlgorithmÚRSAPSSAlgorithmÚOKPAlgorithm)Zdefault_algorithms© r>   úE/var/www/agendate/envp3/lib/python3.6/site-packages/jwt/algorithms.pyÚget_default_algorithmsK   s(    r@   c               @   s@   e Zd ZdZdd„ Zdd„ Zdd„ Zedd	„ ƒZed
d„ ƒZ	dS )Ú	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    c             C   s   t ‚dS )zš
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        N)ÚNotImplementedError)ÚselfÚkeyr>   r>   r?   Úprepare_keyr   s    zAlgorithm.prepare_keyc             C   s   t ‚dS )zn
        Returns a digital signature for the specified message
        using the specified key value.
        N)rB   )rC   ÚmsgrD   r>   r>   r?   Úsigny   s    zAlgorithm.signc             C   s   t ‚dS )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        N)rB   )rC   rF   rD   Úsigr>   r>   r?   Úverify€   s    zAlgorithm.verifyc             C   s   t ‚dS )z7
        Serializes a given RSA key into a JWK
        N)rB   )Úkey_objr>   r>   r?   Úto_jwk‡   s    zAlgorithm.to_jwkc             C   s   t ‚dS )zb
        Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
        N)rB   )Újwkr>   r>   r?   Úfrom_jwkŽ   s    zAlgorithm.from_jwkN)
Ú__name__Ú
__module__Ú__qualname__Ú__doc__rE   rG   rI   ÚstaticmethodrK   rM   r>   r>   r>   r?   rA   m   s   rA   c               @   s(   e Zd ZdZdd„ Zdd„ Zdd„ ZdS )	r3   zZ
    Placeholder for use when no signing or verification
    operations are required.
    c             C   s    |dkrd }|d k	rt dƒ‚|S )NÚ z*When alg = "none", key value must be None.)r   )rC   rD   r>   r>   r?   rE   œ   s
    zNoneAlgorithm.prepare_keyc             C   s   dS )Nó    r>   )rC   rF   rD   r>   r>   r?   rG   ¥   s    zNoneAlgorithm.signc             C   s   dS )NFr>   )rC   rF   rD   rH   r>   r>   r?   rI   ¨   s    zNoneAlgorithm.verifyN)rN   rO   rP   rQ   rE   rG   rI   r>   r>   r>   r?   r3   –   s   	r3   c               @   sZ   e Zd ZdZejZejZej	Z
dd„ Zdd„ Zedd„ ƒZedd	„ ƒZd
d„ Zdd„ ZdS )r4   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c             C   s
   || _ d S )N)Úhash_alg)rC   rU   r>   r>   r?   Ú__init__¶   s    zHMACAlgorithm.__init__c             C   s$   t |ƒ}t|ƒst|ƒr tdƒ‚|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   r	   r
   r   )rC   rD   r>   r>   r?   rE   ¹   s
    zHMACAlgorithm.prepare_keyc             C   s   t jtt| ƒƒjƒ ddœƒS )NÚoct)ÚkÚkty)ÚjsonÚdumpsr   r   Údecode)rJ   r>   r>   r?   rK   Ä   s    zHMACAlgorithm.to_jwkc             C   sn   y.t | tƒrtj| ƒ}nt | tƒr(| }nt‚W n tk
rJ   tdƒ‚Y nX |jdƒdkrbtdƒ‚t|d ƒS )NzKey is not valid JSONrY   rW   zNot an HMAC keyrX   )	Ú
isinstanceÚstrrZ   ÚloadsÚdictÚ
ValueErrorr   Úgetr   )rL   Úobjr>   r>   r?   rM   Í   s    

zHMACAlgorithm.from_jwkc             C   s   t j||| jƒjƒ S )N)ÚhmacÚnewrU   Údigest)rC   rF   rD   r>   r>   r?   rG   Þ   s    zHMACAlgorithm.signc             C   s   t j|| j||ƒƒS )N)rd   Úcompare_digestrG   )rC   rF   rD   rH   r>   r>   r?   rI   á   s    zHMACAlgorithm.verifyN)rN   rO   rP   rQ   ÚhashlibÚsha256r5   Úsha384r6   Úsha512r7   rV   rE   rR   rK   rM   rG   rI   r>   r>   r>   r?   r4   ¬   s   	r4   c               @   sZ   e Zd ZdZejZejZejZdd„ Zdd„ Z	e
dd„ ƒZe
dd	„ ƒZd
d„ Zdd„ ZdS )r:   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        c             C   s
   || _ d S )N)rU   )rC   rU   r>   r>   r?   rV   ñ   s    zRSAAlgorithm.__init__c             C   sv   t |ttfƒr|S t |ttfƒs(tdƒ‚t|ƒ}y$|jdƒrFt|ƒ}nt	|d d�}W n t
k
rp   t|ƒ}Y nX |S )NzExpecting a PEM-formatted key.s   ssh-rsa)Úpassword)r]   r   r   Úbytesr^   Ú	TypeErrorr   Ú
startswithr%   r#   ra   r$   )rC   rD   r>   r>   r?   rE   ô   s    

zRSAAlgorithm.prepare_keyc             C   sÖ   d }t | dd ƒrŠ| jƒ }ddgt|jjƒjƒ t|jjƒjƒ t|jƒjƒ t|jƒjƒ t|j	ƒjƒ t|j
ƒjƒ t|jƒjƒ t|jƒjƒ dœ
}nBt | dd ƒrÄ| jƒ }ddgt|jƒjƒ t|jƒjƒ dœ}ntdƒ‚tj|ƒS )NÚprivate_numbersÚRSArG   )
rY   Úkey_opsÚnÚeÚdÚpÚqÚdpÚdqÚqirI   )rY   rr   rs   rt   zNot a public or private key)Úgetattrrp   r   Úpublic_numbersrs   r\   rt   ru   rv   rw   Údmp1Údmq1Úiqmpr   rZ   r[   )rJ   rc   Únumbersr>   r>   r?   rK     s*    zRSAAlgorithm.to_jwkc       	         sÄ  y.t | tƒrtj| ƒ‰ nt | tƒr(| ‰ nt‚W n tk
rJ   tdƒ‚Y nX ˆ jdƒdkrbtdƒ‚dˆ koxdˆ koxdˆ k�r‚dˆ krŒtd	ƒ‚d
ddddg}‡ fdd„|D ƒ}t|ƒ}|rÊt	|ƒ rÊtdƒ‚t
tˆ d ƒtˆ d ƒƒ}|�r2ttˆ d ƒtˆ d
 ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒ|d�}nHtˆ d ƒ}t|j||jƒ\}}t|||t||ƒt||ƒt||ƒ|d�}|jƒ S dˆ k�r¸dˆ k�r¸t
tˆ d ƒtˆ d ƒƒ}|jƒ S tdƒ‚d S )NzKey is not valid JSONrY   rq   zNot an RSA keyru   rt   rs   Zothz5Unsupported RSA private key: > 2 primes not supportedrv   rw   rx   ry   rz   c                s   g | ]}|ˆ k‘qS r>   r>   )Ú.0Úprop)rc   r>   r?   ú
<listcomp>A  s    z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides d)ru   rv   rw   r}   r~   r   r|   zNot a public or private key)r]   r^   rZ   r_   r`   ra   r   rb   ÚanyÚallr   r   r   r   rs   rt   r   r   r   Úprivate_keyÚ
public_key)	rL   Zother_propsZprops_foundZany_props_foundr|   r€   ru   rv   rw   r>   )rc   r?   rM   *  sd    










zRSAAlgorithm.from_jwkc             C   s   |j |tjƒ | jƒ ƒS )N)rG   r   ÚPKCS1v15rU   )rC   rF   rD   r>   r>   r?   rG   t  s    zRSAAlgorithm.signc             C   s6   y|j ||tjƒ | jƒ ƒ dS  tk
r0   dS X d S )NTF)rI   r   rˆ   rU   r   )rC   rF   rD   rH   r>   r>   r?   rI   w  s
    zRSAAlgorithm.verifyN)rN   rO   rP   rQ   r   r5   r6   r7   rV   rE   rR   rK   rM   rG   rI   r>   r>   r>   r?   r:   ç   s   $Jr:   c               @   sN   e Zd ZdZejZejZejZdd„ Zdd„ Z	dd„ Z
dd	„ Zed
d„ ƒZdS )r;   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        c             C   s
   || _ d S )N)rU   )rC   rU   r>   r>   r?   rV   ˆ  s    zECAlgorithm.__init__c             C   sŒ   t |ttfƒr|S t |ttfƒs(tdƒ‚t|ƒ}y |jdƒrFt|ƒ}nt	|ƒ}W n  t
k
rp   t|d d�}Y nX t |ttfƒsˆtdƒ‚|S )NzExpecting a PEM-formatted key.s   ecdsa-sha2-)rl   zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for ECDSA algorithms)r]   r   r   rm   r^   rn   r   ro   r%   r$   ra   r#   r   )rC   rD   r>   r>   r?   rE   ‹  s    

zECAlgorithm.prepare_keyc             C   s"   |j |tj| jƒ ƒƒ}t||jƒS )N)rG   r   ÚECDSArU   r   Úcurve)rC   rF   rD   Úder_sigr>   r>   r?   rG   §  s    zECAlgorithm.signc             C   sn   yt ||jƒ}W n tk
r$   dS X y.t|tƒr:|jƒ }|j||tj| j	ƒ ƒƒ dS  t
k
rh   dS X d S )NFT)r   rŠ   ra   r]   r   r‡   rI   r   r‰   rU   r   )rC   rF   rD   rH   r‹   r>   r>   r?   rI   ¬  s    
zECAlgorithm.verifyc             C   s0  y.t | tƒrtj| ƒ}nt | tƒr(| }nt‚W n tk
rJ   tdƒ‚Y nX |jdƒdkrbtdƒ‚d|ksrd|krztdƒ‚t|jdƒƒ}t|jdƒƒ}|jdƒ}|dkrÜt	|ƒt	|ƒ  koÂd	kn  rÒt
jƒ }ntd
ƒ‚nÔ|dk�rt	|ƒt	|ƒ  k�odkn  �rt
jƒ }ntdƒ‚n’|dk�r`t	|ƒt	|ƒ  k�oDdkn  �rVt
jƒ }ntdƒ‚nP|dk�r¢t	|ƒt	|ƒ  k�o†d	kn  �r˜t
jƒ }ntdƒ‚ntd|› �ƒ‚t
jtj|dd�tj|dd�|d�}d|k�ræ|jƒ S t|jdƒƒ}t	|ƒt	|ƒk�rtdt	|ƒ|ƒ‚t
jtj|dd�|ƒjƒ S )NzKey is not valid JSONrY   ZECzNot an Elliptic curve keyÚxÚyÚcrvzP-256é    z)Coords should be 32 bytes for curve P-256zP-384é0   z)Coords should be 48 bytes for curve P-384zP-521éB   z)Coords should be 66 bytes for curve P-521Z	secp256k1z-Coords should be 32 bytes for curve secp256k1zInvalid curve: Úbig)Ú	byteorder)rŒ   r�   rŠ   ru   z!D should be {} bytes for curve {})r]   r^   rZ   r_   r`   ra   r   rb   r   Úlenr   Z	SECP256R1Z	SECP384R1Z	SECP521R1Z	SECP256K1ZEllipticCurvePublicNumbersÚintÚ
from_bytesr‡   ZEllipticCurvePrivateNumbersr†   )rL   rc   rŒ   r�   rŠ   Z	curve_objr|   ru   r>   r>   r?   rM   º  sZ    


 


$


$


$

zECAlgorithm.from_jwkN)rN   rO   rP   rQ   r   r5   r6   r7   rV   rE   rG   rI   rR   rM   r>   r>   r>   r?   r;   ~  s   r;   c               @   s    e Zd ZdZdd„ Zdd„ ZdS )r<   zA
        Performs a signature using RSASSA-PSS with MGF1
        c             C   s*   |j |tjtj| jƒ ƒ| jjd�| jƒ ƒS )N)ÚmgfÚsalt_length)rG   r   ÚPSSÚMGF1rU   Údigest_size)rC   rF   rD   r>   r>   r?   rG     s    
zRSAPSSAlgorithm.signc             C   sJ   y0|j ||tjtj| jƒ ƒ| jjd�| jƒ ƒ dS  tk
rD   dS X d S )N)r—   r˜   TF)rI   r   r™   rš   rU   r›   r   )rC   rF   rD   rH   r>   r>   r?   rI     s    

zRSAPSSAlgorithm.verifyN)rN   rO   rP   rQ   rG   rI   r>   r>   r>   r?   r<   ü  s   
r<   c               @   sH   e Zd ZdZdd„ Zdd„ Zdd„ Zdd	„ Zed
d„ ƒZ	edd„ ƒZ
dS )r=   zŽ
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        c             K   s   d S )Nr>   )rC   Úkwargsr>   r>   r?   rV   !  s    zOKPAlgorithm.__init__c             C   sŠ   t |ttfƒrlt |tƒr"|jdƒ}|jdƒ}d|kr>t|ƒ}n.d|krTt|d d�}n|dd… dkrlt|ƒ}t |tt	t
tfƒs†tdƒ‚|S )	Nzutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATE)rl   r   é   zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)r]   rm   r^   Úencoder\   r$   r#   r%   r   r   r   r   r   )rC   rD   Zstr_keyr>   r>   r?   rE   $  s     



zOKPAlgorithm.prepare_keyc             C   s$   t |ƒtk	rt|dƒn|}|j|ƒS )aR  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` iinstance
            :return bytes signature: The signature, as bytes
            zutf-8)Útyperm   rG   )rC   rF   rD   r>   r>   r?   rG   <  s    zOKPAlgorithm.signc             C   sx   yZt |ƒtk	rt|dƒn|}t |ƒtk	r2t|dƒn|}t|ttfƒrL|jƒ }|j||ƒ dS  tjj	k
rr   dS X dS )aÄ  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            zutf-8TFN)
rŸ   rm   r]   r   r   r‡   rI   ÚcryptographyÚ
exceptionsr   )rC   rF   rD   rH   r>   r>   r?   rI   G  s    
zOKPAlgorithm.verifyc             C   sÔ   t | ttfƒrP| jtjtjd�}t | tƒr.dnd}tjt	t
|ƒƒjƒ d|dœƒS t | ttfƒrÈ| jtjtjtƒ d�}| jƒ jtjtjd�}t | tƒr˜dnd}tjt	t
|ƒƒjƒ t	t
|ƒƒjƒ d|dœƒS tdƒ‚d S )	N)ÚencodingÚformatÚEd25519ÚEd448ÚOKP)rŒ   rY   rŽ   )r¢   r£   Zencryption_algorithm)rŒ   ru   rY   rŽ   zNot a public or private key)r]   r   r   Zpublic_bytesr   ZRawr"   rZ   r[   r   r   r\   r   r   Zprivate_bytesr!   r    r‡   r   )rD   rŒ   rŽ   ru   r>   r>   r?   rK   \  s0    




zOKPAlgorithm.to_jwkc             C   s*  y.t | tƒrtj| ƒ}nt | tƒr(| }nt‚W n tk
rJ   tdƒ‚Y nX |jdƒdkrbtdƒ‚|jdƒ}|dkrŠ|dkrŠtd|› �ƒ‚d	|krštd
ƒ‚t|jd	ƒƒ}yNd|krÎ|dkrÄt	j
|ƒS tj
|ƒS t|jdƒƒ}|dkrîtj|ƒS tj|ƒS  tk
�r$ } ztdƒ|‚W Y d d }~X nX d S )NzKey is not valid JSONrY   r¦   zNot an Octet Key PairrŽ   r¤   r¥   zInvalid curve: rŒ   zOKP should have "x" parameterru   zInvalid key parameter)r]   r^   rZ   r_   r`   ra   r   rb   r   r   Zfrom_public_bytesr   r   Zfrom_private_bytesr   )rL   rc   rŠ   rŒ   ru   Úerrr>   r>   r?   rM   „  s6    






zOKPAlgorithm.from_jwkN)rN   rO   rP   rQ   rV   rE   rG   rI   rR   rK   rM   r>   r>   r>   r?   r=     s   (r=   )<rh   rd   rZ   r¡   r   Úutilsr   r   r   r   r   r	   r
   r   r   Zcryptography.exceptionsr    r   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   r   Z,cryptography.hazmat.primitives.asymmetric.ecr   r   Z/cryptography.hazmat.primitives.asymmetric.ed448r   r   Z1cryptography.hazmat.primitives.asymmetric.ed25519r   r   Z-cryptography.hazmat.primitives.asymmetric.rsar   r   r   r   r   r   r   r   Z,cryptography.hazmat.primitives.serializationr   r    r!   r"   r#   r$   r%   r8   ÚModuleNotFoundErrorZrequires_cryptographyr@   rA   r3   r4   r:   r;   r<   r=   r>   r>   r>   r?   Ú<module>   sN   ,(
$

")9 ~