U e ee e1j8dddZ?eddGdd d Z@e*jAe*jBe*jCe*jDe*jEd!ZFe*jGe*jHe*jIe*jJe*jKd!ZLe'jMe'jNe'jOe'jPe'jQd!ZRe*jSe*jTe*jUe*jVe*jWd!ZXe*jYe*jZe*j[e*j\e*j]d!Z^e*j_e*jNe*jOe*jPe*jQd!Z`ejae9e;e@d"d#dZbd2e9e e>e e9e eee9ecdfe-d$d%dZdd3e;e e9e eed&d'd(Zfd4e-e e9e eed)d*d+Zge9e;d,d-d.ZhGd/dde&ZiGd0ddZjdS)5z This module provides PKCS#11 integration for pyHanko, by providing a wrapper for `python-pkcs11 `_ that can be seamlessly plugged into a :class:`~.signers.PdfSigner`. N) dataclass)AnyCallableDictListOptionalSetTupleUnion)algoscorex509)RSASSAPSSParams)hashes)CertificateStore)PKCS11PinEntryModePKCS11SignatureConfig TokenCriteria)coalesce) SigningErrorget_pyca_cryptography_hash)Signer)MGFPROTECTED_AUTH Attribute Mechanism ObjectClass PKCS11ErrorSession)lib)typeszpyhanko.sign.pkcs11 requires pyHanko to be installed with the [pkcs11] option. You can install missing dependencies by running "pip install 'pyHanko[pkcs11]'". PKCS11Signeropen_pkcs11_sessionPKCS11SigningContext find_tokenselect_pkcs11_signing_params)criteriatokenreturncCsd|dkr gSg}|jdk r6|j|jkr6|d|jf|jdk r`|j|jkr`|d|jf|S)Nlabelserial)r)appendr*hex)r&r'Z err_itemsr-7/tmp/pip-unpacked-wheel-w101_d3s/pyhanko/sign/pkcs11.pycriteria_mismatches=sr/cCs t|| SN)r/)r&r'r-r-r.criteria_satisfied_byLsr1)slotsslot_notoken_criteriar(c Cs|dkr0|dkr0t|dkr(|dStd|dkr~|D]>}z |}t||r^|WSWq<tk rxYq~szfind_token..zToken in slot z does not satisfy criteria; .)len get_tokenrr1r/join)r2r3r4Zslotr'errorserr_strr-r-r.r$Rs:       T)frozenc@sNeZdZUdZeeefed<ee e ge fed<ee e ge fed<dS)PKCS11SignatureOperationSpeczq Internal helper class to describe how to invoke a signature operation on a key in a PKCS #11 token. sign_kwargspre_sign_transformpost_sign_transformN) __name__ __module__ __qualname____doc__rstrr__annotations__rrbytesr-r-r-r.rBs rB)sha1sha224sha256sha384sha512)signature_mechanismdigest_algorithmuse_raw_mechanismr(cCsddlm}ddlm}d}d}i}z |j}Wntk rL|dj}YnX|dkr|rrtj|d<t |dd }n t ||d<nZ|d kr|rtj |d<t |d d }n t ||d<|}n"|d kr|rtj |d<t |d d }n t||d<|}n|d krp|rtd|d} || ddjks(tt||d<t|} | dddj} t| } | dj} | | | f|d<nl|dkr|rtdtj|d<nH|dkr|rtdtj|d<tdd dd|d<ntd|dt|||dS)aZ Internal helper function to set up a PKCS #11 signing operation. :param signature_mechanism: The signature mechanism to use (as an ASN.1 value) :param digest_algorithm: The digest algorithm to use :param use_raw_mechanism: Whether to attempt to use the raw mechanism on pre-hashed data. :return: r)encode_dsa_signature)encode_ecdsa_signatureN algorithmZrsassa_pkcs1v15Z mechanismT)wrap_digest_infodsaFZecdsaZ rsassa_pssz$RSASSA-PSS not available in raw mode parametershash_algorithmZmask_gen_algorithm salt_lengthZmechanism_paramed25519z!Ed25519 not available in raw modeed448zEd448 not available in raw modez@?LPzSignature algorithm 'z' is not supported.)rCrDrE)Zpkcs11.util.dsarUZpkcs11.util.ecrVsignature_algo ValueErrorZnativerZRSA_PKCS _hash_fully RSA_MECH_MAPDSA DSA_MECH_MAPECDSAECDSA_MECH_MAPNotImplementedErrorAssertionErrorRSASSA_PSS_MECH_MAPDIGEST_MECH_MAP MGF_MECH_MAPZEDDSAstructpackrB)rRrSrTrUrVrDrEkwargsr_paramsZpss_digest_paramZmgf_valZ pss_mgf_paramZ pss_salt_lenr-r-r.r%s                 ) lib_locationr3 token_labelr4user_pinr(c Cst|}|dkr.|dk r.tdtt|d}|}t|||d}|dkrht|dk rbd|dndi}|dk r|||d<|jf|S) a Open a PKCS#11 session :param lib_location: Path to the PKCS#11 module. :param slot_no: Slot number to use. If not specified, the first slot containing a token labelled ``token_label`` will be used. :param token_label: .. deprecated:: 0.14.0 Use ``token_criteria`` instead. Label of the token to use. If ``None``, there is no constraint. :param token_criteria: Criteria that the token should match. :param user_pin: User PIN to use, or :attr:`.PROTECTED_AUTH`. If ``None``, authentication is skipped. .. note:: Some PKCS#11 implementations do not require PIN when the token is opened, but will prompt for it out-of-band when signing. Whether :attr:`.PROTECTED_AUTH` or ``None`` is used in this case depends on the implementation. :return: An open PKCS#11 session object. Nz9'token_label' is deprecated, use 'token_criteria' instead)r))r3r4zNo token matching criteria z foundzNo token foundrr) p11_libwarningswarnDeprecationWarningrZ get_slotsr$ropen) rpr3rqr4rrrr2r'rnr-r-r.r"@s&"  no_resultsr)cert_idcCs~g}|dk r|d|d|dk rD|dt|dd|rXdd|nd}|rnd|d }n d |d }|S) Nzlabel ''zID 'asciiz with r6zCould not find certr;zFound more than one cert)r+binasciihexlifydecoder>)ryr)rzZ info_strsZ qualifiererrr-r-r._format_pull_err_msg{s r)pkcs11_sessionr)rzcCstjtji}|dk r||tj<|dk r0||tj<||}t|}t|dkrh|d}t j |tj St | ||d}t|dS)Nr5rrx)rCLASSr CERTIFICATELABELZID get_objectslistr<r CertificateloadVALUErr)rr)rzZ query_paramsqresultscert_objrr-r-r. _pull_certs      r)rSrXcs$tttdfdd }|S)N)datar(csJt}|||}rBttd|d S|SdS)N)rWrZ)rSdigest) rHashupdatefinalizer Z DigestInfolowerr ZNulldump)rhrrSZmd_specrXr-r._hs   z_hash_fully.._h)rrL)rSrXrr-rr.rasrac seZdZdZdeeeeejeeee ee ee j dfdd Z d d Z eed d d ZeddZeedddZde ee dddZeejd ddZddZddZddZZS) r!a Signer implementation for PKCS11 devices. :param pkcs11_session: The PKCS11 session object to use. :param cert_label: The label of the certificate that will be used for signing, to be pulled from the PKCS#11 token. :param cert_id: ID of the certificate object that will be used for signing, to be pulled from the PKCS#11 token. :param signing_cert: The signer's certificate. If the signer's certificate is provided via this parameter, the ``cert_label`` and ``cert_id`` parameters will not be used to retrieve the signer's certificate. :param ca_chain: Set of other relevant certificates (as :class:`.asn1crypto.x509.Certificate` objects). :param key_label: The label of the key that will be used for signing. Defaults to the value of ``cert_label`` if left unspecified and ``key_id`` is also unspecified. .. note:: At least one of ``key_id``, ``key_label`` and ``cert_label`` must be supplied. :param key_id: ID of the private key object (optional). :param other_certs_to_pull: List labels of other certificates to pull from the PKCS#11 device. Defaults to the empty tuple. If ``None``, pull *all* certificates. :param bulk_fetch: Boolean indicating the fetching strategy. If ``True``, fetch all certs and filter the unneeded ones. If ``False``, fetch the requested certs one by one. Default value is ``True``, unless ``other_certs_to_pull`` has one or fewer elements, in which case it is always treated as ``False``. :param use_raw_mechanism: Use the 'raw' equivalent of the selected signature mechanism. This is useful when working with tokens that do not support a hash-then-sign mode of operation. .. note:: This functionality is only available for ECDSA at this time. Support for other signature schemes will be added on an as-needed basis. NFTr-)r cert_label signing_cert key_labelkey_idrzrRcst|| s |nd|_t| |s | nd|_t| |s4| nd|_t|| sH|nd|_||_||_d|_|dk r~t|dkr~d|_ n| |_ | |_ d|_ d|_ d|_ tj|||| d|dk r|j||dk r|j|dS)z- Initialise a PKCS11 signer. NFr5) prefer_pss embed_rootsrrR)rrrrzrr other_certs_other_certs_loadedr< bulk_fetchrT _key_handle_loaded_PKCS11Signer__loading_eventsuper__init___cert_registryregister_multipleregister)selfrrrca_chainrrrother_certs_to_pullrrrzrTrR __class__r-r.rs6  zPKCS11Signer.__init__cCs&|js |}|j|d|_|jS)NT)r_load_other_certsrr)rcertsr-r-r._init_cert_registry s  z PKCS11Signer._init_cert_registryr(cCs|Sr0)rrr-r-r. cert_registry)szPKCS11Signer.cert_registrycCs||jSr0) _load_objects _signing_certrr-r-r.r/szPKCS11Signer.signing_cert)rSr(cCs|}t||||jdS)N)rT)rr%Z"get_signature_mechanism_for_digestrT)rrSr-r-r._select_pkcs11_signing_params4s z*PKCS11Signer._select_pkcs11_signing_params)rrSr(csp|rdS|IdHddlm}|j||jdk rFfdd}t}|d|IdHS)Ns00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000r) SignMixincs(jfj}jdk r$|}|Sr0)signrCrE) signaturerkhspecr-r._perform_signatureNs  z7PKCS11Signer.async_sign_raw.._perform_signature) ensure_objects_loadedpkcs11rrrrDasyncioget_running_looprun_in_executor)rrrSdry_runrrloopr-rr.async_sign_raw>s    zPKCS11Signer.async_sign_rawcCs t|Sr0)set_PKCS11Signer__pullrr-r-r.rWszPKCS11Signer._load_other_certsccs|j}|dk rt|dkrdS|dks,|jr|jtjtji}t d|D]H}|tj }|dksl||krNd|d}t |t j |tjVqNn.|D](}d|d}t |t|j|VqdS)Nrz.Pulling all certificates from PKCS#11 token...zFound certificate with label 'z ' on token.z Pulling certificate with label 'z' from PKCS#11 token...)rr<rrrrrrrloggerdebugrr rrrr)rZother_cert_labelsrrr)msgr-r-r.Z__pullZs&       zPKCS11Signer.__pullcs\|jr dS|jdkrHt|_}t}|d|jIdH|n|jIdHdS)a Async method that, when awaited, ensures that objects (relevant certificates, key handles, ...) are loaded. This coroutine is guaranteed to be called & awaited in :meth:`sign_raw`, but some property implementations may cause object loading to be triggered synchronously (for backwards compatibility reasons). This blocks the event loop the first time it happens. To avoid this behaviour, asynchronous code should ideally perform `await signer.ensure_objects_loaded()` after instantiating the signer. .. note:: The asynchronous context manager on :class:`PKCS11SigningContext` takes care of that automatically. N) rrrEventrrrrwait)reventrr-r-r.r}s  z"PKCS11Signer.ensure_objects_loadedcCsZ|jr dS||jdkr2t|j|j|jd|_|jjtj |j |j d}||_ d|_dS)N)r)rz)r)idT) rrrrrrrzget_keyrZ PRIVATE_KEYrrr)rrr-r-r.rs  zPKCS11Signer._load_objects) NNNNFTr-TNNFN)F)rFrGrHrIrrrJr rrLr SignedDigestAlgorithmrrpropertyrrrrBrrrrrrr __classcell__r-r-rr.r!sP3/    #c@s\eZdZdZdeeedddZddZe dd d Z d d Z d dZ ddZ ddZdS)r#z+Context manager for PKCS#11 configurations.N)configrrcCs||_d|_||_dSr0)r_session _user_pin)rrrrr-r-r.rszPKCS11SigningContext.__init__cCs<|jp |jj}|dk r t|}n|jjtjkr4t}nd}|Sr0)rrrrrJZ prompt_pinrZDEFERr)rpinr-r-r. _handle_pins z PKCS11SigningContext._handle_pinrcCs|j}|}z t|j|j|j|d|_}WnHtjk rv}z(t d|jdt |j d||W5d}~XYnXt ||j |j|j|j|j|j|j|j|j|j|jd S)N)r3r4rrz'PKCS#11 error while opening session to z: [z] ) rrrrTrrrrzrrR)rrr" module_pathr3r4rrrrtyperFr!rrrrZ raw_mechanismrrrrzZsigning_certificaterR)rrrsessionexr-r-r. _instantiates:z!PKCS11SigningContext._instantiatecCs|Sr0)rrr-r-r. __enter__szPKCS11SigningContext.__enter__cs.t}|d|jIdH}|IdH|Sr0)rrrrr)rrZsignerr-r-r. __aenter__szPKCS11SigningContext.__aenter__cCs|jdSr0rcloserexc_typeexc_valexc_tbr-r-r.__exit__szPKCS11SigningContext.__exit__cs|jdSr0rrr-r-r. __aexit__szPKCS11SigningContext.__aexit__)N)rFrGrHrIrrrJrrr!rrrrrr-r-r-r.r#s  )NN)NNNN)NN)NN)krIrr~loggingrlrt dataclassesrtypingrrrrrrr r rZ asn1cryptor r r Zasn1crypto.algosrZcryptography.hazmat.primitivesrZpyhanko_certvalidator.registryrZpyhanko.config.pkcs11rrrZpyhanko.pdf_utils.miscrZpyhanko.sign.generalrrZpyhanko.sign.signersrrrrrrrrrrsr Z p11_types ImportErrore__all__ getLoggerrFrTokenrJr/boolr1ZSlotintr$rBZ SHA1_RSA_PKCSZSHA224_RSA_PKCSZSHA256_RSA_PKCSZSHA384_RSA_PKCSZSHA512_RSA_PKCSrbZSHA1_RSA_PKCS_PSSZSHA224_RSA_PKCS_PSSZSHA256_RSA_PKCS_PSSZSHA384_RSA_PKCS_PSSZSHA512_RSA_PKCS_PSSriSHA1SHA224SHA256SHA384SHA512rkZ ECDSA_SHA1Z ECDSA_SHA224Z ECDSA_SHA256Z ECDSA_SHA384Z ECDSA_SHA512rfZDSA_SHA1Z DSA_SHA224Z DSA_SHA256Z DSA_SHA384Z DSA_SHA512rdZSHA_1rjrr%objectr"rLrrrar!r#r-r-r-r.s (     $     6       n  =  n