U m?Z?ddl@mAZAddlBmCZCmDZDddlEmFZFddlGmHZHddlImJZJmKZKmLZLmMZMmNZNmOZOmPZPddlQmRZRmSZSmTZTmUZUdddddddd d!d"d#d$d%g ZVeWeXZYed&eNd'ZZej[eej\ej]dfd(d)d%Z^e_d*d+d,Z`ejaej[d-d.d/Zbej[ejce ejde ejed0d1d$Zfd]ejgejaeheie eSe eee_e_fd2d3dZjejke8d4d5d"Zld^ejke eie ee eme e-e e/e eSeHe ehefd6 d7dZnd_ejaeeHee-e e/d8d9d:d;Zoeddddd<ejkeeZe eie ee eme eHeZd=d>dZpeddddd<ejke eie ee eme eHeNd?d@dZpeNdddddfejke eie ee eme eHe eSeZdAdBdZpejge edCdDd!Zqd`ejge_e ejkdFdGd Zrejge eidCdHdZsejge eeidIdJdZtdaejke eeie eSdKdLdZue ejvejaeee e1e ee&e%e$ffdMdNdOZwe ejvejae eej[dPdQd#Zxddddde?jydfeeieejzej{fejke ee ee ee eHe eSeOdRdSdZ|edTdUdVZ}edUdWGdXdYdYe e}Z~ee}e~e}dZd[d\ZdS)bN) dataclass)datetime) IOAny AwaitableDictGenericIterableListOptionalTupleTypeTypeVarUnionoverload)algoscmscoretspx509)InvalidSignature)hashes)CancelableAsyncIteratorValidationContextfind_valid_path)DisallowedAlgorithmError ExpiredErrorInvalidCertificateErrorPathBuildingErrorPathValidationError RevokedErrorStaleRevinfoErrorValidationError)TimeSlideFailure)ValidationPath)PKIXValidationParams)ACValidationResultasync_validate_ac) CMSExtractionErrorCMSStructuralErrorMultivaluedAttributeErrorNonexistentAttributeErrorSignedDataCertscheck_ess_certidextract_certificate_infoextract_signer_infofind_unique_cms_attributeget_pyca_cryptography_hash)misc)lift_iterable_async) AdESFailureAdESIndeterminate)errors)KeyUsageConstraints)CAdESSignerAttributeAssertionsCertifiedAttributesClaimedAttributesRevocationDetailsSignatureStatusStandardCMSSignatureStatusTimestampSignatureStatus)DEFAULT_ALGORITHM_USAGE_POLICYCMSAlgorithmUsagePolicyextract_message_digest validate_rawvalidate_sig_integrityasync_validate_cms_signaturecollect_timing_infovalidate_tst_signed_dataasync_validate_detached_cmscms_basic_validationcompute_signature_tst_digestextract_tst_dataextract_self_reported_tsextract_certs_for_validationcollect_signer_attr_statusvalidate_algorithm_protectionget_signing_cert_attr StatusType)bound) signed_attrsreturncCs$t|dd}|dkr t|dd}|S)a  Retrieve the ``signingCertificate`` or ``signingCertificateV2`` attribute (giving preference to the latter) from a signature's signed attributes. :param signed_attrs: Signed attributes. :return: The value of the attribute, if present, else ``None``. Tv2NF)_grab_signing_cert_attr)rUattrr[G/tmp/pip-unpacked-wheel-w101_d3s/pyhanko/sign/validation/generic_cms.pyrRcs  rWc Cs|rdnd}|rtjntj}zt||}||WStk rLYdStk r}ztj }t j d|d|W5d}~XYnXdS)NZsigning_certificate_v2Zsigning_certificatez3Wrong cardinality for signing certificate attributeZades_subindication) rSigningCertificateV2SigningCertificater0loaddumpr+r*r7NO_SIGNING_CERTIFICATE_FOUNDr9SignatureValidationError)rUrX attr_nameclsvalueeerrr[r[r\rYus  rY)certrUcCsNt|}|dkrdS|dd}t||sJtj}tjd|jjd|ddS)NcertsrzWSigning certificate attribute does not match selected signer's certificate for subject"z".r])rRr-r7rbr9rcsubjectZhuman_friendly)rirUrZZcertidrhr[r[r\_check_signing_certificates  rl)attrsclaimed_digest_algorithm_objclaimed_signature_algorithm_objclaimed_mac_algorithm_objcCszt|d}Wn2tk r&d}Yntk r@tdYnX|dk r|dj}||jkrhtd|dk r|dj}|dkrtdn||jkrtd|dk r|d j}|dkrtd n||jkrtd dS) a Internal API to validate the CMS algorithm protection attribute defined in :rfc:`6211`, if present. :param attrs: A CMS attribute list. :param claimed_digest_algorithm_obj: The claimed (i.e. unprotected) digest algorithm value. :param claimed_signature_algorithm_obj: The claimed (i.e. unprotected) signature algorithm value. :param claimed_mac_algorithm_obj: The claimed (i.e. unprotected) MAC algorithm value. :raises errors.CMSStructuralError: if multiple CMS protection attributes are present :raises errors.CMSAlgorithmProtectionError: if a mismatch is detected Zcms_algorithm_protectionNz4Multiple CMS algorithm protection attributes presentdigest_algorithmzCDigest algorithm does not match CMS algorithm protection attribute.signature_algorithmz|p6t|j}|j} |pFt}|dkrTt }|d} | dj }|ddj }|d}|dj }|dkrt |d}t |}t |}|||}n|dtjk rtjdtjd zt|| |||| d \}}Wn<tk r6}ztjd |jtjd |W5d}~XYnXd}}}}|rzj|j| |dk rrt|g}n |j| }t| ||||d IdH}|j }|j!}|j"p|j#}|j$}Wn8t%k r}zt&j'd |dt(j)}W5d}~XYnX|pi}|dkr dn|j*|d<|j||| ||||||d |S)z Perform basic validation of CMS and PKCS#7 signatures in isolation (i.e. integrity and trust checks). Internal API. Nrrrzrqencap_content_inforcontentzKCMS structural error: detached signatures should not have encapsulated datar])rvrwrxryzCMS structural error: )rpathsrz&Processing error in validation processexc_infovalidation_time) rrZ signing_certrZpkcs7_signature_mechanismZtrust_problem_indicrZrevocation_detailserror_time_horizon)+r/rOr other_certsrCZ lift_policyrZbest_signature_timerrBrsbytesr1rHashupdatefinalizerrr9rcr6rrFr)rcertificate_registryregister_multipler4Z path_builderZasync_build_paths_lazyvalidate_cert_usageerror_subindic revo_detailssuccess_result error_pathr ValueErrorloggererrorr7!CERTIFICATE_CHAIN_GENERAL_FAILUREr{)rrrrrrrrrurrirryrrZ mechanismrecirvrawZmd_specmdrrrg ades_statuspathrrr op_resultr[r[r\rKs              z,CertvalidatorOperationResult[ValidationPath])rirrrrrVcs*tdfdd }t|IdHS)zE Low-level certificate validation routine. Internal API. )rVcs tdIdHS)N)rr)validaterr[rirrrrr[r\_check9s z#validate_cert_usage.._checkN)r$handle_certvalidator_errors)rirrrrrr[rr\r-s  r)rrrr)r status_clsrrrrrVcsdSNr[)rrrrrrr[r[r\rGFs )rrrrrrVcsdSrr[)rrrrrr[r[r\rGRs)rrrrrrrVcs.||}t||||||dIdH}|f|S)a Validate a CMS signature (i.e. a ``SignedData`` object). :param signed_data: The :class:`.asn1crypto.cms.SignedData` object to validate. :param status_cls: Status class to use for the validation result. :param raw_digest: Raw digest, computed from context. :param validation_context: Validation context to validate the signer's certificate. :param status_kwargs: Other keyword arguments to pass to the ``status_class`` when reporting validation results. :param key_usage_settings: A :class:`.KeyUsageConstraints` object specifying which key usages must or must not be present in the signer's certificate. :param algorithm_policy: The algorithm usage policy for the signature validation. .. warning:: This is distinct from the algorithm usage policy used for certificate validation, but the latter will be used as a fallback if this parameter is not specified. It is nonetheless recommended to align both policies unless there is a clear reason to do otherwise. :return: A :class:`.SignatureStatus` object (or an instance of a proper subclass) )rrN)default_usage_constraintsrK)rrrrrrrZeff_key_usage_settingsr[r[r\rG]s' )rurVc Cs:z|d}t|d}|jWSttfk r4YdSXdS)a Extract self-reported timestamp (from the ``signingTime`` attribute) Internal API. :param signer_info: A ``SignerInfo`` value. :return: The value of the ``signingTime`` attribute as a ``datetime``, or ``None``. rUZ signing_timeN)r0rsr+r*)rusastr[r[r\rNs  F)rusignedrVc CsXz8|r|d}t|d}n|d}t|d}|d}|WSttfk rRYdSXdS)a Extract signed data associated with a timestamp token. Internal API. :param signer_info: A ``SignerInfo`` value. :param signed: If ``True``, look for a content timestamp (among the signed attributes), else look for a signature timestamp (among the unsigned attributes). :return: The ``SignedData`` value found, or ``None``. rUZcontent_time_stampZunsigned_attrsZsignature_time_stamp_tokenrN)r0r+r*)rurrZtstZuatst_signed_datar[r[r\rMs  cCsft|}|dkrdS|d}|djd}|ddj}|dj}t|}t|}|||S)a. Compute the digest of the signature according to the message imprint algorithm information in a signature timestamp token. Internal API. :param signer_info: A ``SignerInfo`` value. :return: The computed digest, or ``None`` if there is no signature timestamp. Nrrmessage_imprinthash_algorithmrzr~)rMparsedrsr1rrrr)ruZtst_datarmiZtst_md_algorithmZsignature_bytesZ tst_md_specrr[r[r\rLs   )ruts_validation_contextrc si}t|}|dk r||d<t|dd}|dk rht|}|dk sDtt|||IdH}tf|}||d<t|dd} | dk rt| ||dIdH} tf| } | |d<|S) a Collect and validate timing information in a ``SignerInfo`` value. This includes the ``signingTime`` attribute, content timestamp information and signature timestamp information. :param signer_info: A ``SignerInfo`` value. :param ts_validation_context: The timestamp validation context to validate against. :param raw_digest: The raw external message digest bytes (only relevant for the validation of the content timestamp token, if there is one) Nsigner_reported_dtF)rZtimestamp_validityT)expected_tst_imprintZcontent_timestamp_validity)rNrMrLAssertionErrorrIrA) rurrrrrZtst_signature_digestZtst_validity_kwargsZ tst_validityZcontent_tst_signed_dataZcontent_tst_validity_kwargsZcontent_tst_validityr[r[r\rHs6      )rrrrc sd}|dd}t|tjr"|j}t|tjs>tjdtj d|dj }t }t ||d|i||dIdH}|d d j } || krtd | d |d d|d<|S)a Validate the ``SignedData`` of a time stamp token. :param tst_signed_data: The ``SignedData`` value to validate; must encapsulate a ``TSTInfo`` value. :param validation_context: The validation context to validate against. :param expected_tst_imprint: The expected message imprint value that should be contained in the encapsulated ``TSTInfo``. :param algorithm_policy: The algorithm usage policy for the signature validation. .. warning:: This is distinct from the algorithm usage policy used for certificate validation, but the latter will be used as a fallback if this parameter is not specified. It is nonetheless recommended to align both policies unless there is a clear reason to do otherwise. :return: Keyword arguments for a :class:`.TimeStampSignatureStatus`. Nrrz'SignedData does not encapsulate TSTInfor]Zgen_time timestamp)rrrrrZhashed_messagezTimestamp token imprint is z, but expected r}Fr) isinstancerZParsableOctetStringrrZTSTInfor9rcr6rrsrArrKrwarninghex) rrrrZtst_infoZtst_info_bytesrZ ku_settingsrZ tst_imprintr[r[r\rIs2     )acsrrrVc s|fdd|D}g}g}t|D]L}z||IdHWq&tttfk rp}z||W5d}~XYq&Xq&||fS)Ncsg|]}t|dqS))Z holder_cert)r').0acrrr[r\ csz+process_certified_attrs..)asyncioZ as_completedappendrrr)rrrjobsresultsr9Zjobrgr[rr\process_certified_attrsYs rsd_attr_certificatesrrsd_signed_attrsc szt|d}WnNtk r&d}Yn8tk r\}ztjt|tjd|W5d}~XYnXi}d}d}|dk rN|d} t t | t j s| nd} |d} d} t | t j sdd| D} t | t | k} |dk rt| ||}|IdH\}}|dk rt|}nd}| pt |d t j  }|dk r:|r:td t| |||d |d <|dk rt|||IdH\}}|r~|||r||t||d <||d<|S)NZsigner_attributes_v2r]Zclaimed_attributesr[Zcertified_attributes_v2FcSsg|]}|jdkr|jqS)Z attr_cert)nameZchosen)rrZr[r[r\rs z.collect_signer_attr_status..Zsigned_assertionszCAdES signer attributes with externally certified assertions for which no validation method is available. This may affect signature semantics in unexpected ways.)Z claimed_attrsZcertified_attrsac_validation_errsZunknown_attrs_presentZcades_signer_attrsZac_attrsr)r0r+r*r9rcstrr6rr= from_iterablerrZVoidlenrr<Z from_resultsrrr;extend)rrrrZ signer_attrsrgresultZcades_ac_resultsZcades_ac_errorsZ claimed_asn1ZclaimedZcertified_asn1Zunknown_cert_attrsZ cades_acsZval_jobZ certifiedZ unknown_attrsZ ac_resultsZ ac_errorsr[r[r\rPus        ) input_datarsigner_validation_contextrac_validation_contextrrrVc s|dkr |}t|} | ddj} tt| } t|trF| |n@t|tj tj frl| t|dnt |} t j | || |d| } t| || dIdH}t|}t|| ||||dIdH}t|}|dk r|j|j|t|j|j|| dd IdHtf|S) a .. versionadded: 0.9.0 .. versionchanged: 0.11.0 Added ``ac_validation_context`` param. Validate a detached CMS signature. :param input_data: The input data to sign. This can be either a :class:`bytes` object, a file-like object or a :class:`cms.ContentInfo` / :class:`cms.EncapsulatedContentInfo` object. If a CMS content info object is passed in, the `content` field will be extracted. :param signed_data: The :class:`cms.SignedData` object containing the signature to verify. :param signer_validation_context: Validation context to use to verify the signer certificate's trust. :param ts_validation_context: Validation context to use to verify the TSA certificate's trust, if a timestamp token is present. By default, the same validation context as that of the signer is used. :param ac_validation_context: Validation context to use to validate attribute certificates. If not supplied, no AC validation will be performed. .. note:: :rfc:`5755` requires attribute authority trust roots to be specified explicitly; hence why there's no default. :param algorithm_policy: The algorithm usage policy for the signature validation. .. warning:: This is distinct from the algorithm usage policy used for certificate validation, but the latter will be used as a fallback if this parameter is not specified. It is nonetheless recommended to align both policies unless there is a clear reason to do otherwise. :param key_usage_settings: Key usage parameters for the signer. :param chunk_size: Chunk size to use when consuming input data. :param max_read: Maximal number of bytes to read from the input stream. :return: A description of the signature's status. Nrqrzr)max_read)rr)rrrrrrUr)r/rsrrr1rrrr ContentInfoEncapsulatedContentInfo bytearrayr3Zchunked_digestrrHr@rrKr.rrrrPZattribute_certsr)rrrrrrr chunk_sizerrurqhZtemp_bufZ digest_bytesrrr[r[r\rJsT=      ResultTypeT) covariant)frozenc@s^eZdZUdZeeed<dZeeed<dZ ee ed<dZ ee ed<dZ eeed<dS)CertvalidatorOperationResultzB Internal class to inspect error data from certvalidator. rNrrrr)__name__ __module__ __qualname____doc__r r__annotations__rr>rrrr$rr7r[r[r[r\rHs  r)cororVc sd}d}}zt|IdHdWStk rX}ztj|j|dtj}W5d}~XYn\tk r}ztj|j|dtj}W5d}~XYn$t k r}z tj|j|dtj }|j }W5d}~XYnt k r(}z:tj|j|d|j }|jdkr tj}n tj}|j}W5d}~XYntk r}zf|j }t|j|j}|jrbtj}n:|jrtj}td|j|jd}ntj}td|j|jd}W5d}~XYntk r}ztjd|dtj}W5d}~XYntk r<}z:|j }t|j|j}|js&|jr&tj}ntj}W5d}~XYnxtk rz}z |j }tj|j|dtj}W5d}~XYn:t k r}ztj|j|dtj}W5d}~XYnXtd||||dS) z Internal error handling function that maps certvalidator errors to AdES status indications. :param coro: :return: N)rrF)Z ca_revokedrevocation_daterevocation_reasonTzFailed to build path)rrrrr)!rrrrZ failure_msgr7ZCHAIN_CONSTRAINTS_FAILUREr#ZNO_POEr!Z TRY_LATERZ time_cutoffrZ original_pathZ banned_sinceZCRYPTO_CONSTRAINTS_FAILUREZ!CRYPTO_CONSTRAINTS_FAILURE_NO_POEr Z revocation_dtZis_side_validationrZ is_ee_certZREVOKED_NO_POEr>reasonZREVOKED_CA_NO_POErZNO_CERTIFICATE_CHAIN_FOUNDrZ expired_dtZOUT_OF_BOUNDS_NO_POErr")rZ time_horizonrrrgrr[r[r\rUs    r)NN)NNNNNN)N)F)N)rlogging dataclassesrrtypingrrrrrr r r r r rrrZ asn1cryptorrrrrcryptography.exceptionsrZcryptography.hazmat.primitivesrZpyhanko_certvalidatorrrrZpyhanko_certvalidator.errorsrrrrrr r!r"Z pyhanko_certvalidator.ltv.errorsr#Zpyhanko_certvalidator.pathr$Z!pyhanko_certvalidator.policy_declr%Zpyhanko_certvalidator.validater&r'Zpyhanko.sign.generalr(r)r*r+r,r-r.r/r0r1Z pdf_utilsr3Zpdf_utils.miscr4Z ades.reportr6r7r9settingsr:statusr;r<r=r>r?r@rAutilsrBrCrDrE__all__ getLoggerrrrSZ CMSAttributesr_r^rRboolrY CertificaterlZDigestAlgorithmZSignedDigestAlgorithmZ HmacAlgorithmrQZ SignerInforrrFZ SignedDatarOdictrKrrGrNrMrLrHrIZAttributeCertificateV2rrPZDEFAULT_CHUNK_SIZErrrJrrrr[r[r[r\s  <  (   0    $      K * !     6  " 9 ?   h k