jZ ddlZddlZddlmZddlmZmZmZmZm Z m Z ddl m Z m Z mZddlmZddlmZmZmZddlmZddlmZmZdd lmZd d lmZmZmZmZm Z m!Z!m"Z"d d l#m$Z$m%Z%d d l&m'Z'm(Z(d dl)m*Z*d dl+m,Z,ddl-m.Z.m/Z/ddlm0Z0ddl1m2Z2ddl3m4Z4ddl5m6Z6gdZ7e.ej0dej0ddddde/j8Z9e:gdZ; Gd d!eZ<Gd"d#Z=d$e6d%e>d&ee>fd'Z?d(Z@d)ZAd*ejBd+e jCfd,ZDd+e e jCe>ffd-ZEe;e=fd.e2d/eeFd0e e=fd1ZGGd2d3e$ZHd4ddejIfd5e4d6eFfd7ZJdS)8N)compare_digest)AnyDict FrozenSetOptionalTupleType)algoscmscore)VOID)hasheshmackeywrap)hkdf)genericmisc)get_pyca_cryptography_hash)CMSStructuralErrorMultivaluedAttributeErrorNonexistentAttributeErrorValueErrorWithMessagebyte_range_digestfind_unique_cms_attributesimple_cms_attribute)PdfByteRangeDigestPreparedByteRangeDigest)CMSAlgorithmProtectionErrorDisallowedAlgorithmError)validate_algorithm_protection)extract_contents)DeveloperExtensionDevExtensionMultivalued)pdf_name) PdfFileReader)BasePdfFileWriter)PdfMacIntegrityInfo)ALLOWED_MD_ALGSISO32004PdfMacTokenHandleradd_standalone_macvalidate_pdf_macz/ISO_z/2.0i}z:2024z'https://www.iso.org/standard/45877.htmlF) prefix_name base_versionextension_levelextension_revisionurlcompare_by_level multivalued)sha256sha3_256sha384sha3_384sha512sha3_512shake256ceZdZdS)PdfMacValidationErrorN)__name__ __module__ __qualname__m/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/pdf_utils/crypt/pdfmac.pyr?r?JsDrDr?c deZdZdZejddiZdZede de de fdZ ee fde de d ej d ee fd Zd ed efdZede de d e fdZde d ejfdZded ee ejffdZde dee d ee e ffdZdejde dejde d ej f dZde de d e fdZdd de dee ded ejfd!Zd"ejd e fd#Z d$ejd%e!j"fd&Z#d ej fd'Z$d ej d e%fd(Z&d ej de dee fd)Z'd*S)+r-a: Internal utility class to create and validate PDF MAC tokens. .. warning:: This is a class to simplify local overrides for creating test documents with various defects. Instances of this class should never be created or manipulated directly during regular operation. algorithmr7c"||_||_dSNmac_kek md_algorithm)selfrKrLs rE__init__zPdfMacTokenHandler.__init__\s (rDfile_encryption_keykdf_saltrLcH|||}|||S)NrJ)_derive_mac_kek)clsrOrPrLrKs rE from_key_matzPdfMacTokenHandler.from_key_mat`s/%%&98DDs7>>>>rD auth_data allowed_mdsc|d}|dj}|dkrtd|d}|dj}||vrt|tjd||||S)N mac_algorithmrGr7z:Only HMAC-SHA256 is currently supported for PDF MAC tokensdigest_algorithm)oid_type time_horizon)rOrPrL)nativeNotImplementedErrorr r DigestAlgorithmIdrT) rSrOrPrUrV mac_algo_objmac_algodigest_algo_objmd_algos rEfor_validationz!PdfMacTokenHandler.for_validationgs-6o,F  ,3 x  %L 2;;M1N!+.5 + % %*0!    3     rDinclude_signature_digestreturnctjt|j}|||r|ndd}t |S)NT)document_digestsignature_digestdry_run)rHashrrLfinalizebuild_pdfmac_tokenlendump)rMrd dummy_hash dummy_tokens rEdetermine_token_sizez'PdfMacTokenHandler.determine_token_sizesw[ &t'8 9 9  (** --&+CMZZ.  ;##%%&&&rDc~tjtjd|d}||S)N sPDFMAC)rGlengthsaltinfo)rHKDFrSHA256derive)rSrOrPkdfs rErRz"PdfMacTokenHandler._derive_mac_keksA imoo     zz-...rDmessage_digestctj|jtjd|jid}tjt ddt d|t d|gS)NrG)rXrY content_typepdf_mac_integrity_infor{cms_algorithm_protection)r CMSAlgorithmProtectionmac_algo_identDigestAlgorithmrL CMSAttributesr)rMr{algo_protections rE_format_auth_attrsz%PdfMacTokenHandler._format_auth_attrss4!%!4$'$7 $"34%%     $^5MNN$%5~FF$.    rDric 6|rtd}ntjd}tj|j|}t jd|tj ddit j ddid}|t j d|ifS) Nrs) wrapping_key key_to_wraprrGpdf_mac_wrap_kdf aes256_wrap)version encrypted_keykey_derivation_algorithmkey_encryption_algorithmpwri) bytessecrets token_bytesr aes_key_wraprKr PasswordRecipientInfor KdfAlgorithmKeyEncryptionAlgorithm RecipientInfo)rMrimac_keyrrs rE_get_mac_keying_infoz'PdfMacTokenHandler._get_mac_keying_infos  .BiiGG)"--G,7   (!.,1,>#%7-- -0,F -0--     )64.9999rDrgrhcd|i}|||d<d|d<t|}|}t|j}t j|}|||}||fS)N data_digestrhrr)r*rnrrLrrjupdaterk) rMrgrhmessage_kwargsmessage message_bytesmd_specmd_funr{s rE_format_messagez"PdfMacTokenHandler._format_messages+8)I  '1AN- .$%y!%n55  ,T->??W%% m$$$**n,,rDrecipient_infor auth_attrsmacc tjd|gtjdditjd|jitjdt j|d||dS)NrrGr7r~r}content)rrecipient_infosrXrYencap_content_inforr)r AuthenticatedData HmacAlgorithmrrLEncapsulatedContentInfor ParsableOctetString)rMrrrrs rE_format_auth_dataz$PdfMacTokenHandler._format_auth_datas$$2#3!$!2K3J!K!K$'$7 $"34%%'*&A(@#'#;M#J#J'' )     rDr data_to_macctj|tj}|||S)N)keyrG)rHMACrrxrrk)rMrrhmac_funs rE compute_maczPdfMacTokenHandler.compute_macs@9FMOODDD $$$  """rDFricf||\}}|||\}}||}|||} ||||| } tjd| dS)Nr)rr)rrrrauthenticated_datar) rrrruntagrnrr ContentInfo) rMrgrhrirrirr{rr authed_datas rErlz%PdfMacTokenHandler.build_pdfmac_tokens///@@ (,(<(< -) ) % ~,,^<< )9)9););)@)@)B)B  ,,'! -  1k J J   rD recp_infoscd} |\}|j}n#t$rYnwxYwt|tjst d|d}|t us|djdkrt d|dd}|jdkrtd|j d |d j} tj |j | }n"#tj $rt d wxYw|S) NzWPDF MAC requires exactly one recipientInfo, which must be of PasswordRecipientInfo typerrGrz_PDF MAC tokens must have their key derivation algorithm explicitly identified as pdfMacWrapKdf.rrzPPDF MAC only supports unpadded 256-bit AES key wrapping for key encryption; not .r)r wrapped_keyzFailed to unwrap MAC key)chosen ValueError isinstancer rr?r r\r]dottedraes_key_unwraprK InvalidUnwrap)rMrrrecprzkea_objrrs rE_retrieve_mac_keyz$PdfMacTokenHandler._retrieve_mac_keysg  GT;DD    D $ 9:: '0  -. $;;#k*15GGG':  12;? >] * *%H4;NHHH  _-4  D,!\}GG$ D D D'(BCC C Ds  9CC4attrs encap_contentc`t|j}tj|}|t ||} t|d}|j|krtddS#ttf$rtdwxYw)Nr{zMValue of messageDigest attribute does not match hash of encapsulated content.zcMessage digest not found in authenticated attributes, or multiple messageDigest attributes present.) rrLrrjrrrkrr\r?rr)rMrrrmdr{claimed_message_digests rE_validate_message_digestz+PdfMacTokenHandler._validate_message_digestDs-T->?? [ ! ! % &&''' %>'&& "&,>>+,?> *+DE   '=  s *B !B-c|d}t| t|d|d|dn*#t$r}td|jz|d}~wwxYw|dd}|||dS) NrrYrX)claimed_signature_algorithm_objclaimed_digest_algorithm_objclaimed_mac_algorithm_objz%CMS alg protection validation error: rr)r)_validate_content_type_attrr!rr?failure_messager)rMrUre int_info_objs rE_validate_auth_attrsz'PdfMacTokenHandler._validate_auth_attrsZs|,  $J///  )04-67I-J*3O*D       +   '7!:KK   !!56yA  %%j %MMMMMs9 A AA cN|d}|turtd|d}|d}||}|||}t ||djstd ||n*#t$r}td|j z|d}~wwxYw|d d j}|d krtd |d d j S)N unauth_attrsz5PDF MAC tokens cannot have unauthenticated attributesrr)rrzPDF MAC token has invalid MACzCMS structural error: rr}r~z_The content type of the encapsulated content in a PDF MAC token must be id-pdfMacIntegrityInfo.r) r r?rrrrnrr\rrrparsed) rMrUrrrr computed_macreci_cts rE#_validate_and_extract_encap_contentz6PdfMacTokenHandler._validate_and_extract_encap_contentqsd!0 t # #'G  |, )23D)E ((44'' !1!1!3!3!8!8!:!:(  lIe,<,CDD I'(GHH H   % %i 0 0 0 0!   '(1+<<   /0@G - - -'8 -.y9@@s,C C) C$$C)cR||}t|||dSrI)r _validate_pdf_mac_integrity_info)rMrUrgrhrs rEvalidate_pdfmac_token_cmsz,PdfMacTokenHandler.validate_pdfmac_token_cmss;@@KK ( ?,<     rDN)(r@rArB__doc__r rrrN classmethodrstrrTr+rrrcboolintrqrRrrrrrrrrrrrlRecipientInfosrr rrrr*rrrCrDrEr-r-Ns`  'S& X'>??N)))?"'?38?HK???[?  '6   "  (  s^    [ @ 'T 'c ' ' ' ' /"' /38 /  / / /[ /  3;L    &:: uc'' (:::::-$-8@- ue| ----$ )  %         4#5#u#####     #5/         6$C,>$5$$$$L&7;7O,Nc.CNNNN.&A.&A &A&A&A&AP  (    #5/       rDr-int_inforgrhc|dj}||krtd|d}||turtddS|j}|td||krtddS)Nrz;Document digest does not match value in PdfMacIntegrityInforhz;PdfMacIntegrityInfo contains an unexpected signature digestz6Could not find signature digest in PdfMacIntegrityInfozc< t|}n/#tttjf$rt dwxYwt j|}t|}t|||d}|dj dkr/|d}t|ddkr|dd}|t d t|d d }n$#ttf$rt d wxYw||d j fS) Nz%Failed to retrieve signature contentsr} signed_datar signer_infosr)rzQSignature dictionary must contain a SignedData message with exactly 1 signerInfo.unsigned_attrs pdf_mac_dataz;Signature must have exactly 1 pdfMacData unsigned attribute signature)r"rrr PdfReadErrorr?r rrrmrr\rrr)sig_dictr sig_bytessig_cir signer_infosdrs rE_extract_mac_in_sigrsWM$X.. nd&7 8MMM#$KLLLM_ ! !) , ,Fi..K8[999K n$ 55 I  r.! " "a ' '^,Q/K# )    * ( )>   &'@ A   # I    ;{+2 22s,>C++!D readerrV handler_clsc* |jd}n#t$rd}YnwxYwt|tjrt dt|tjst dd}d} |d}t|tjr|dkrd}n|dkrd}n#t$rYnwxYw|j d tj }|rt||}|d } d} n|r |d } n:#tj$rt d t$rt d wxYw| } t| tjst dt#| |\}} | d } nt d|djdkrt d|j} | J|d}|ddj}t+|j | |\}}| Kt-jt1|}|| |}nd} | }n'#t8j$r}t d|d}~wwxYw|| ||| |||dS)N /AuthCodez&AuthCode dictionary cannot be indirectz$Failed to locate AuthCode dictionaryF /MACLocation /StandaloneTz/AttachedToSigrrz /SigObjRefz7Value of /SigObjRef entry must be an indirect referencez"/AttachedToSig requires /SigObjRefz)/SigObjRef does not point to a dictionaryz Failed to locate MAC in documentr}rz0MAC tokens must be of CMS type AuthenticatedDatarrYrG)rrLzError retrieving salt)rOrPrUrV)rUrgrh)! trailer_viewrrrrIndirectObjectr?DictionaryObject NameObjectstreamseekosSEEK_ENDrget_value_as_referenceIndirectObjectExpected get_objectrr\security_handlerlowerrrrjrrrk get_kdf_saltrrrcget_file_encryption_keyr)rrVrr is_standaloneis_in_signature mac_locationrrrsignature_valuesig_refrshrUrL_rgsig_mdrhrurs rEr/r/&s %--k:: '7122N#$LMMM gw7 8 8L#$JKKKMO ~66 lG$6 7 7 '},, $ !111"&      }!!!R[11HH((;;\*  H N44\BBGG-   'I  N N N'(LMM M N%%''(G$<== '; #6h"I"Il+ #$FGGG n$(<<<# >     B >>>y!I/0=DJJLLL* *<A"7 EEFF o&&&!??,,D    DDD#$;<r=handlertok_sizemac_dict cms_writerprepared_br_digest res_output pdfmac_tokens rEr.r.s#$"5"5<"5"P"PG++!&,H q8|<<r`sQ >>>>>>>>>>>>>>>>'''''''''' @@@@@@@@@@333333++++++++AAAAAAIHHHHH<<<<<<DDDDDDDD""""""&&&&&&//////       ))!!&))1'.   )        1   V V V V V V V V r !uo:    0  %_03uS_e5K/L3333H#2,>UU U3U()UUUUp77777)777!  & 4 4 4 4 4 4 4 4 4rD