jz vddlZddlZddlZddlZddlmZddlmZmZm Z ddl m Z m Z m Z mZddlmZddlmZmZmZddlmZmZdd lmZmZmZmZmZdd lmZm Z m!Z!dd l"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dd l,m-Z-m.Z.dd l/m0Z0m1Z1m2Z2ddl3m4Z4eGddZ5dee6e7fde7fdZ8 d5de7de5de e7fdZ9 d5de7de5de7de e7fdZ:dddZ;de7fdZ< d5de7de7de e7de7fd Z=ej>Gd!d"ej?Z@Gd#d$ejAe-ZBGd%d&e%ejCZDGd'd(eDe0ZEGd)d*eDe1ZFGd+d,eDe2ZGejHd-ZId.ZJd/ZKd0ZLd1ejMfd2ZNe*jOGd3d4e*ZPe-jOeBdS)6N) dataclass)sha256sha384sha512)DictOptionalTupleUnion)core)Cipher algorithmsmodes)genericmisc)compute_o_value_legacycompute_o_value_legacy_prepcompute_u_value_r2compute_u_value_r34legacy_normalise_pw)aes_cbc_decryptaes_cbc_encrypt rc4_encrypt) AuthResult AuthStatus CryptFilterCryptFilterBuilderCryptFilterConfigurationIdentityCryptFilterPdfKeyNotAvailableErrorSecurityHandlerSecurityHandlerVersion)SerialisableCredentialSerialisedCredential)AESCryptFilterMixinAESGCMCryptFilterMixinRC4CryptFilterMixin)StandardPermissionscNeZdZUeed<eed<eed<ededdfdZdS) _R6KeyEntry hash_valuevalidation_saltkey_saltentryreturnc~t|dksJt|dd|dd|ddS)N0 ()lenr*)clsr.s o/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/pdf_utils/crypt/standard.py from_bytesz_R6KeyEntry.from_bytes/sC5zzR5":uRU|U2b5\BBBN)__name__ __module__ __qualname__bytes__annotations__ classmethodr7r8r6r*r*)skOOOCuCCCC[CCCr8r*passwordr/ct|tr(|sdSddlm}||d}|ddS)Nr8r)saslprepzutf-8) isinstancestr _saslpreprBencode)r@rBs r6_r6_normalise_pwrH5s^(C  6 3''''''8H%%,,W55 DSD>r8pw_bytesr.u_entrycDt||j|}||jkSN) _r6_hash_algor,r+)rIr.rJpurported_hashs r6_r6_password_authenticaterO@s&#8U-BGLLN U- --r8e_entryct||j|}t|dksJt||t ddS)Nr2Fkeydataiv use_padding)rMr-r4rr<)rIr.rPrJ interm_keys r6_r6_derive_file_keyrYGsT xAAJ w<<2      Wr   r8TF)TF input_bytesc:td|DdzS)Nc3 K|] }|dzV dS)Nr?).0bs r6 z_bytes_mod_3..Ys&**q1u******r8r_)sum)r\s r6 _bytes_mod_3rdWs$ **k*** * *Q ..r8 current_saltct|}t|dksJ|||r*t|dksJ|||}ttt f}dx}}|dks ||dz kr||z|pdzdz}t |dd||ddd d } |t| dd} | | }| t| d z }|d z }|dk||dz k|ddS) u3 Algorithm 2.B in ISO 32000-2 § 7.6.4.3.4 r1r@r2r8NrRFrSr)rr4updatedigestrrrrd) rIrerJ initial_hashkhashesround_no last_byte_valk1e next_hashs r6rMrM\st(##L |   ! ! ! ! %%%%7||r!!!!G$$$Aff %F  H} R--=8b=88lgn- 3 #2#RAbeH%     <#2#//0 IaLL   ! !#a&&1* A  R--=8b=88 SbS6Mr8cZeZdZdZdZdZdZdZdZdZ de j fd Z e d d ZdS) StandardSecuritySettingsRevisionz;Indicate the standard security handler revision to emulate.r_Nr/cb|j}|tjntj|SrL)valuer NullObject NumberObject)selfvals r6 as_pdf_objectz.StandardSecuritySettingsRevision.as_pdf_objects.j$'KG  W5I#5N5N r8cZ t|S#t$rtjcYSwxYwrL)rt ValueErrorOTHER)r5rzs r6 from_numberz,StandardSecuritySettingsRevision.from_numbers? :3E:: : : : :39 9 9 9 :s **)r/rt)r9r:r;__doc__ RC4_BASIC RC4_EXTENDED RC4_OR_AES128AES256AES_GCMrr PdfObjectrr>rr?r8r6rtrtzs{EEILM FG E w0    :::[:::r8rtc|eZdZdejfdejddifgZedefdZde fdZ ede fd Z d S) _PasswordCredential pwd_bytesid1optionalTr/cdS)Nrr?r5s r6get_namez_PasswordCredential.get_names{r8c*|SrL)dumpr}s r6 _ser_valuez_PasswordCredential._ser_valuesyy{{r8rUc| t|S#t$rtjdwxYw)Nz)Failed to deserialise password credential)rloadrr PdfReadError)r5rUs r6 _deser_valuez _PasswordCredential._deser_valuesM Q&++D11 1 Q Q Q#$OPP P Qs;N) r9r:r;r OctetString_fieldsr>rErr<rrr?r8r6rrs d&'  :t"45G [EQQQQ[QQQr8rcjeZdZUdZdZeded<edZfdZ de fdZ fd Z xZ S) StandardCryptFilterzB Crypt filter for use with the standard security handler. NStandardSecurityHandler_handlerc\t|jtr |jjStrL)rDrr _auth_failedNotImplementedErrorrs r6rz StandardCryptFilter._auth_faileds( dm%< = = .=- -!!r8ct|tstt|d|_dSrL)rDr TypeErrorsuper_set_security_handler _shared_key)r}handler __class__s r6rz)StandardCryptFilter._set_security_handlersA'#:;; O %%g...r8r/cF|jsJ|jSrL)rget_file_encryption_keyrs r6derive_shared_encryption_keyz0StandardCryptFilter.derive_shared_encryption_keys$}}44666r8ct}tj|j|d<|S)N/Length)rrrr|keylen)r}resultrs r6rz!StandardCryptFilter.as_pdf_objects6&&(($0==y r8)r9r:r;rrrr=propertyrrr<rr __classcell__rs@r6rrs59Hh01888 ""X"      7e7777r8rceZdZdZdS)StandardAESCryptFilterz= AES crypt filter for the standard security handler. Nr9r:r;rr?r8r6rr Dr8rceZdZdZdS)StandardAESGCMCryptFilterzA AES-GCM crypt filter for the standard security handler. Nrr?r8r6rrrr8rceZdZdZdS)StandardRC4CryptFilterz= RC4 crypt filter for the standard security handler. Nrr?r8r6rrrr8rz/StdCFcdttt|ittSNrdefault_stream_filterdefault_string_filter)rSTD_CFrrs r6_std_rc4_configr3 # 'v6667$$   r8cdttt|ittSr)rrrrs r6_std_aes_configrrr8c`tttittS)Nr)rrrr?r8r6_std_gcm_configrs. # *,,-$$   r8cfdictcT|dd}t|dzS)Nrr3rgr)getr)r_acts_as_default keylen_bitss r6#_build_legacy_standard_crypt_filterrs-**Y++K !)9 : : ::r8c eZdZUdZejdeejddejddejddejd d iZeeje fe d <e d e fd Z e dddejddfdedefdZe dejdddfdededefdZed+dZ d,dedededeedeef fd Ze d ejd efd!Ze d ejfd"Zed effd# Z d$Z!d%efd&Z"d%efd'Z# d-d%eed e$fd(Z%d e&e'eeffd)Z(d efd*Z)xZ*S).ra Implementation of the standard (password-based) security handler. You shouldn't have to instantiate :class:`.StandardSecurityHandler` objects yourself. For encrypting new documents, use :meth:`build_from_pw` or :meth:`build_from_pw_legacy`. For decrypting existing documents, pyHanko will take care of instantiating security handlers through :meth:`.SecurityHandler.build`. z/V2z/AESV2c"tdS)NrRrr___s r6z StandardSecurityHandler.4J5 5 5 r8z/AESV3c"tdS)Nr2rrrs r6rz StandardSecurityHandler.rr8z/AESV4ctSrL)rrs r6rz StandardSecurityHandler.s 4M4O4Or8z /IdentityctSrL)rrs r6rz StandardSecurityHandler.s 7J7L7Lr8_known_crypt_filtersr/c*tjdS)N /Standard)r NameObjectrs r6rz StandardSecurityHandler.get_names!+...r8NrRTrevpermsc Pt|}|t|n|}|tjkrt|d|tjkrd}n|r|tjkrd}t |||j|} |tjkrL|tjztj ztj ztj z}t|| ||\} } nt||j|| ||| \} } |tjkr tj}n)|tjkr tj}n tj}|tjkr%|#|rt#d}nt%|}|d||||| | || d| }| |_t)||d|_|S) a Initialise a legacy password-based security handler, to attach to a :class:`~.pyhanko.pdf_utils.writer.PdfFileWriter`. Any remaining keyword arguments will be passed to the constructor. .. danger:: The functionality implemented by this handler is deprecated in the PDF standard. We only provide it for testing purposes, and to interface with legacy systems. :param rev: Security handler revision to use, see :class:`.StandardSecuritySettingsRevision`. :param id1: The first part of the document ID. :param desired_owner_pass: Desired owner password. :param desired_user_pass: Desired user password. :param keylen_bytes: Length of the key (in bytes). :param use_aes128: Use AES-128 instead of RC4 (default: ``True``). :param perms: Permission bits to set :param crypt_filter_config: Custom crypt filter configuration. PyHanko will supply a reasonable default if none is specified. :return: A :class:`StandardSecurityHandler` instance. Nz/ is not supported by this bootstrapping method.rRr)versionrevision legacy_keylen perm_flagsodataudatacrypt_filter_configencrypt_metadatarrr?)rrtrrrrrzr(ALLOW_FORM_FILLINGALLOW_ASSISTIVE_TECHNOLOGYALLOW_REASSEMBLYALLOW_HIGH_QUALITY_PRINTINGrrr"RC4_40RC4_LONGER_KEYSrrrr _credential)r5rrdesired_owner_passdesired_user_pass keylen_bytes use_aes128rrrkwargso_entryrJrTrshs r6build_from_pw_legacyz,StandardSecurityHandler.build_from_pw_legacy!s6Z11CDD!, 1 2 2 2#  1? ? ?GGG  2< < <LL  "B"PPPL(  139l   2< < <%89%@A&67&A B .!7E3LGSS/!  LGS 2@ @ @,:GG 4> > >,3GG,H S  +-      (,k>-JKK r8rwclt|t|cxkrdksntjd|d|r+|r)t|t|cxkrdksntjd|d|rt|dkrtjd|ddS)Nr1z2/U and /O entries must be 48 bytes long in a rev. z security handlerr2z;/UE and /OE must be present and be 32 bytes long in a rev. rRz6/Perms must be present and be 16 bytes long in a rev. )r4rPdfError)rrrrrrs r6_check_r6_valuesz(StandardSecurityHandler._check_r6_valuess E c%jj....B....-////  V CKK3v;;,L,L,L,L",L,L,L,L-////  #o"6"6""<"<-//// #=" > > N + +uffo   !DK DK#2D JJ#e**22222222m.@D CDK C$+(<  ,0!r8 encrypt_dictc|dd}|dzdkrtjd|dz} |d}|d}n"#t$rtjdwxYwd tjd t fd }d tjd tfd }t|| d |tj |j dd|j dd| d|| d|| d|| dtd| dd S)a Gather and preprocess the "easy" metadata values in an encryption dictionary, and turn them into constructor kwargs. This function processes ``/Length``, ``/P``, ``/Perms``, ``/O``, ``/U``, ``/OE``, ``/UE`` and ``/EncryptMetadata``. rr3rgrz"Key length must be a multiple of 8/O/Uz!/O and /U entries must be presentxr/ct|tjtjfs$t jdt ||jS)NzExpected string, but got )rDrTextStringObjectByteStringObjectrrtypeoriginal_bytesr*s r6 _get_byteszFStandardSecurityHandler.gather_encryption_metadata.._get_bytessPG,g.FG O'(MDGG(M(MNNN# #r8ct|tjrtj|St jd|d)Nz Cannot parse z as a permission indicator)rDrr|r( from_sint32rrr0s r6_parse_permissionszNStandardSecurityHandler.gather_encryption_metadata.._parse_permissionssK!W122 *6q999'AAAAAr8/P)defaultNr1/OE/UE/Perms/EncryptMetadataT/KDFSaltc`t|tjtjfr|jndSrL)rDrr,r-r/r0s r6rzDStandardSecurityHandler.gather_encryption_metadata..s6!G4g6NOA$$ r8) rrrrrrrrr) rrr KeyErrorrrr<r(dict get_and_applyallow_everythingr/bool)r5r&rrrrr1r4s r6gather_encryption_metadataz2StandardSecurityHandler.gather_encryption_metadatams#&&y"55 !O ! !- DEE E! E &E &EE E E E- CDD D E $'+ $ $ $ $ $ '"3 8K     #11"+<>>2 &ss+&ss+--eZ@@--eZ@@(66xLL)77"D$8"//      s A A*ctj|d}t|d}td||||d||S)N/V/R)rrrr?)r"rrtrprocess_crypt_filtersrB)r5r&vrs r6instantiate_from_pdf_objectz3StandardSecurityHandler.instantiate_from_pdf_objects| # .|D/A B B , 8 8d9K L L&  # 9 9, G G  ,,\::    r8c8tjp|jSrL)rpdf_mac_enabledr%)r}rs r6rKz'StandardSecurityHandler.pdf_mac_enabledsww&<$*< J!(!9$.!I!IF:    F|5EEE ' 4T[1_ E EF9 |1133t }2244t <0@ @ @)0)>%**F% & MM$2@@BB C C C =<C C C#4T[AAF5M#4T[AAF5M&78LMMF8  r8rc |j}|j}|tjkr t ||j|j|\}}nEt||j|j |j|j||j \}}|dd}|dd}||k|fS)NrR) rrrtrrrrrrzrr)r}rr@r user_tokenuser_tok_suppliedrTs r6_auth_user_password_legacyz2StandardSecurityHandler._auth_user_password_legacysmZ 2< < <%7$*dj#&& " ss&9    %&& " s!2#2# 6 #CRCJ J.33r8c$ t||d}|j}t||j|j}|t jkrt||j}nH|j}tdddD]- t fd|D}t||}.|}| ||\} }| r||_ tj|fS| ||\} }| r||_ tj|fStjdfS)Nrrc3"K|] }|z V dSrLr?)r`rais r6rbz?StandardSecurityHandler._authenticate_legacy..s'33!A333333r8)rrrrzrrtrrrranger<rUrrOWNERUSERFAILED) r}rr@credrrT prp_userpassr~new_keyowner_password user_passwordrYs @r6_authenticate_legacyz,StandardSecurityHandler._authenticate_legacys1"##F#FGGm)(CIt{KK 2< < <&sDJ77LL*C2r2&& 0 03333s33333!'3//L"==c<PP  )#D #S( ("<|tjdt|}|||\}}|||_d|_nd|_t'||j S) a Authenticate a user to this security handler. :param credential: The credential to use (a password in this case). :param id1: First part of the document ID. This is mandatory for legacy encryption handlers, but meaningless otherwise. :return: An :class:`AuthResult` object indicating the level of access obtained. z]Standard authentication credential must be a string, byte string or _PasswordCredential, not .rrNz+id1 must be specified for legacy encryptionFT)statuspermission_flags)rDr$r# deserialiserrEr<rrr.nativerrtr_authenticate_r6rrcrrrr)r} credentialrrresrTs r6 authenticatez$StandardSecurityHandler.authenticate sP j"6 7 7 H/;JGGJ*':C&GHH #+J''+++  j"5 6 6 8U#*C#K07Jm 29 9 9,,Z88HC{'A-Z88J00jAAHC ?"D  %D   $D tzBBBBr8c t|}t|j}t|j}t |||jr)t j}t|||j |j}nAt ||r#t j }t|||j }nt j dfSttj|t!j}|}||j|z} | dddk} | |jt/jt3jd| dddkz} t6| d} | | |jkz} n#t:$rd} YnwxYw| st=jd tAd |i|_!||fS) N rzrErr(r@rtrrAr staticmethodr!r"rrr<r$rMr>rBrIrrKrrUrcrrmr rrjrrrs@r6rrs   5!!#F8$$' '  8$$' '  8$$&O&O;'')L)L J$w13EEF   ////[/ %I%8%I%K%K xx -x#xxx[xt%I%8%I%K%Kzz# z  zzzz[zx\2BF$(@"@"'@"3@" ( @"&&>?@"5/@"@"@"@"@"@"D= "3= = = = [= ~  "3    [  ======X=84e4444,'''''626+C+C'+C +C+C+C+C\-E*huo2M,N----^r8rrL)Qabcenumrrs dataclassesrhashlibrrrtypingrrr r asn1cryptor &cryptography.hazmat.primitives.ciphersr r rpyhanko.pdf_utilsrr_legacyrrrrr_utilrrrapirrrrrrr r!r"cred_serr#r$ filter_mixinsr%r&r' permissionsr(r*rEr<rHrOrYrurdrMunique VersionEnumrtSequencerABCrrrrrrrrrrMrregisterrr?r8r6rs=  !!!!!!**********////////////LLLLLLLLLL++++++++A@@@@@@@@@                      CBBBBBBB -,,,,, CCCCCCC CuS%Z0UEI...'.2:5/.... $      e_     u--/e//// FJ#(3;E? <:::::t'7:: :6QQQQQ$-)?QQQ*+sw>     02E        35K        02E     H % %;  $;;;;s s s s s os s s l  344444r8