jpr2dZddlZddlZddlZddlZddlmZddlmZm Z m Z m Z m Z m Z mZmZddlZddlmZmZmZddlmZddlmZddlmZmZmZmZdd lmZdd l m!Z!dd l"m#Z#dd l$m%Z%dd l&m'Z' ddlm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ddlm0Z1ddlm2Z3n#e4$rZ5e4de5dZ5[5wwxYwgdZ6ej7e8Z9de ede3j:de ee;e;ffdZ d5de e3j?de e@de ede e3j:fdZAedGddZBe+jCe+jDe+jEe+jFe+jGd ZHe+jIe+jJe+jKe+jLe+jMd ZNe(jOe(jPe(jQe(jRe(jSd ZTe+jUe+jVe+jWe+jXe+jYd ZZe+j[e+j\e+j]e+j^e+j_d Z`e+jae+jPe+jQe+jRe+jSd Zbd!ejcd"e;d#e=d$e e;efdeBf d%Zd d6d&e;de e@d'e e;de ed(ee;eedfde.f d)Zf d5d*e;d+e=d,e e;d-e egfd.Zhd"e;d/e=fd0ZiGd1d2e#ZjGd3d4ZkdS)7z This module provides PKCS#11 integration for pyHanko, by providing a wrapper for `python-pkcs11 `_ that can be seamlessly plugged into a :class:`~.signers.PdfSigner`. N) dataclass)AnyCallableDictListOptionalSetTupleUnion)algoscorex509)RSASSAPSSParams)hashes)PKCS11PinEntryModePKCS11SignatureConfigPKCS11SigningPinEntryMode TokenCriteria)coalesce) SigningError)Signer)CertificateStore)get_pyca_cryptography_hash)MGFPROTECTED_AUTH Attribute Mechanism ObjectClass PKCS11ErrorSession SignMixin)lib)typeszpyhanko.sign.pkcs11 requires pyHanko to be installed with the [pkcs11] option. You can install missing dependencies by running "pip install 'pyHanko[pkcs11]'".) PKCS11SignerPKCS11SigningContext find_tokenopen_pkcs11_sessionselect_pkcs11_signing_paramscriteriatokenreturnc|gSg}|j,|j|jkr|d|jf|j>|j|jkr.|d|jf|S)Nlabelserial)r-appendr.hex)r)r* err_itemss b/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/sign/pkcs11.pycriteria_mismatchesr3>s I~!ekX^&C&C'8>2333"u|x'F'F(HO$7$7$9$9:;;; c$t|| SN)r3)r)r*s r2criteria_satisfied_byr7Ms#8U33 33r4slotsslot_notoken_criteriac<|>|zfind_token..sE  .8eS5))#))      r4zToken in slot z does not satisfy criteria; .)len get_tokenrr7r3join)r8r9r:r*slot cur_tokenerrorserr_strs r2r&r&Ss&'/ u::??8%%'' '#  E  D  NN,, (CC%EE     c%jj NgNN#e**NN 'N,,.. $^Y??  ii  ":;;;;r4rN)sha1sha224sha256sha384sha512signature_mechanismdigest_algorithmuse_raw_mechanismrOcddlm}ddlm}d}d}i} |j} n#t $r|dj} YnwxYw| dkr6|r"tj|d<t|d }nt||d<nt| d kr7|r!tj |d<t|d }nt||d<|}n7| d kr6|r!tj |d<t|d }nt||d<|}n| d kr|rtd|d} || ddjksJt ||d<t"|} | dddj} t$| } | dj}| | |f|d<nj| dkr!|rtdtj|d<nC| dkr&|rtdtj|d<d|d<nd|vrtd| d|jdi|t+|||S)a Internal helper function to set up a PKCS #11 signing operation. :param signature_mechanism: The signature mechanism to use (as an ASN.1 value) :param digest_algorithm: The digest algorithm to use :param use_raw_mechanism: Whether to attempt to use the raw mechanism on pre-hashed data. :param sign_kwargs: Override kwargs manually. :return: r)encode_dsa_signature)encode_ecdsa_signatureN algorithmrsassa_pkcs1v15 mechanismT)wrap_digest_infodsaFecdsa rsassa_pssz$RSASSA-PSS not available in raw mode parametershash_algorithmmask_gen_algorithm salt_lengthmechanism_paramed25519z!Ed25519 not available in raw modeed448zEd448 not available in raw mode)FNzSignature algorithm 'z' is not supported.)rOrPrQr?)pkcs11.util.dsarbpkcs11.util.ecrcsignature_algo ValueErrornativerRSA_PKCS _hash_fully RSA_MECH_MAPDSA DSA_MECH_MAPECDSAECDSA_MECH_MAPNotImplementedErrorRSASSA_PSS_MECH_MAPDIGEST_MECH_MAP MGF_MECH_MAPEDDSAupdaterN)r^r_r`rOrbrcrPrQkwargsrtparamspss_digest_parammgf_val pss_mgf_param pss_salt_lens r2r(r(s &544444555555FA,; AAA,[9@A***  A"+"4F; !, 4"""  #//?"@F;   5  A"+-F; !, 5"""  #//?"@F; 2 7 " "  C"+/F; !, 5"""   #11A"BF; 4 < ' '  N%&LMM M"5l"C6*:#;K#H#OOOOO22BC{*+;<-.|<[IP$W- m,3    %  !! 9 $ $  K%&IJJ J'o{ 7 " "  I%&GHH H'o{$1 !! K ' '! GN G G G   FM  K   '-/   s 66 lib_location token_labeluser_pinc&t|}|,|*tjdtt |}|}t |||}|t|d|dndi}|||d<|jd i|S) a Open a PKCS#11 session :param lib_location: Path to the PKCS#11 module. :param slot_no: Slot number to use. If not specified, the first slot containing a token labelled ``token_label`` will be used. :param token_label: .. deprecated:: 0.14.0 Use ``token_criteria`` instead. Label of the token to use. If ``None``, there is no constraint. :param token_criteria: Criteria that the token should match. :param user_pin: User PIN to use, or :attr:`.PROTECTED_AUTH`. If ``None``, authentication is skipped. .. note:: Some PKCS#11 implementations do not require PIN when the token is opened, but will prompt for it out-of-band when signing. Whether :attr:`.PROTECTED_AUTH` or ``None`` is used in this case depends on the implementation. :return: An open PKCS#11 session object. Nz9'token_label' is deprecated, use 'token_criteria' instead)r-)r9r:zNo token matching criteria z foundzNo token foundrr?) p11_libwarningswarnDeprecationWarningr get_slotsr&ropen) rr9rr:rr"r8r*rs r2r'r'=sD ,  C+"9 G    '[999 MMOOE ugn M M ME }) C. B B B B!   F%z 5:    r4 object_kind no_resultsr-id_valuecg}||d|d|>|dtj|dd|rdd|nd}|r d||d }nd ||d }|S) Nzlabel ''zID 'asciiz with r=zCould not find rDzFound more than one )r/binasciihexlifydecoderG)rrr-r info_strs qualifiererrs r2_format_pull_err_msgrxs I +5+++,,,M 0 : : A A' J JMMMNNN3<D/9--///"I?9 9Y999>[>)>>> Jr4rgcVtdtdtffd }|S)Ndatar+c$tj}|||}rOt jtjd|d S|S)N)rdrk)r_digest) rHashrfinalizer DigestInfolowerr Nulldump)rhrr_md_specrgs r2_hz_hash_fully.._hs K    #&6%;%;%=%=&*ikk))% dff Mr4)rrX)r_rgrrs`` @r2rxrxsP()9::G5" Ir4cxeZdZUdZeeefed<eeefed< d&ded e e d e e j d e e d e e d e e de ejde ee efffd ZdZedefdZedZde dee effdZde dee efdefdZ d'de de de fdZdee j fdZdeeeffdZde e d e e deeeffdZdeeeffd Zde e d e e fd!Zd"Z d#Z!d$Z"d%Z#xZ$S)(r$a Signer implementation for PKCS11 devices. :param pkcs11_session: The PKCS11 session object to use. :param cert_label: The label of the certificate that will be used for signing, to be pulled from the PKCS#11 token. :param cert_id: ID of the certificate object that will be used for signing, to be pulled from the PKCS#11 token. :param signing_cert: The signer's certificate. If the signer's certificate is provided via this parameter, the ``cert_label`` and ``cert_id`` parameters will not be used to retrieve the signer's certificate. :param ca_chain: Set of other relevant certificates (as :class:`.asn1crypto.x509.Certificate` objects). :param key_label: The label of the key that will be used for signing. Defaults to the value of ``cert_label`` if left unspecified and ``key_id`` is also unspecified. .. note:: At least one of ``key_id``, ``key_label`` and ``cert_label`` must be supplied. :param key_id: ID of the private key object (optional). :param other_certs_to_pull: List labels of other certificates to pull from the PKCS#11 device. Defaults to the empty tuple. If ``None``, pull *all* certificates. :param bulk_fetch: Boolean indicating the fetching strategy. If ``True``, fetch all certs and filter the unneeded ones. If ``False``, fetch the requested certs one by one. Default value is ``True``, unless ``other_certs_to_pull`` has one or fewer elements, in which case it is always treated as ``False``. :param use_raw_mechanism: Use the 'raw' equivalent of the selected signature mechanism. This is useful when working with tokens that do not support a hash-then-sign mode of operation. .. note:: This functionality is only available for ECDSA at this time. Support for other signature schemes will be added on an as-needed basis. :param signature_mechanism: Specify the signature mechanism explicitly. By default, pyHanko will attempt to infer it from the key's properties. :param base_sign_kwargs: Directly specify some of the keyword arguments passed to the :meth:`pkcs11.SignMixin.sign` method. This can be used as an escape hatch to enable functionality (advanced auth, additional signing mechanisms) that are not directly supported by pyHanko. default_cert_query_paramsdefault_key_query_paramsNFTr?pkcs11_session cert_label signing_cert key_labelkey_idcert_idr^base_sign_kwargsct|| s|nd|_t| |s| nd|_t| |s| nd|_t|| s|nd|_||_||_d|_|t|dkrd|_ n| |_ | |_ d|_ d|_ |pi|_ d|_t|||| |r|j|||j|t(jt,ji|_t(jt,jt(jdi|_dS)z- Initialise a PKCS11 signer. NFr<) prefer_pss embed_rootsrr^T)rrrrrr other_certs_other_certs_loadedrE bulk_fetchr` _key_handle_loaded _sign_kwargs_PKCS11Signer__loading_eventsuper__init___cert_registryregister_multipleregisterrCLASSr CERTIFICATEr PRIVATE_KEYSIGNr)selfrrrca_chainrrrother_certs_to_pullrrrr`r^r __class__s r2rzPKCS11Signer.__init__s(# : d  vi'IwwTJJ z)KtLL !)v-OZZ4PP,.#(  *s3F/G/G1/L/L#DOO(DO!204 ,2# !#% 3     <   1 1( ; ; ;  #   ( ( 6 6 6 O[4* & O[4 ND) %%%r4c|js5|}|j|d|_|jS)NT)r_load_other_certsrr)rcertss r2_init_cert_registryz PKCS11Signer._init_cert_registrysH' ,**,,E   1 1% 8 8 8'+D $""r4r+c*|Sr6)rrs r2 cert_registryzPKCS11Signer.cert_registry$s'')))r4c8||jSr6) _load_objects _signing_certrs r2rzPKCS11Signer.signing_cert*s !!r4 data_to_signc|jS)a Supply keyword arguments to pass to the :meth:`pkcs11.SignMixin.sign` method. This can be used as an escape hatch to enable functionality (advanced auth, additional signing mechanisms) that are not directly supported by pyHanko. :param data_to_sign: The data being signed. .. note:: In typical cases this parameter can be ignored; pyHanko exposes it to subclasses to allow for just-in-time credentials that depend on the content being signed. :return: A dictionary of keyword arguments. )r)rrs r2rOzPKCS11Signer.sign_kwargs0s *  r4r_rOc|}t||||j|S)N)r`rO)rr("get_signature_mechanism_for_digestr`)rr_rOs r2_select_pkcs11_signing_paramsz*PKCS11Signer._select_pkcs11_signing_paramsGsK,1133+  3 34D E E "4#     r4rclK|rdS|d{Vddlm}|jJ|j|||jfd}tj}| d|d{VS)Ns00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000r)r!)rOcfjfij}j|}|Sr6)signrOrQ) signaturerkhspecs r2_perform_signaturez7PKCS11Signer.async_sign_raw.._perform_signatureesA99(899I'3 44Y??  r4) ensure_objects_loadedpkcs11r!rrrOrPasyncioget_running_looprun_in_executor) rrr_dry_runr!rlooprrs ` @@r2async_sign_rawzPKCS11Signer.async_sign_rawRs   :((*********$$$$$$+++(11 $*:*:4*@*@2    " .**400D        '))))$0BCCCCCCCCCr4cDt|Sr6)set_PKCS11Signer__pullrs r2rzPKCS11Signer._load_other_certsns4;;==!!!r4c*t|jS)z Search parameters to bulk fetch certificates from the token. .. note:: Can be overridden in subclasses. )dictrrs r2bulk_cert_fetch_paramsz#PKCS11Signer.bulk_cert_fetch_paramsqs D2333r4r-crt|j}|||tj<|||tj<|S)z Search parameters to fetch a single certificate from the token. .. note:: Can be overridden in subclasses. )rrrLABELID)rr-r query_paramss r2single_cert_fetch_paramsz%PKCS11Signer.single_cert_fetch_paramsysE.2  *. .   ,1L )  )0L &r4ct|j}|j|j|tj<|j|j|tj<|S)z Search parameters to fetch the signing key from the token. .. note:: Can be overridden in subclasses. )rrrrrrr)rrs r2signing_key_fetch_paramsz%PKCS11Signer.signing_key_fetch_paramssF .2$2O-P-P > %,0NL ) ; ")-L &r4cZ|||}|j|}t|}t |dkr7|d}t j|tj Std| ||}t|)Nr<r certificaterr-r) rr get_objectslistrEr CertificateloadrVALUErr)rr-rrqresultscert_objrs r2_pull_single_certzPKCS11Signer._pull_single_certs 44UGDD   + +L 9 9q'' w<<1  qzH#(()/)BCC C&&; C c"" "r4c |}|j|}t|}t |dkr|dSt d| |j|j}t|)Nr<rz private keyr) rrrrrErrrr)rrrrrs r2_pull_signing_key_handlez%PKCS11Signer._pull_signing_key_handles4466   + +L 9 9q'' w<<1  1: &&;n C c"" "r4c#@K|j}|t|dkrdS||jr|j|}t d|D]k}|tj }|||vrQd|d}t |tj |tj VldS|D];}d|d}t |||dV2222 %)37#'"&#'EI596 6 6 SM6 t/0 6 C= 6 6 %6 &e&AB6 #4S>26 6 6 6 6 6 p###*/***X* ""X" !!$sCx.!!!!.  #  26sCx.  %     ;@DDD-0D DDDD8"3t'7#8""""4Y^(<4444}% in  ( $y#~*>    #}#%####.### HHHB...<       r4r$c\eZdZdZ d dedeefdZdZde fdZ d Z d Z d Z d ZdS)r%z+Context manager for PKCS#11 configurations.Nconfigrc0||_d|_||_dSr6)r_session _user_pin)rrrs r2rzPKCS11SigningContext.__init__s +/ !r4c|jp |jj}|t|}n$|jjt jkrt}nd}|Sr6)rrrrV prompt_pinrDEFERr)rpins r2 _handle_pinz PKCS11SigningContext._handle_pinsJn4 4 ?c((CC [ #'9'? ? ? CCC r4r+cB|j}|} t|j|j|j|x|_}nG#tj$r5}td|jdt|j d||d}~wwxYwi}|j tjkr |jp||d<t!||j|j|j|j|j|j|j|j|j|j|j| }|jrd|jt<j<|S)N)r9r:rz'PKCS#11 error while opening session to z: [z] r ) rrrr`rrrrrr^rT) rr!r' module_pathr9r:rrrrtyperRsigning_pin_moderREAUTHENTICATE signing_pinr$rrrr raw_mechanismrrrrsigning_certificater^only_resident_certsrrTOKEN)rrr sessionexbase_signing_kwargssigners r2 _instantiatez!PKCS11SigningContext._instantiate&s`   &9"%4 ''' DMGG !   j&:LjjQUVXQYQYQbjjfhjj  !  "&?&N N N)/);)Bs  &   '&($2 & :(=N3 & :0     % E@DF ,Y_ = s)AB 0BB c*|Sr6)r0rs r2 __enter__zPKCS11SigningContext.__enter__Ks  """r4cKtj}|d|jd{V}|d{V|Sr6)rrrr0r)rrr/s r2 __aenter__zPKCS11SigningContext.__aenter__Nsg'))++D$2CDDDDDDDD**,,,,,,,,, r4c8|jdSr6rcloserexc_typeexc_valexc_tbs r2__exit__zPKCS11SigningContext.__exit__Ts r4c<K|jdSr6r6r8s r2 __aexit__zPKCS11SigningContext.__aexit__Ws  r4r6)rRrSrTrUrrrVrr!r$r0r2r4r<r>r?r4r2r%r%s55HL""+"7?}""""   #l####J### r4r%)NN)NNNN)lrUrrloggingr dataclassesrtypingrrrrrr r r r asn1cryptor r rasn1crypto.algosrcryptography.hazmat.primitivesrpyhanko.config.pkcs11rrrrpyhanko.pdf_utils.miscrpyhanko.sign.generalrpyhanko.sign.signersrpyhanko_certvalidator.registryrpyhanko_certvalidator.utilrrrrrrrr r!r"rr# p11_types ImportErrore__all__ getLoggerrRr TokenrVr3boolr7Slotintr&rN SHA1_RSA_PKCSSHA224_RSA_PKCSSHA256_RSA_PKCSSHA384_RSA_PKCSSHA512_RSA_PKCSrySHA1_RSA_PKCS_PSSSHA224_RSA_PKCS_PSSSHA256_RSA_PKCS_PSSSHA384_RSA_PKCS_PSSSHA512_RSA_PKCS_PSSrSHA1SHA224SHA256SHA384SHA512r ECDSA_SHA1 ECDSA_SHA224 ECDSA_SHA256 ECDSA_SHA384 ECDSA_SHA512r}DSA_SHA1 DSA_SHA224 DSA_SHA256 DSA_SHA384 DSA_SHA512r{SHA_1rrr(objectr'rXrrxr$r%r?r4r2ros  !!!!!!IIIIIIIIIIIIIIIIIIII ((((((((((,,,,,,111111 ,+++++------'''''';;;;;;AAAAAA                    &%%%%%))))))) + E        8 $ $ }% .7o  %S/    4}%4.7o4 4444".266   6 c]6]+6io 6666r $.  #''''    '++++  Hjjjj    $$$$   "" ""    O b4bbbc3h b " bbbbN"!%.2)- 8 8 8 c]8 #8 ]+ 8 C%& 8  8 8 8 8 | $  C=uo &#D4iiiii6iiiX GGGGGGGGGGs2 BB) B$$B)