hl JddlZddlZddlZddlZddlmZddlmZmZm Z ddl m Z m Z m Z mZddlmZddlmZmZmZddlmZmZdd lmZmZmZmZmZdd lmZm Z m!Z!m"Z"dd l#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-dd l.m/Z/m0Z0dd l1m2Z2m3Z3eGddZ4dee5e6fde6fdZ7 d1de6de4de e6fdZ8 d1de6de4de6de e6fdZ9dddZ:de6fdZ; d1de6de6de e6de6fdZZ?Gd"d#ej@e/ZAGd$d%e'ejBZCGd&d'eCe2ZDGd(d)eCe3ZEejFd*ZGd+ZHd,ZId-ejJfd.ZKe,jLGd/d0e,ZMe/jLeAdS)2N) dataclass)sha256sha384sha512)DictOptionalTupleUnion)core)Cipher algorithmsmodes)genericmisc)compute_o_value_legacycompute_o_value_legacy_prepcompute_u_value_r2compute_u_value_r34legacy_normalise_pw)aes_cbc_decryptaes_cbc_encrypt as_signed rc4_encrypt) ALL_PERMS AuthResult AuthStatus CryptFilterCryptFilterBuilderCryptFilterConfigurationIdentityCryptFilterPdfKeyNotAvailableErrorSecurityHandlerSecurityHandlerVersion)SerialisableCredentialSerialisedCredential)AESCryptFilterMixinRC4CryptFilterMixincNeZdZUeed<eed<eed<ededdfdZdS) _R6KeyEntry hash_valuevalidation_saltkey_saltentryreturnc~t|dksJt|dd|dd|ddS)N0 ()lenr*)clsr.s \/var/www/html/Sam_Eipo/venv/lib/python3.11/site-packages/pyhanko/pdf_utils/crypt/standard.py from_bytesz_R6KeyEntry.from_bytes,sC5zzR5":uRU|U2b5\BBBN)__name__ __module__ __qualname__bytes__annotations__ classmethodr7r8r6r*r*&skOOOCuCCCC[CCCr8r*passwordr/ct|tr(|sdSddlm}||d}|ddS)Nr8r)saslprepzutf-8) isinstancestr _saslpreprBencode)r@rBs r6_r6_normalise_pwrH2s^(C  6 3''''''8H%%,,W55 DSD>r8pw_bytesr.u_entrycDt||j|}||jkSN) _r6_hash_algor,r+)rIr.rJpurported_hashs r6_r6_password_authenticaterO=s&#8U-BGLLN U- --r8e_entryct||j|}t|dksJt||t ddS)Nr2Fkeydataiv use_padding)rMr-r4rr<)rIr.rPrJ interm_keys r6_r6_derive_file_keyrYDsT xAAJ w<<2      Wr   r8TF)TF input_bytesc:td|DdzS)Nc3 K|] }|dzV dS)Nr?).0bs r6 z_bytes_mod_3..Vs&**q1u******r8r_)sum)r\s r6 _bytes_mod_3rdTs$ **k*** * *Q ..r8 current_saltct|}t|dksJ|||r*t|dksJ|||}ttt f}dx}}|dks ||dz kr||z|pdzdz}t |dd||ddd d } |t| dd} | | }| t| d z }|d z }|dk||dz k|ddS) u3 Algorithm 2.B in ISO 32000-2 § 7.6.4.3.4 r1r@r2r8NrRFrSr)rr4updatedigestrrrrd) rIrerJ initial_hashkhashesround_no last_byte_valk1e next_hashs r6rMrMYst(##L |   ! ! ! ! %%%%7||r!!!!G$$$Aff %F  H} R--=8b=88lgn- 3 #2#RAbeH%     <#2#//0 IaLL   ! !#a&&1* A  R--=8b=88 SbS6Mr8cVeZdZdZdZdZdZdZdZ de j fdZ e d d Z dS) StandardSecuritySettingsRevisionz;Indicate the standard security handler revision to emulate.r_Nr/cb|j}|tjntj|SrL)valuer NullObject NumberObject)selfvals r6 as_pdf_objectz.StandardSecuritySettingsRevision.as_pdf_objects.j$'KG  W5I#5N5N r8cZ t|S#t$rtjcYSwxYwrL)rt ValueErrorOTHER)r5rys r6 from_numberz,StandardSecuritySettingsRevision.from_numbers? :3E:: : : : :39 9 9 9 :s **)r/rt)r9r:r;__doc__ RC4_BASIC RC4_EXTENDED RC4_OR_AES128AES256rr PdfObjectr~r>rr?r8r6rtrtwsvEEILM F E w0    :::[:::r8rtc|eZdZdejfdejddifgZedefdZde fdZ ede fd Z d S) _PasswordCredential pwd_bytesid1optionalTr/cdS)Nrr?r5s r6get_namez_PasswordCredential.get_names{r8c*|SrL)dumpr|s r6 _ser_valuez_PasswordCredential._ser_valuesyy{{r8rUc| t|S#t$rtjdwxYw)Nz)Failed to deserialise password credential)rloadrr PdfReadError)r5rUs r6 _deser_valuez _PasswordCredential._deser_valuesM Q&++D11 1 Q Q Q#$OPP P Qs;N) r9r:r;r OctetString_fieldsr>rErr<rrr?r8r6rrs d&'  :t"45G [EQQQQ[QQQr8rcjeZdZUdZdZeded<edZfdZ de fdZ fd Z xZ S) StandardCryptFilterzB Crypt filter for use with the standard security handler. NStandardSecurityHandler_handlerc\t|jtr |jjStrL)rDrr _auth_failedNotImplementedErrorrs r6rz StandardCryptFilter._auth_faileds( dm%< = = .=- -!!r8ct|tstt|d|_dSrL)rDr TypeErrorsuper_set_security_handler _shared_key)r|handler __class__s r6rz)StandardCryptFilter._set_security_handlersA'#:;; O %%g...r8r/cF|jsJ|jSrL)rget_file_encryption_keyrs r6derive_shared_encryption_keyz0StandardCryptFilter.derive_shared_encryption_keys#}}}44666r8ct}tj|j|d<|S)N/Length)rr~rr{keylen)r|resultrs r6r~z!StandardCryptFilter.as_pdf_objects6&&(($0==y r8)r9r:r;rrrr=propertyrrr<rr~ __classcell__rs@r6rrs59Hh01888 ""X"      7e7777r8rceZdZdZdS)StandardAESCryptFilterz= AES crypt filter for the standard security handler. Nr9r:r;rr?r8r6rr Dr8rceZdZdZdS)StandardRC4CryptFilterz= RC4 crypt filter for the standard security handler. Nrr?r8r6rrrr8rz/StdCFcdttt|ittSNr)default_stream_filterdefault_string_filter)r STD_CFrrs r6_std_rc4_configr3 # 'v6667$$   r8cdttt|ittSr)r rrrs r6_std_aes_configrrr8cfdictcT|dd}t|dzS)Nrr3rgr)getr)r_acts_as_default keylen_bitss r6#_build_legacy_standard_crypt_filterrs-**Y++K !)9 : : ::r8c @eZdZUdZejdeejddejddejddiZeeje fe d <e d e fd Z e d d ded dfdedefdZe d edfdZed$dZ d%dedededeeffd Ze dejd efdZe dejfdZdZdefdZdefd Z d&deed e!fd!Z"d e#e$eeffd"Z%d efd#Z&xZ'S)'ra Implementation of the standard (password-based) security handler. You shouldn't have to instantiate :class:`.StandardSecurityHandler` objects yourself. For encrypting new documents, use :meth:`build_from_pw` or :meth:`build_from_pw_legacy`. For decrypting existing documents, pyHanko will take care of instantiating security handlers through :meth:`.SecurityHandler.build`. z/V2z/AESV2c"tdS)NrRrr___s r6z StandardSecurityHandler.4J5 5 5 r8z/AESV3c"tdS)Nr2rrrs r6rz StandardSecurityHandler.rr8z /IdentityctSrL)r!rs r6rz StandardSecurityHandler.s 7J7L7Lr8_known_crypt_filtersr/c*tjdS)N /Standard)r NameObjectrs r6rz StandardSecurityHandler.get_names!+...r8NrRTrevpermsc ,t|}|t|n|}|tjkrt|d|tjkrd}n|r|tjkrd}t |||j|} t|dz}|tjkr(t|dz}t|| ||\} } nt||j|| ||| \} } |tjkr tj}n)|tjkr tj }n tj }|tjkr%|#|rtd}nt|}|d ||||| | || d| }| |_t!||d |_|S) a Initialise a legacy password-based security handler, to attach to a :class:`~.pyhanko.pdf_utils.writer.PdfFileWriter`. Any remaining keyword arguments will be passed to the constructor. .. danger:: The functionality implemented by this handler is deprecated in the PDF standard. We only provide it for testing purposes, and to interface with legacy systems. :param rev: Security handler revision to use, see :class:`.StandardSecuritySettingsRevision`. :param id1: The first part of the document ID. :param desired_owner_pass: Desired owner password. :param desired_user_pass: Desired user password. :param keylen_bytes: Length of the key (in bytes). :param use_aes128: Use AES-128 instead of RC4 (default: ``True``). :param perms: Permission bits to set (defined as an integer) :param crypt_filter_config: Custom crypt filter configuration. PyHanko will supply a reasonable default if none is specified. :return: A :class:`StandardSecurityHandler` instance. Nz/ is not supported by this bootstrapping method.rRlr)versionrevision legacy_keylen perm_flagsodataudatacrypt_filter_configencrypt_metadatarrr?)rrtrrrrryrrrr$RC4_40RC4_LONGER_KEYSrrrr _credential)r5rrdesired_owner_passdesired_user_pass keylen_bytes use_aes128rrrkwargso_entryrJrTrshs r6build_from_pw_legacyz,StandardSecurityHandler.build_from_pw_legacy sZ11CDD!, 1 2 2 2#  1? ? ?GGG  2< < <LL  "B"PPPL(  139l   %*,-- 2< < <ej011E-!7E3LGSS/!  LGS 2@ @ @,:GG 4> > >,3GG,-JKK r8rwclt|t|cxkrdksntjd|d|r+|r)t|t|cxkrdksntjd|d|rt|dkrtjd|ddS)Nr1z2/U and /O entries must be 48 bytes long in a rev. z security handlerr2z;/UE and /OE must be present and be 32 bytes long in a rev. rRz6/Perms must be present and be 16 bytes long in a rev. )r4rPdfError)rrrrrrs r6_check_r6_valuesz(StandardSecurityHandler._check_r6_valuess E c%jj....B....-////  V CKK3v;;,L,L,L,L",L,L,L,L-////  #o"6"6""<"<-//// #=" > > N + +uffo   !DK DK#2D JJ#e**22222222m.@D CDK C$+(<  ,0!r8 encrypt_dictcd|dd}|dzdkrtjd|dz} |d}|d}n"#t$rtjdwxYwd tjd t fd }t|t|d t|j d d|j d d| d|| d|| d|| dtdS)a Gather and preprocess the "easy" metadata values in an encryption dictionary, and turn them into constructor kwargs. This function processes ``/Length``, ``/P``, ``/Perms``, ``/O``, ``/U``, ``/OE``, ``/UE`` and ``/EncryptMetadata``. rr3rgrz"Key length must be a multiple of 8/O/Uz!/O and /U entries must be presentxr/ct|tjtjfs$t jdt ||jS)NzExpected string, but got )rDrTextStringObjectByteStringObjectrrtypeoriginal_bytes)rs r6 _get_byteszFStandardSecurityHandler.gather_encryption_metadata.._get_bytes?sPG,g.FG O'(MDGG(M(MNNN# #r8/PNr1/OE/UE/Perms/EncryptMetadataT)default)rrrrrrrr) rrrKeyErrorrrr<dictrrr get_and_applybool)r5rrrrrr s r6gather_encryption_metadataz2StandardSecurityHandler.gather_encryption_metadata)sa#&&y"55 !O ! !- DEE E! E &E &EE E E E- CDD D E $'+ $ $ $ $ $  !1!1$ !B!BCC&ss+&ss+--eZ@@--eZ@@(66xLL)77"D$8    s A A*ctj|d}t|d}td||||d||S)N/V/R)rrrr?)r$rrtrprocess_crypt_filtersr+)r5rvrs r6instantiate_from_pdf_objectz3StandardSecurityHandler.instantiate_from_pdf_objectSs| # .|D/A B B , 8 8d9K L L&  # 9 9, G G  ,,\::    r8ctj}tjd|d<tj|j|d<tj|j|d<tjt|j|d<|j s|j tj krtj|j dz|d<|j |d<|j|d <|j tj krHtj|j|d <||j|jt(jkrTtj|j|d <tj|j|d <tj|j|d <|S)Nrz/Filterrrr!rgrr-r.r%r"r#r$)rDictionaryObjectrrrrr{rr_compat_entriesrr$rrr~r BooleanObjectrrirrtrrrr)r|rs r6r~z%StandardSecurityHandler.as_pdf_object`s)++#.{;;y/ ;;t / ;;t +Idj,A,ABBt    F|5EEE ' 4T[1_ E EF9 |1133t }2244t <0@ @ @)0)>%**F% & MM$2@@BB C C C =<C C C#4T[AAF5M#4T[AAF5M&78LMMF8  r8rc |j}|j}|tjkr t ||j|j|\}}nEt||j|j |j|j||j \}}|dd}|dd}||k|fS)NrR) rrrtrrrrrryrr)r|rr@r user_tokenuser_tok_suppliedrTs r6_auth_user_password_legacyz2StandardSecurityHandler._auth_user_password_legacyzsmZ 2< < <%7$*dj#&& " ss&9    %&& " s!2#2# 6 #CRCJ J.33r8c$ t||d}|j}t||j|j}|t jkrt||j}nH|j}tdddD]- t fd|D}t||}.|}| ||\} }| r||_ tj|fS| ||\} }| r||_ tj|fStjdfS)Nrc3"K|] }|z V dSrLr?)r`rais r6rbz?StandardSecurityHandler._authenticate_legacy..s'33!A333333r8)rrrryrrtrrrranger<r:rrOWNERUSERFAILED) r|rr@credrrT prp_userpassr}new_keyowner_password user_passwordr?s @r6_authenticate_legacyz,StandardSecurityHandler._authenticate_legacys1"##F#FGGm)(CIt{KK 2< < <&sDJ77LL*C2r2&& 0 03333s33333!'3//L"==c<PP  )#D #S( ("<|tjdt|}|||\}}|||_nd|_t'||jS) a Authenticate a user to this security handler. :param credential: The credential to use (a password in this case). :param id1: First part of the document ID. This is mandatory for legacy encryption handlers, but meaningless otherwise. :return: An :class:`AuthResult` object indicating the level of access obtained. z]Standard authentication credential must be a string, byte string or _PasswordCredential, not .rrNz+id1 must be specified for legacy encryptionT)statuspermission_flags)rDr&r% deserialiserrEr<rrrnativerrtr_authenticate_r6rrIrrrr)r| credentialrrresrTs r6 authenticatez$StandardSecurityHandler.authenticatesH j"6 7 7 H/;JGGJ*':C&GHH #+J''+++  j"5 6 6 8U#*C#K07Jm 29 9 9,,Z88HC{'A-Z88J00jAAHC ?"D   $D tzBBBBr8ct|}t|j}t|j}t |||jr)t j}t|||j |j}nAt ||r#t j }t|||j }nt j dfSttj|t!j}|}||j|z} | dddk} | |jt/jd| dddkz} t2| d} | | |jkz} n#t6$rd} YnwxYw| st9jd t=d |i|_||fS) N rzrErrrtintrr staticmethodrr$rr rr4r(r+r2r~r<r:rIrrSr rrPrrrs@r6rrs   5!!#F8$$' '  8$$' '  ;'')L)L J$w13EEF   ////[/  rr -rrrr[rh XXX[Xt\2BF9"9"'9"39"  9"&&>?9"9"9"9"9"9"v' "3' ' ' ' [' R  "3    [  44e4444,'''''626*C*C'*C *C*C*C*CZ*E*huo2M,N****Xr8rrL)Nabcenumrr dataclassesrhashlibrrrtypingrrr r asn1cryptor &cryptography.hazmat.primitives.ciphersr r rpyhanko.pdf_utilsrr_legacyrrrrr_utilrrrrapirrrrrr r!r"r#r$cred_serr%r& filter_mixinsr'r(r*rEr<rHrOrYrYrdrMunique VersionEnumrtSequencerABCrrrrrrrr4rregisterrr?r8r6rts  !!!!!!**********////////////LLLLLLLLLL++++++++LKKKKKKKKKKK                        CBBBBBBBCCCCCCCC CCCCCCC CuS%Z0UEI...'.2:5/.... $      e_     u--/e//// FJ#(3;E? <:::::t'7:: :4QQQQQ$-)?QQQ*+sw>     02E        02E     H % %;  $;;;;cccccocccL  344444r8