o
    
þðcÃ  ã                   @   s¤   d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
mZ d dlmZmZmZ d dlmZ G dd„ deƒZd	ZG d
d„ dƒZG dd„ dƒZdS )é    N)Úutils)ÚInvalidSignature)ÚhashesÚpadding)ÚCipherÚ
algorithmsÚmodes)ÚHMACc                   @   s   e Zd ZdS )ÚInvalidTokenN)Ú__name__Ú
__module__Ú__qualname__© r   r   ú@/opt/certbot/lib/python3.10/site-packages/cryptography/fernet.pyr
      s    r
   é<   c                	   @   sV  e Zd Z	d"dejeef dejddfdd„Ze	defdd„ƒZ
d	edefd
d„Zd	ededefdd„Zd	edededefdd„Z	d"dejeef deje defdd„Zdejeef dededefdd„Zdejeef defdd„Zedejeef dejeef fdd„ƒZd	eddfdd„Zd	ededejejeef  defd d!„ZdS )#ÚFernetNÚkeyÚbackendÚreturnc              
   C   sh   zt  |¡}W n tjy } ztdƒ|‚d }~ww t|ƒdkr$tdƒ‚|d d… | _|dd … | _d S )Nz4Fernet key must be 32 url-safe base64-encoded bytes.é    é   )Úbase64Úurlsafe_b64decodeÚbinasciiÚErrorÚ
ValueErrorÚlenÚ_signing_keyÚ_encryption_key)Úselfr   r   Úexcr   r   r   Ú__init__   s    ÿþ€ÿÿzFernet.__init__c                 C   s   t  t d¡¡S )Nr   )r   Úurlsafe_b64encodeÚosÚurandom)Úclsr   r   r   Úgenerate_key.   s   zFernet.generate_keyÚdatac                 C   ó   |   |tt ¡ ƒ¡S ©N©Úencrypt_at_timeÚintÚtime)r   r'   r   r   r   Úencrypt2   ó   zFernet.encryptÚcurrent_timec                 C   s   t  d¡}|  |||¡S )Nr   )r#   r$   Ú_encrypt_from_parts)r   r'   r0   Úivr   r   r   r+   5   s   
zFernet.encrypt_at_timer2   c                 C   s¨   t  d|¡ t tjj¡ ¡ }| |¡| 	¡  }t
t | j¡t |¡ƒ ¡ }| |¡| 	¡  }d|jddd | | }t| jt ¡ ƒ}	|	 |¡ |	 	¡ }
t ||
 ¡S )Nr'   ó   €é   Úbig)ÚlengthÚ	byteorder)r   Ú_check_bytesr   ÚPKCS7r   ÚAESÚ
block_sizeÚpadderÚupdateÚfinalizer   r   r   ÚCBCÚ	encryptorÚto_bytesr	   r   r   ÚSHA256r   r"   )r   r'   r0   r2   r<   Úpadded_datar@   Ú
ciphertextÚbasic_partsÚhÚhmacr   r   r   r1   9   s,   
þýÿþýÿ
zFernet._encrypt_from_partsÚtokenÚttlc                 C   s:   t  |¡\}}|d u rd }n|tt ¡ ƒf}|  |||¡S r)   )r   Ú_get_unverified_token_datar,   r-   Ú_decrypt_data)r   rH   rI   Ú	timestampr'   Ú	time_infor   r   r   ÚdecryptR   s
   zFernet.decryptc                 C   s0   |d u rt dƒ‚t |¡\}}|  ||||f¡S )Nz6decrypt_at_time() can only be used with a non-None ttl)r   r   rJ   rK   )r   rH   rI   r0   rL   r'   r   r   r   Údecrypt_at_time\   s   ÿzFernet.decrypt_at_timec                 C   s   t  |¡\}}|  |¡ |S r)   )r   rJ   Ú_verify_signature)r   rH   rL   r'   r   r   r   Úextract_timestampf   s   
zFernet.extract_timestampc              	   C   s€   t | ttfƒstdƒ‚zt | ¡}W n ttjfy   t‚w |r'|d dkr)t‚t	|ƒdk r1t‚t
j|dd… dd}||fS )Nztoken must be bytes or strr   é€   é	   é   r5   )r7   )Ú
isinstanceÚstrÚbytesÚ	TypeErrorr   r   r   r   r
   r   r,   Ú
from_bytes)rH   r'   rL   r   r   r   rJ   l   s   ÿz!Fernet._get_unverified_token_datac                 C   sN   t | jt ¡ ƒ}| |d d… ¡ z| |dd … ¡ W d S  ty&   t‚w )Néàÿÿÿ)r	   r   r   rB   r=   Úverifyr   r
   )r   r'   rF   r   r   r   rP      s   ÿzFernet._verify_signaturerL   rM   c                 C   sÞ   |d ur|\}}|| |k rt ‚|t |k rt ‚|  |¡ |dd… }|dd… }tt | j¡t |¡ƒ 	¡ }| 
|¡}	z|	| ¡ 7 }	W n	 tyM   t ‚w t tjj¡ ¡ }
|
 
|	¡}z	||
 ¡ 7 }W |S  tyn   t ‚w )NrS   é   rZ   )r
   Ú_MAX_CLOCK_SKEWrP   r   r   r:   r   r   r?   Ú	decryptorr=   r>   r   r   r9   r;   Úunpadder)r   r'   rL   rM   rI   r0   r2   rD   r^   Úplaintext_paddedr_   Úunpaddedr   r   r   rK   ‰   s8   
ÿþ
ÿ
þÿzFernet._decrypt_datar)   )r   r   r   ÚtypingÚUnionrW   rV   ÚAnyr!   Úclassmethodr&   r.   r,   r+   r1   ÚOptionalrN   rO   rQ   ÚstaticmethodÚTuplerJ   rP   rK   r   r   r   r   r      sp    ýþý
üÿÿÿ
þÿÿÿ
þ
ÿÿÿ
þ
ÿþþýüûr   c                   @   s²   e Zd Zdeje fdd„Zdedefdd„Zdede	defd	d
„Z
dejeef defdd„Z	ddejeef deje	 defdd„Zdejeef de	de	defdd„ZdS )ÚMultiFernetÚfernetsc                 C   s   t |ƒ}|s
tdƒ‚|| _d S )Nz1MultiFernet requires at least one Fernet instance)Úlistr   Ú_fernets)r   rj   r   r   r   r!   ®   s   ÿ
zMultiFernet.__init__Úmsgr   c                 C   r(   r)   r*   )r   rm   r   r   r   r.   ¶   r/   zMultiFernet.encryptr0   c                 C   s   | j d  ||¡S )Nr   )rl   r+   )r   rm   r0   r   r   r   r+   ¹   s   zMultiFernet.encrypt_at_timec              	   C   sb   t  |¡\}}| jD ]}z
| ||d ¡}W  n ty   Y q
w t‚t d¡}| jd  |||¡S )Nr   r   )r   rJ   rl   rK   r
   r#   r$   r1   )r   rm   rL   r'   ÚfÚpr2   r   r   r   Úrotate¼   s   
ÿ
zMultiFernet.rotateNrI   c              	   C   s4   | j D ]}z	| ||¡W   S  ty   Y qw t‚r)   )rl   rN   r
   )r   rm   rI   rn   r   r   r   rN   Ê   s   
ÿzMultiFernet.decryptc              	   C   s6   | j D ]}z
| |||¡W   S  ty   Y qw t‚r)   )rl   rO   r
   )r   rm   rI   r0   rn   r   r   r   rO   Ô   s   
ÿzMultiFernet.decrypt_at_timer)   )r   r   r   rb   ÚIterabler   r!   rW   r.   r,   r+   rc   rV   rp   rf   rN   rO   r   r   r   r   ri   ­   s,    ÿÿÿ
þ
ÿÿÿþri   )r   r   r#   r-   rb   Úcryptographyr   Úcryptography.exceptionsr   Úcryptography.hazmat.primitivesr   r   Ú&cryptography.hazmat.primitives.ciphersr   r   r   Ú#cryptography.hazmat.primitives.hmacr	   Ú	Exceptionr
   r]   r   ri   r   r   r   r   Ú<module>   s    