3
l�_\ � @ s� d dl mZmZmZ d dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dl m
Z
d dlmZ d dlmZmZ d dlmZmZmZ d dlmZ G d d
� d
e�Zd ZG d d
� d
e �Z G dd� de �Z dS )� )�absolute_import�division�print_functionN)�utils)�InvalidSignature)� _get_backend)�hashes�padding)�Cipher�
algorithms�modes)�HMACc @ s e Zd ZdS )� InvalidTokenN)�__name__�
__module__� __qualname__� r r � /usr/lib64/python3.6/fernet.pyr s r �< c @ sp e Zd Zddd�Zedd� �Zdd� Zdd � Zd
d � Zdd d
�Z dd� Z
dd� Z e dd� �Z
dd� Zdd� ZdS )�FernetNc C sL t |�}tj|�}t|�dkr&td��|d d� | _|dd � | _|| _d S )N� z4Fernet key must be 32 url-safe base64-encoded bytes.� )r �base64�urlsafe_b64decode�len�
ValueError� _signing_key�_encryption_key�_backend)�self�key�backendr r r �__init__ s
zFernet.__init__c C s t jtjd��S )Nr )r �urlsafe_b64encode�os�urandom)�clsr r r � generate_key, s zFernet.generate_keyc C s | j |ttj� ��S )N)�encrypt_at_time�int�time)r �datar r r �encrypt0 s zFernet.encryptc C s t jd�}| j|||�S )Nr )r$ r% �_encrypt_from_parts)r r+ � current_time�ivr r r r( 3 s
zFernet.encrypt_at_timec C s� t jd|� tjtjj�j� }|j|�|j � }t
tj| j �t j
|�| j�j� }|j|�|j � }dtjd|� | | }t| jtj� | jd�} | j|� | j � }
tj||
�S )Nr+ � �z>Q)r! )r � _check_bytesr �PKCS7r �AES�
block_size�padder�update�finalizer
r r �CBCr � encryptor�struct�packr
r r �SHA256r r# ) r r+ r. r/ r5 Z padded_datar9 �
ciphertextZ basic_parts�hZhmacr r r r- 7 s
zFernet._encrypt_from_partsc C s& t j|�\}}| j|||ttj� ��S )N)r �_get_unverified_token_data�
_decrypt_datar) r* )r �token�ttl� timestampr+ r r r �decryptJ s zFernet.decryptc C s. |d krt d��tj|�\}}| j||||�S )Nz6decrypt_at_time() can only be used with a non-None ttl)r r r? r@ )r rA rB r. rC r+ r r r �decrypt_at_timeN s
zFernet.decrypt_at_timec C s t j|�\}}| j|� |S )N)r r? �_verify_signature)r rA rC r+ r r r �extract_timestampV s
zFernet.extract_timestampc C s� t jd| � ytj| �}W n ttjfk
r8 t�Y nX | sPtj |d�dkrTt�yt
j d|dd� �\}W n t
j k
r� t�Y nX ||fS )NrA r � z>Q� � )
r r1 r r � TypeError�binascii�Errorr �sixZ
indexbytesr: �unpack�error)rA r+ rC r r r r? \ s
z!Fernet._get_unverified_token_datac C s\ t | jtj� | jd�}|j|d d� � y|j|dd � � W n tk
rV t�Y nX d S )N)r! r i����i����) r
r r r< r r6 Zverifyr r )r r+ r> r r r rF m s zFernet._verify_signaturec C s� |d k r(|| |k rt �|t |k r(t �| j|� |dd� }|dd� }ttj| j�tj|�| j �j
� }|j |�}y||j � 7 }W n t
k
r� t �Y nX tjtjj�j� } | j |�}
y|
| j � 7 }
W n t
k
r� t �Y nX |
S )NrJ � r i����)r �_MAX_CLOCK_SKEWrF r
r r3 r r r8 r � decryptorr6 r7 r r r2 r4 �unpadder) r r+ rC rB r. r/ r= rS Zplaintext_paddedrT Zunpaddedr r r r@ u s,
zFernet._decrypt_data)N)N)r r r r" � classmethodr' r, r( r- rD rE rG � staticmethodr? rF r@ r r r r r s
r c @ s> e Zd Zdd� Zdd� Zdd� Zdd� Zdd
d �Zd d
� Zd S )� MultiFernetc C s t |�}|std��|| _d S )Nz1MultiFernet requires at least one Fernet instance)�listr �_fernets)r Zfernetsr r r r" � s
zMultiFernet.__init__c C s | j |ttj� ��S )N)r( r) r* )r �msgr r r r, � s zMultiFernet.encryptc C s | j d j||�S )Nr )rY r( )r rZ r. r r r r( � s zMultiFernet.encrypt_at_timec C sl t j|�\}}x>| jD ]0}y|j||d d �}P W q tk
rD Y qX qW t�tjd�}| jd j|||�S )Nr r )r r? rY r@ r r$ r% r- )r rZ rC r+ �f�pr/ r r r �rotate� s
zMultiFernet.rotateNc C s: x0| j D ]&}y |j||�S tk
r, Y qX qW t�d S )N)rY rD r )r rZ rB r[ r r r rD � s
zMultiFernet.decryptc C s< x2| j D ](}y|j|||�S tk
r. Y qX qW t�d S )N)rY rE r )r rZ rB r. r[ r r r rE � s
zMultiFernet.decrypt_at_time)N) r r r r" r, r( r] rD rE r r r r rW � s
rW ) Z
__future__r r r r rL r$ r: r* rN Z cryptographyr Zcryptography.exceptionsr Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r Z&cryptography.hazmat.primitives.ciphersr
r r Z#cryptography.hazmat.primitives.hmacr
� Exceptionr rR �objectr rW r r r r � s u