U
    c                  	   @   s   d dl m Z  d dlmZ d dlmZmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d d	lmZ d d
lmZ d dlmZmZ ddlmZ ddlmZmZmZmZmZ ddl m!Z!m"Z" e#dddhZ$ee$Z%de%dfe&e&ej'ej(e)ee ee  dddZ*ej+dddZ,dS )    )datetime)Optional)cmsx509)serialization)padding)DSAPublicKey)ECDSAEllipticCurvePublicKey)Ed448PublicKey)Ed25519PublicKey)RSAPublicKey)AlgorithmUsagePolicyDisallowWeakAlgorithmsPolicy   )AdESIndeterminate)MultivaluedAttributeErrorNonexistentAttributeErrorfind_unique_cms_attributeget_pyca_cryptography_hashprocess_pss_params   )DisallowedAlgorithmErrorSignatureValidationErrorsha1md5Zmd2FN)	signaturesigned_datacertsignature_algorithmmd_algorithmalgorithm_policy
time_indicc                 C   s&  |dk	r\|j |||jd}|s\d|d j d}	|jdk	rJ|	d|j 7 }	t|	|jdkdztd|ji}
W n t	k
r   d}
Y nX td|i}|
dk	r|

 |
 krtd|d j d	|d j tjd
t||d}t|j
 }|j}|dkr(t|tst|| |t | n|dkrjt|tsBtt|d ||d\}}|| ||| n|dkrt|tst|| || n|dkrt|tst|| |t| n`|dkrt|tst|| | n8|dkrt|tst|| | ntd| ddS )z1
    Validate a raw signature. Internal API.
    N)Zmoment
public_keyzSignature algorithm 	algorithmz, is not allowed by the current usage policy.z	 Reason: )Z	permanentzDigest algorithm z5 does not match value implied by signature algorithm )Zades_subindication)	prehashedZrsassa_pkcs1v15Z
rsassa_pss
parametersZdsaZecdsaZed25519Zed448zSignature mechanism z is not supported.)Zsignature_algorithm_allowedr#   nativeZfailure_reasonr   Znot_allowed_afterr   ZDigestAlgorithm	hash_algo
ValueErrordumpr   r   ZCRYPTO_CONSTRAINTS_FAILUREr   r   Zload_der_public_keyZsignature_algo
isinstancer   AssertionErrorverifyr   ZPKCS1v15r   r   r
   r	   r   r   NotImplementedError)r   r   r   r   r    r%   r!   r"   Zsig_algo_allowedmsgZsig_hash_algoZhash_algo_objZ	verify_mdZpub_keyZsig_algoZpss_paddingr(    r0   A/tmp/pip-unpacked-wheel-0kb_yl26/pyhanko/sign/validation/utils.pyvalidate_raw$   sx    
 
 


 





r2   )signer_infoc              	   C   s<   zt | d d}|jW S  ttfk
r6   tdY nX d S )NZsigned_attrsZmessage_digestzUMessage digest not found in signature, or multiple message digest attributes present.)r   r'   r   r   r   )r3   Zembedded_digestr0   r0   r1   extract_message_digests   s     r4   )-r   typingr   Z
asn1cryptor   r   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   Z-cryptography.hazmat.primitives.asymmetric.dsar   Z,cryptography.hazmat.primitives.asymmetric.ecr	   r
   Z/cryptography.hazmat.primitives.asymmetric.ed448r   Z1cryptography.hazmat.primitives.asymmetric.ed25519r   Z-cryptography.hazmat.primitives.asymmetric.rsar   Z!pyhanko_certvalidator.policy_declr   r   Zades.reportr   Zgeneralr   r   r   r   r   errorsr   r   	frozensetZDEFAULT_WEAK_HASH_ALGORITHMSZDEFAULT_ALGORITHM_USAGE_POLICYbytesZCertificateZSignedDigestAlgorithmstrr2   Z
SignerInfor4   r0   r0   r0   r1   <module>   s:     O