DjE"2ddlmZddlZddlmZddlmZmZddlm Z ddl m Z m Z m Z mZddlmZddlmZdd lmZdd lmZmZmZd d lmZmZGd deZGddeZGddeZGddeZ GddeZ!eGddeZ"eGddZ#dZ$e$d+d Z%Gd!d"ej&Z'Gd#d$e'Z(Gd%d&e'Z)d'Z*d(Z+Gd)d*ej&Z,dS),) annotationsN) dataclass)IntEnumuniquewraps)AnyMappingSequencecast)x509)InvalidSignature)default_backend)ecpaddingrsa)AttestationObjectAuthenticatorDataceZdZdZdS)InvalidAttestationz.Base exception for attestation-related errors.N__name__ __module__ __qualname____doc__Q/home/thesage/.hermes/venv/lib/python3.11/site-packages/fido2/attestation/base.pyrr,s8888rrceZdZdZdS) InvalidDataz"Attestation contains invalid data.Nrrrrr!r!0s,,,,rr!ceZdZdZdS)rz7The signature of the attestation could not be verified.Nrrrrrr4sAAAArrceZdZdZdS)UntrustedAttestationz)The CA of the attestation is not trusted.Nrrrrr$r$8s3333rr$c$eZdZdZdfd ZxZS)UnsupportedTypez(The attestation format is not supported.Ncvt|rd|dnd||_||_dS)NzAttestation format "z" is not supportedz)This attestation format is not supported!)super__init__ auth_datafmt)selfr*r+ __class__s rr)zUnsupportedType.__init__?sO  = :3 : : : :<   #rN)rrrrr) __classcell__)r-s@rr&r&<sC22rr&c&eZdZdZdZdZdZdZdZdS)AttestationTypezSupported attestation types.rrN) rrrrBASICSELFATT_CAANON_CANONErrrr1r1Is-&& E D FG DDDrr1c(eZdZUdZded<ded<dS)AttestationResultz'The result of verifying an attestation.r1attestation_type list[bytes] trust_pathN)rrrr__annotations__rrrr;r;Ts011%%%%rr;c<tfd}|S)zDUtility decoractor to wrap common exceptions related to InvalidData.cr |i|S#tttf$r}t|d}~wwxYwr.) ValueErrorKeyError IndexErrorr!)argskwargsefs rinnerzcatch_builtins..inner_sO !1d%f%% %Hj1 ! ! !a..  !s 616r)rHrIs` rcatch_builtinsrJ\s5 1XX!!!!X! Lrchainr=returnNonecxd|D}|d}|r|}|d}|} t|tjrB|jJ||j|jtj |jnkt|tj rB|jJ||j|jtj |jntdn#t$rt!wxYw|dSdS)zVerifies a chain of certificates. Checks that the first item in the chain is signed by the next, and so on. The first item is the leaf, the last is the root. cPg|]#}tj|t$Sr)r load_der_x509_certificater).0ders r z%verify_x509_chain..ps+ U U UT +C1B1B C C U U UrrNzUnsupported signature key type)pop public_key isinstancer RSAPublicKeysignature_hash_algorithmverify signaturetbs_certificate_bytesrPKCS1v15rEllipticCurvePublicKeyECDSArB_InvalidSignaturer)rKcertscertchildpubs rverify_x509_chainrdish V Uu U U UE 99Q<.TypedUnsupportedAttestationcJtdSr.)r(r))r,r-r+s rr)zBAttestation.for_type..TypedUnsupportedAttestation.__init__s!  %%%%%r)rrrr)r/)r-r+s@rTypedUnsupportedAttestationrrs> & & & & & & & & & &rrt)rf__subclasses__getattrUnsupportedAttestation)r+clsrts` rfor_typezAttestation.for_types--//  CsHd++s22 3 & & & & & & &*@ & & &+*rN)rgrhr*rrirjrLr;)r+rmrLrn) rrrrabcabstractmethodrY staticmethodryrrrrfrfs\AA       + + +\ + + +rrfceZdZddZdZdS)rwNc||_dSr.)r+)r,r+s rr)zUnsupportedAttestation.__init__s rc,t||jr.)r&r+rls rrYzUnsupportedAttestation.verifysi222rr.)rrrr)rYrrrrwrws733333rrwceZdZdZdZdS)NoneAttestationnonec`|ikrtdttjgS)Nz*None Attestation requires empty statement.)r!r;r1r9rls rrYzNoneAttestation.verifys- ??JKK K !5r:::rN)rrrrprYrrrrrs( F;;;;;rrc|jtjjkrt d |jtj}|jj rt ddS#tj $rt dwxYw)Nz+Attestation certificate must use version 3!z+Attestation certificate must have CA=false!z4Attestation certificate must have Basic Constraints!) versionr Versionv3r! extensionsget_extension_for_classBasicConstraintsvaluecaExtensionNotFound)rabcs r_validate_cert_commonrs |t|&&GHHHR _ 4 4T5J K K 8; MKLL L M M  !RRRPQQQRs ?A,,B cHdtDS)Ncg|]?}t|dddkttt|@S)rpr)rvr typer )rQrxs rrSz)_default_attestations..sO     3& ) )V 3 3 T#Y 3 3 3r)rfrurrr_default_attestationsrs/  --//   rcLeZdZdZdddZejdd ZddZdZ dS)AttestationVerifierzBase class for verifying attestation. Override the ca_lookup method to provide a trusted root certificate used to verify the trust path from the attestation. Nattestation_typesSequence[Attestation] | Nonec0|p t|_dSr.)r_attestation_types)r,rs rr)zAttestationVerifier.__init__s"3"N7L7N7Nrattestation_resultr;r*rrL bytes | Nonect)zLookup a CA certificate to be used to verify a trust path. :param attestation_result: The result of the attestation :param auth_data: The AuthenticatorData from the registration )NotImplementedError)r,rr*s r ca_lookupzAttestationVerifier.ca_lookups"###rattestation_objectrrirjrMct|j}|jD] }t|dd|jkr|}n!||j|j|}|||j}|std t|j |gzdS#t$r}t|d}~wwxYw)zVerify attestation. :param attestation_object: dict containing attestation data. :param client_data_hash: SHA256 hash of the ClientData bytes. rpNzNo root found for Authenticator) rwr+rrvrYatt_stmtr*rr$rdr>r)r,rri att_verifieratresultrrGs rverify_attestationz&AttestationVerifier.verify_attestations%;;M;Q$R$R )  Br8T**.@.DDD! E $$  '  (   ^^F$6$@ A A J&'HII I * f/2$6 7 7 7 7 7 * * *&q)) ) *s B%% C/B>>Cc|j|dS)z?Allows passing an instance to Fido2Server as verify_attestationN)r)r,rEs r__call__zAttestationVerifier.__call__s&&&&rr.)rr)rr;r*rrLr)rrrirjrLrM) rrrrr)rzr{rrrrrrrrs OOOOO $$$$****B'''''rr)rKr=rLrM)- __future__rrz dataclassesrenumrr functoolsrtypingr r r r cryptographyr cryptography.exceptionsrr_cryptography.hazmat.backendsr)cryptography.hazmat.primitives.asymmetricrrrwebauthnrr Exceptionrr!r$r&r1r;rJrdABCrfrwrrrrrrrrs=8#""""" !!!!!! ////////////IIIIII888888FFFFFFFFFF;;;;;;;;99999999-----$---BBBBB)BBB44444-444     (        g        %%%%D+++++#'+++:33333[333;;;;;k;;; R R R8'8'8'8'8'#'8'8'8'8'8'r