/
var
/
opt
/
nydus
/
ops
/
customer_local_ops
/
util
/
__pycache__
/
up file
home
� =�j�, � � � d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm Z m Z m Z m Z d dl mZ d dlmZ d dlmZmZ d dlmZmZ d d lmZmZ d e d efd �Zd e ee f d efd�Z G d� d� Z G d� d� Z G d� d� Z y)� N)� b64decode� b64encode)�Path)�AnyStr�Optional�Union�cast)�x509)�Fernet)�hashes� serialization)�MGF1�OAEP)�aes_cbc_pkcs7_encrypt�aes_cbc_pkcs7_decrypt�data�returnc �d � t | t � r| j d� } t t | � S )a Convert a Python `str` object to a `bytes` object. If the parameter is already a `bytes` object, return it unmodified. :param data: The object to be converted :return: The converted object, or the original object if it was not a `str` object �utf-8)� isinstance�str�encoder �bytes)r s �R/opt/nydus/tmp/pip-target-hb7welcc/lib/python/customer_local_ops/util/encryptor.py� _make_bytesr s) � � �$�� ��{�{�7�#�� ��t� � � �key_pathc �� � | � t d� �t | t � r t | � } | j � st dj | �� � �| j � S )a. Convenience function to load the content of a key or cert file and return its contents. :param key_path: Path to the key/cert file to be loaded :return: The file contents as a bytes object :raises: ValueError if the key_path parameter is None of doesn't point to an existing file z!key_path parameter cannot be Nonez$key path '{key_path}' does not exist�r )� ValueErrorr r r �is_file�format� read_bytesr s r �load_key_contentr$ ! s_ � � ���<�=�=��(�C� ���>�� � � � ��?�F�F�PX�F�Y�Z�Z� � � � � r c �L � e Zd ZdZedededefd�� Zedededefd�� Z y) � Encryptor� �encrypted_data� secret_keyr c � � t t |� � }|d| j }|| j d }t |� }t j |� j � }t |||� j d� S )a� Decrypt encrypted data using the PKCS7 symmetric decryption algorithm :param encrypted_data: Base-64 encoded byte array containing encrypted data, which is a combination of the salt and the actual data :param secret_key: Secret value used to generate an encryption key :return: Decrypted, plain text value Nr )r r �_Encryptor__iv_size�hashlib�sha256�digestr �decode)�clsr( r) � decoded_data�ivr �secret_key_bytes�hashed_secret_keys r �decryptzEncryptor.decrypt9 sr � � !��^�!<�=� � �.�3�=�=� )���C�M�M�N�+��&�z�2�� #�N�N�+;� <� C� C� E��$�%6��b�A�H�H��Q�Qr �unencrypted_datac �� � t j | j � }t |� }t |� }t j |� j � }t |||� \ }}t ||z � S )a# Encrypts data using the PKCS7 symmetric encryption algorithm :param unencrypted_data: Data to be encrypted :param secret_key: Secret value used to generate an encryption key :return: Base-64 encoded byte array containing encrypted value ) �os�urandomr+ r r, r- r. r r ) r0 r6 r) �iv_bytes�plain_text_bytesr3 r4 r2 r( s r �encryptzEncryptor.encryptK sl � � �:�:�c�m�m�,��&�'7�8��&�z�2�� #�N�N�+;� <� C� C� E�� 2�3D�FV�X`� a���N���n�,�-�-r N) �__name__� __module__� __qualname__r+ � classmethodr r r5 r r< � r r r& r& 6 s\ � ��I��R�V� R�� R�C� R� �R�" �.�v� .�6� .�e� .� �.r r& c � � e Zd ZdZ ej � Z e ee�� ed�� Z e de de de e fd�� Ze d e d e de e fd �� Zy) �SmallPayloadEncryptora� Utility class that provides methods to encrypt and decrypt small-ish payloads via an asymmetric (public/private key) algorithm. The definition of "small" depends on the size of the encryption key and the type of padding algorithm used. For example, given a key size of 4096 bytes and the type of padding used by this set class, the maximum size of a payload that can be encrypted is 447 bytes. )� algorithmN)�mgfrD �labelr( �decryption_key_contentr c �� � |�y|� t d� �t t |� � }t j |d�� }|j || j � j d� S )a� Decrypts data encrypted by the `encrypt()` method in this class. :param encrypted_data: The data to be decrypted :param decryption_key_content: The content of the OpenSSL private key file corresponding to the public cert used to encrypt the data :return: The decrypted data :raises: ValueError if decryption_key_content` is None N�$decryption_key_content can't be None)�passwordr )r r r r �load_pem_private_keyr5 � _SmallPayloadEncryptor__paddingr/ )r0 r( rG �decryption_keys r r5 z SmallPayloadEncryptor.decrypth sd � � � !�� !� )� � C�D� D�"�;�~�#>�?��&�;�;�<R�]a�b�� �%�%�n�c�m�m�D�K�K�G�T�Tr r6 �encryption_key_contentc �� � |�y|� t d� �t |� }t j |� }|j � }t |j || j � � S )a� Encrypts any small payload using an RSA asymmetric key algorithm. The maximum size of the payload depends on the size of the encryption key. For example, given a key size of 4096 bits, the maximum size of the payload that can be encrypted is 447 bytes. :param unencrypted_data: The data to be encrypted :param encryption_key_content: The content of the OpenSSL X509 public certificate that will be used to encrypt the data :return: The base64 encoded and encrypted data as a bytes object :raises: ValueError if the payload size is too large :raises: ValueError if `encryption_key_content` is None N�$encryption_key_content can't be None)r r r �load_pem_x509_certificate� public_keyr r< rL )r0 r6 rN �encryption_cert�encryption_keys r r< z SmallPayloadEncryptor.encrypt~ sg � � � #�� !� )� � C�D� D�&�'7�8�� �8�8�9O�P��(�3�3�5��� �/�/�0@�#�-�-�P�Q�Qr )r= r> r? �__doc__r �SHA256�&_SmallPayloadEncryptor__hash_algorithmr r rL r@ r r r r r5 r< rA r r rC rC ] s� � �� %�v�}�}�����(8�9�EU�]a�b�I��U�V� U�U� U�x�X[�}� U� �U�* �R�v� R�u� R�QY�Z_�Q`� R� �Rr rC c �X � e Zd ZdZedededee fd�� Z edededee fd�� Z y ) �LargePayloadEncryptora This class provides methods to encrypt and decrypt large payloads via the Fernet symmetric encryption algorithm. The `encrypt()` method automatically generates a key for encryption. That key is then encrypted using the asymmetric public/private key algorithm of the `SmallPayloadEncrypter.encrypt()` method and is included in the resulting byte stream returned by this classes' `encrypt()` method. The "receiving" endpoint must then extract the Fernet key from the byte stream and use the corresponding private key of public/private key pair to decrypt the Fernet key. The decrypted Fernet key can then be used to decrypt the remainder of the payload. The only known restriction on payload size is that the payload must fit into memory. r( rG r c �� � |�y|� t d� �t |� }t j t |� j d� � }|j d� }|� t d� �t |� }t t t j ||� � }t |� }t t t |� � }|j |d j d� � j d� S )a� Decrypts data encrypted by the `encrypt()` method of this class. The decryption algorithm is 1. Decode the base-64 representation of the JSON object 2. Load the JSON into a Python dictionary 3. Extract the encrypted Fernet key from the JSON object and decrypt it using our asymmetric decryption algorithm, i.e., the same algorithm we use to decrypt passwords. 4. Extract the encrypted data from the JSON object and decrypt it using the Fernet decryption algorithm. :param encrypted_data: The data to be decrypted :param decryption_key_content: The content of the OpenSSL private key file corresponding to the public cert used to encrypt the data :return: The decrypted data as a `str` object :raises: ValueError if the decryption key is missing from the `encrypted_data` payload :raises: ValueError if decryption_key_content` is None NrI r �keyz0token decryption key is missing from the payload�token)r r �json�loadsr r/ �getr r rC r5 r r r )r0 r( rG � json_object�encrypted_token_key�decrypted_token_key�fernet_encryptors r r5 z LargePayloadEncryptor.decrypt� s� � �& � !�� !� )� � C�D� D�$�^�4���j�j��>�!:�!A�!A�'�!J�K� � )�o�o�e� 4�� � &� � O�P� P� )�*=� >�� #�3�(=�(E�(E�FY�[q�(r� s�� )�*=� >��!�$�u�.A�"B�C�� �'�'� �G�(<�(C�(C�G�(L�M�T�T�U\�]�]r r6 rN c � � |�y|� t d� �t |t � r|j d� }t j � }t |� }t j ||� j d� |j t t |� � j d� d�}t t j |� j d� � S )a� Encrypts arbitrary data. This method uses a symmetric encryption algorithm (Fernet) to encrypt the data. This algorithm is capable of encrypting much larger payloads than asymmetric algorithms like RSA, which are limited by the key size and padding, if used. The encryption process is 1. Generate a random encryption key 2. Use that key to encrypt the original data. 3. Encrypt the key generated in step 1 by our asymmetric encryption algorithm, i.e., the same algorithm we use to encrypt passwords. This step may or may not use the same public/private keys we use for password encryption. 4. Create a Python dictionary with two entries: key: the encrypted Fernet key token: the data that was encrypted with the Fernet key Both the dictionary keys and values must be of type `str`, not `bytes`, to be JSON serializable. 5. Serialize the dictionary as a JSON string 6. Return a base-64 encoded representation of the JSON. :param unencrypted_data: The data to be encrypted :param encryption_key_content: The content of the OpenSSL X509 public certificate that will be used to encrypt the data :return: The encrypted key/text pair as a base-64 encoded `bytes` object :raises: ValueError if `encryption_key_content` is None NrP r )r[ r\ )r r r r r � generate_keyrC r< r/ r r r r] �dumps)r0 r6 rN r[ rc �results r r< z LargePayloadEncryptor.encrypt� s� � �8 � #�� !� )� � C�D� D� �&�� ,� /� 6� 6�w� ?� ��!�!�#��!�#�;�� )�0�0��6L�M�T�T�U\�]�%�-�-�d�5�:J�.K�L�S�S�T[�\� �� ����F�+�2�2�7�;�<�<r N) r= r> r? rU r@ r r r r r5 r< rA r r rY rY � sk � � � �%^�V� %^�U� %^�x�X[�}� %^� �%^�N �+=�v� +=�u� +=�QY�Z_�Q`� +=� �+=r rY )!r, r] r8 �base64r r �pathlibr �typingr r r r � cryptographyr �cryptography.fernetr � cryptography.hazmat.primitivesr r �1cryptography.hazmat.primitives.asymmetric.paddingr r �oscrypto.symmetricr r r r r r$ r& rC rY rA r r �<module>rp s~ �� � � � '� � 0� 0� � &� @� H� K� �f� �� � !�u�T�3�Y� /� !�E� !�*$.� $.�N9R� 9R�xb=� b=r