관리-도구
편집 파일: digest.cpython-39.pyc
a f�Wc>� � @ s8 d Z ddlmZ ddlZddlZe�e�Zz(ddlmZ e j dkrPe� d� dZ W n e yh dZ Y n0 ddl Z ddlZddlmZ ddlmZ zddlmZ W n e y� dZY n0 dd lmZ dd lmZmZmZmZm Z m Z dd l m Z m Z m!Z!m"Z"m#Z# dd l$m%Z% g d �Z&dZ'dZ(g d�Z)dddddddddddddddd �Z*d d � Z+i Z,d d � Z-d!d"� Z.dVd%d&�Z/e,j0e/_1dWd'd(�Z2G d)d*� d*e �Z3d#a4e5g d+��Z6dXd,d-�Z7e ej8�9d.���r�e7� ed/d0� e d1�D ��Z:ed2d0� e d1�D ��Z;dYd3d4�Z<dZd5d6�Z=ed7�j>Z?d[d8d9�Zej8�9d:��p(d;Z@e"�r\e@d<v �r\dd=lAmBZB d>d?� ZCd@dA� ZDdBZEnve@dCv �r�ddlmZ ddDlmFZF eFdEkZGi ZHdFd?� ZCdGZEn:e@dHv �s�J �ddIlImJZK ddJlmLZL dKd?� ZCdLdA� ZDdMZEe@eEk�r�d ZZ dNdO� e�r�dPnde �r dQnddReE fD �ZMdPeMv �r dSZNndQeMv �r0dTZNndUZNdS )\zlpasslib.crypto.digest -- crytographic helpers used by the password hashes in passlib .. versionadded:: 1.7 � )�divisionN)� pbkdf2_hmac�hashlibz*ignoring pure-python hashlib.pbkdf2_hmac())�Struct)�warn)�exc)� join_bytes� to_native_str�join_byte_values�to_bytes� SequenceMixin�as_bool)�irange� int_types�unicode_or_bytes_types�PY3� error_from)�memoized_property)� lookup_hash�HashInfo�norm_hash_name� compile_hmac�pbkdf1r l �� l ���� ) )�md2r )�md5r )�sha1zsha-1)�sha224zsha-224zsha2-224)�sha256zsha-256zsha2-256)�sha384zsha-384zsha2-384)�sha512zsha-512zsha2-512)�blake2bzblake-2b)�blake2szblake-2s)�md4r" )Z ripemd160z ripemd-160Zripemd)�@ � )� r# )� r# )� r# )� r# )�0 r$ )r( � )r% � )r) �h )r# �H )r& � )r r! r" r r r r r �sha3_224�sha3_256�sha3_384�sha3_512r Zshake128Zshake256c C s< i } t tjtdg�B �D ] }t|�}|j|jf| |j< q| S )z� internal helper used to generate ``_fallback_info`` dict. currently only run manually to update the above list; not invoked at runtime. r" )�sortedr Zalgorithms_available�setr � digest_size� block_size�name)�outZalg�info� r: �9/usr/lib/python3.9/site-packages/passlib/crypto/digest.py�_gen_fallback_infoz s r< c C s | }t | t�st| dd�} t�dd| �� �� �} | �d�r\| dd� } | �d�r\| dd � } d d � }|| �}|rt|S t� d | �}|r�|� d dd�\}}}|r�||7 }|}|r�|d| 7 }|r�|d7 }||7 }||�}|r�|S t � d|||� n | }| � dd�}t �d|||� ||fS )aA internal helper used by :func:`lookup_hash` -- normalize arbitrary hash name to hashlib format. if name not recognized, returns dummy record and issues a warning. :arg name: unnormalized name :returns: tuple with 2+ elements: ``(hashlib_name, iana_name|None, ... 0+ aliases)``. zutf-8z hash namez[_ /]�-zscram-� Nz-plus���c S s t D ]}| |v r| S qd S �N)�_known_hash_names)r7 �rowr: r: r; � check_table� s z&_get_hash_aliases.<locals>.check_tablez8(?i)^(?P<name>[a-z]+)-?(?P<rev>\d)?-?(?P<size>\d{3,4})?$r7 �rev�size�_z0normalizing unrecognized hash name %r => %r / %rz;normalizing unrecognized hash name and format %r => %r / %r)� isinstance�strr �re�sub�strip�lower� startswith�endswith�match�group�logr9 �replaceZwarning) r7 ZorigrC �result�m� iana_namerD rE Z hashlib_namer: r: r; �_get_hash_aliases� sF � �rV c s� � � d�s2� dvr2z tt� �W S ty0 Y n0 tj�z�� d� W n tyX Y n,0 d � �fdd� }� |_d|_d� |_|S � dkr�d d l m } |S d S ) a internal helper used by :func:`lookup_hash` -- lookup hash constructor by name :arg name: name (normalized to hashlib format, e.g. ``"sha256"``) :returns: hash constructor, e.g. ``hashlib.sha256()``; or None if hash can't be located. rF )�newZ algorithms� c s �� | �S r@ r: ��msg�r7 Z new_ssl_hashr: r; �const� s z _get_hash_const.<locals>.constr zMwrapper for hashlib.new(%r), generated by passlib.crypto.digest.lookup_hash()r" r )r" N)rX ) rM �getattrr �AttributeErrorrW � ValueError�__name__� __module__�__doc__Zpasslib.crypto._md4r" )r7 r\ r" r: r[ r; �_get_hash_const� s* � rc FTc s^ t }z || W S ttfy$ Y n0 |r.d}d}t| t�r�t| �}|d � � sTJ �� | krtt� |d�}||| < |S t� �}|r�tr�� t vr�d � fdd� }n^t| t �r�| S t | �r�| }t|� j �}|d � t� �}|du r�n||u r�nd}nt �| d d ��t |||d �}|du�r|||< |�rZ|D ]4� � �r$|�� �d|fv �sNJ d � ��||� < �q$|S )af Returns a :class:`HashInfo` record containing information about a given hash function. Can be used to look up a hash constructor by name, normalize hash name representation, etc. :arg digest: This can be any of: * A string containing a :mod:`!hashlib` digest name (e.g. ``"sha256"``), * A string containing an IANA-assigned hash name, * A digest constructor function (e.g. ``hashlib.sha256``). Case is ignored, underscores are converted to hyphens, and various other cleanups are made. :param required: By default (True), this function will throw an :exc:`~passlib.exc.UnknownHashError` if no hash constructor can be found, or if the hash is not actually available. If this flag is False, it will instead return a dummy :class:`!HashInfo` record which will defer throwing the error until it's constructor function is called. This is mainly used by :func:`norm_hash_name`. :param return_unknown: .. deprecated:: 1.7.3 deprecated, and will be removed in passlib 2.0. this acts like inverse of **required**. :returns HashInfo: :class:`HashInfo` instance containing information about specified digest. Multiple calls resolving to the same hash should always return the same :class:`!HashInfo` instance. FTr ��requiredrX c s t d� ��d S )Nz4%r disabled for fips by passlib set_mock_fips_mode())r_ ��source�r7 r: r; r\ A s zlookup_hash.<locals>.constNzdigest name or constructor�digest)r\ �namesre z%r already in cache)rX )�_hash_info_cache�KeyError� TypeErrorrG r rV r rc �mock_fips_mode�_fips_algorithmsr �callabler7 r �ExpectedTypeError�get) ri Zreturn_unknownre �cacheZ cache_by_nameZ name_listr9 r\ Z other_constr: rh r; r � sR & r c C sR t | dd�}|jr$td|j tj� |dkr2|jS |dkr@|jS td|f ��dS )a< Normalize hash function name (convenience wrapper for :func:`lookup_hash`). :arg name: Original hash function name. This name can be a Python :mod:`~hashlib` digest name, a SCRAM mechanism name, IANA assigned hash name, etc. Case is ignored, and underscores are converted to hyphens. :param format: Naming convention to normalize to. Possible values are: * ``"hashlib"`` (the default) - normalizes name to be compatible with Python's :mod:`!hashlib`. * ``"iana"`` - normalizes name to IANA-assigned hash function name. For hashes which IANA hasn't assigned a name for, this issues a warning, and then uses a heuristic to return a "best guess" name. :returns: Hash name, returned as native :class:`!str`. Frd znorm_hash_name(): r Zianazunknown format: %rN) r �unknownr � error_textr �PasslibRuntimeWarningr7 rU r_ )r7 �formatr9 r: r: r; r s s r c @ sn e Zd ZdZdZdZdZdZdZdZ dZ dZ ddd�Z dd � Z d d � Zed d � �Zedd� �Zedd� �ZdS )r a� Record containing information about a given hash algorithm, as returned :func:`lookup_hash`. This class exposes the following attributes: .. autoattribute:: const .. autoattribute:: digest_size .. autoattribute:: block_size .. autoattribute:: name .. autoattribute:: iana_name .. autoattribute:: aliases .. autoattribute:: supported This object can also be treated a 3-element sequence containing ``(const, digest_size, block_size)``. Nr: FTc s6 |d � �_ |d �_|dd� �_� ��fdd�}|du rj|tv rPd� }nd� }d �_||� dS z |� }W n\ ty� } zDd t|��� v r�d � }nd � t|�j |f }||� W Y d}~dS d}~0 0 |�_ |j �_ |j �_ t |�� �|j k�r td �j ��|j �j k�r2td�j ||j f tj� dS )a initialize new instance. :arg const: hash constructor :arg names: list of 2+ names. should be list of ``(name, iana_name, ... 0+ aliases)``. names must be lower-case. only iana name may be None. r � � Nc sZ d� �fdd� }�r"|� ds"J �� �_ |�_zt� \�_�_W n tyT Y n0 dS )zc helper that installs stub constructor which throws specified error <msg>. rX c s t �� ���d S r@ )r ZUnknownHashErrorrf )rZ r7 r: r; r\ � s z8HashInfo.__init__.<locals>.use_stub_const.<locals>.constzshouldn't get hereN)rX )ru r\ �_fallback_infor5 r6 rl )rZ r\ �r7 re �selfrY r; �use_stub_const� s z)HashInfo.__init__.<locals>.use_stub_constzunsupported hash: %rzunknown hash: %rTzdisabled for fipsz%r hash disabled for fipsz)internal error in %r constructor (%s: %s)z"%r constructor failed sanity checkzEinconsistent digest name: %r resolved to %r, which reports name as %r)r7 rU �aliasesrA rt r_ rH rL �typer` r\ r5 r6 �lenri � RuntimeErrorr r rv )r| r\ rj re r} rZ �hash�errr: r{ r; �__init__� s< ��zHashInfo.__init__c C s d| j | j| jf S )Nz/<lookup_hash(%r): digest_size=%r block_size=%r))r7 r5 r6 �r| r: r: r; �__repr__ s �zHashInfo.__repr__c C s | j | j| jfS r@ )r\ r5 r6 r� r: r: r; � _as_tuple s zHashInfo._as_tuplec C s | j du S )zy whether hash is available for use (if False, constructor will throw UnknownHashError if called) N)ru r� r: r: r; � supported s zHashInfo.supportedc C s8 t sdS zt | jddd� W dS ty2 Y dS 0 dS )z5helper to detect if hash is supported by fastpbkdf2()N� p� srx TF)�_fast_pbkdf2_hmacr7 r_ r� r: r: r; �supported_by_fastpbkdf2$ s z HashInfo.supported_by_fastpbkdf2c C s8 t sdS zt | jddd� W dS ty2 Y dS 0 dS )z>helper to detect if hash is supported by hashlib.pbkdf2_hmac()Nr� r� rx TF)�_stdlib_pbkdf2_hmacr7 r_ r� r: r: r; �supported_by_hashlib_pbkdf20 s z$HashInfo.supported_by_hashlib_pbkdf2)T)r` ra � __qualname__rb r7 rU r~ r\ r5 r6 ru rt r� r� r� r r� r� r� r: r: r: r; r � s& � L r ) r r r r r r/ r0 r1 r2 Z shake_128Z shake_256c C s | a t�� dS )zW UT helper which monkeypatches lookup_hash() internals to replicate FIPS mode. N)rn r � clear_cache)�enabler: r: r; �_set_mock_fips_mode_ s r� ZPASSLIB_MOCK_FIPS_MODEc c s | ]}|d A V qdS )�\ Nr: ��.0�xr: r: r; � <genexpr>q rX r� � c c s | ]}|d A V qdS )�6 Nr: r� r: r: r; r� r rX c s� t | �}|\}}}|dks"J d��t|t�s8t|dd�}t|�}||krX||��� }|}||k rp|d|| 7 }||�t��j� ||�t ��j�|r�� �fdd�}n� �fdd�}||_ |S ) a� This function returns an efficient HMAC function, hardcoded with a specific digest & key. It can be used via ``hmac = compile_hmac(digest, key)``. :arg digest: digest name or constructor. :arg key: secret key as :class:`!bytes` or :class:`!unicode` (unicode will be encoded using utf-8). :param multipart: request a multipart constructor instead (see return description). :returns: By default, the returned function has the signature ``hmac(msg) -> digest output``. However, if ``multipart=True``, the returned function has the signature ``hmac() -> update, finalize``, where ``update(msg)`` may be called multiple times, and ``finalize() -> digest_output`` may be repeatedly called at any point to calculate the HMAC digest so far. The returned object will also have a ``digest_info`` attribute, containing a :class:`lookup_hash` instance for the specified digest. This function exists, and has the weird signature it does, in order to squeeze as provide as much efficiency as possible, by omitting much of the setup cost and features of the stdlib :mod:`hmac` module. r& zblock size too small�key�Zparam� c s �� � �� fdd�} � j | fS )z)generated by compile_hmac(multipart=True)c s � � } | � ��� � | �� S r@ ��updateri )�outer)� _outer_copy�innerr: r; �finalize� s z,compile_hmac.<locals>.hmac.<locals>.finalize)r� )r� �Z _inner_copyr� )r� r; �hmac� s zcompile_hmac.<locals>.hmacc s, � � }|� | � �� }|� |�� � |�� S )zgenerated by compile_hmac()r� )rZ r� r� r� r: r; r� � s ) r rG �bytesr r� ri � translate� _TRANS_36�copy� _TRANS_5C� digest_info) ri r� Z multipartr� r\ r5 r6 Zklenr� r: r� r; r t s$ r c C s� t | �\}}}t|dd�}t|dd�}t|t�s>t�|dd��|dk rNtd��|du r\|}nDt|t�svt�|d d ��n*|d k r�td ��n||kr�td ||f ��|| }t|�D ]} ||��� }q�|d|� S )a; pkcs#5 password-based key derivation v1.5 :arg digest: digest name or constructor. :arg secret: secret to use when generating the key. may be :class:`!bytes` or :class:`unicode` (encoded using UTF-8). :arg salt: salt string to use when generating key. may be :class:`!bytes` or :class:`unicode` (encoded using UTF-8). :param rounds: number of rounds to use to generate key. :arg keylen: number of bytes to generate (if omitted / ``None``, uses digest's native size) :returns: raw :class:`bytes` of generated key .. note:: This algorithm has been deprecated, new code should use PBKDF2. Among other limitations, ``keylen`` cannot be larger than the digest size of the specified hash. �secretr� �salt�int�roundsrx �rounds must be at least 1N� int or None�keylenr zkeylen must be at least 0z'keylength too large for digest: %r > %r) r r rG r r rq r_ r ri ) ri r� r� r� r� r\ r5 r6 �blockrF r: r: r; r � s* � r z>Lc s t |dd�}t �dd��t| �}|j}t�t�s>t��dd���dk rNtd��|du r\|}n*t|t�svt�|d d ��n|dk r�td ��|| d | }|tkr�t d ��|j r�t |j |��|�S |j r�t|j |��|�S t| |��t|�� t� ���fd d�td|d �D ��d|� S )a pkcs#5 password-based key derivation v2.0 using HMAC + arbitrary digest. :arg digest: digest name or constructor. :arg secret: passphrase to use to generate key. may be :class:`!bytes` or :class:`unicode` (encoded using UTF-8). :arg salt: salt string to use when generating key. may be :class:`!bytes` or :class:`unicode` (encoded using UTF-8). :param rounds: number of rounds to use to generate key. :arg keylen: number of bytes to generate. if omitted / ``None``, will use digest's native output size. :returns: raw bytes of generated key .. versionchanged:: 1.7 This function will use the first available of the following backends: * `fastpbk2 <https://pypi.python.org/pypi/fastpbkdf2>`_ * :func:`hashlib.pbkdf2_hmac` (only available in py2 >= 2.7.8, and py3 >= 3.4) * builtin pure-python backend See :data:`passlib.crypto.digest.PBKDF2_BACKENDS` to determine which backend(s) are in use. r� r� r� r� r� rx r� Nr� r� zkeylen must be at least 1zkeylen too long for digestc 3 s& | ] }� ���t |� ���V qd S r@ )� _pack_uint32�r� �i�Z calc_block� keyed_hmacr� r� r: r; r� c s �z pbkdf2_hmac.<locals>.<genexpr>)r r r5 rG r r rq r_ � MAX_UINT32� OverflowErrorr� r� r7 r� r� r �_get_pbkdf2_looperr r )ri r� r� r� r� r� r5 Z block_countr: r� r; r s8 $ ��r ZPASSLIB_PBKDF2_BACKEND�any)r� � from-bytes)�partialc C s t t| �S r@ )r� �_pbkdf2_looper�r5 r: r: r; r� r s r� c C sH t j}d}|||�}t|d �D ]}||�}||||�N }q |�| |�S )zk py3-only implementation of pbkdf2 inner loop; uses 'int.from_bytes' + integer XOR Zbigrx )r� � from_bytesr r )r5 r� ri r� r� ZBIG�accumrF r: r: r; r� u s r� r� )r� �unpackr� )�sys_bitsr# c C sD z t | W S ty Y n0 tr<| d@ s<| d? }d| }nD| d@ sttrb| d? }d| }|d7 }q�| d? }d| }n td| ��t|�}t| d �d d � t|�D ��d �d d � t|�D ��d �}djf i |��}t|�D ]}|d||f 7 }q�|djf i |��7 }t |dd�}tt|d�}t� } t ||| � | d } || _ | t | < | S )a) We want a helper function which performs equivalent of the following:: def helper(keyed_hmac, digest, rounds): accum = digest for _ in irange(rounds - 1): digest = keyed_hmac(digest) accum ^= digest return accum However, no efficient way to implement "bytes ^ bytes" in python. Instead, using approach where we dynamically compile a helper function based on digest size. Instead of a single `accum` var, this helper breaks the digest into a series of integers. It stores these in a series of`accum_<i>` vars, and performs `accum ^= digest` by unpacking digest and perform xor for each "accum_<i> ^= digest_<i>". this keeps everything in locals, avoiding excessive list creation, encoding or decoding, etc. :param digest_size: digest size to compile for, in bytes. (must be multiple of 4). :return: helper function with call signature outlined above. � � z=%dQz=%dQIrx ry z=%dIzunsupported digest size: %dz, c s s | ]}d | V qdS )zacc_%dNr: r� r: r: r; r� � rX z%_get_pbkdf2_looper.<locals>.<genexpr>c s s | ]}d | V qdS )zdig_%dNr: r� r: r: r; r� � rX )r5 Z accum_varsZ digest_varsa def helper(keyed_hmac, digest, rounds): '''pbkdf2 loop helper for digest_size={digest_size}''' unpack_digest = struct.unpack {accum_vars} = unpack_digest(digest) for _ in irange(1, rounds): digest = keyed_hmac(digest) {digest_vars} = unpack_digest(digest) z acc_%d ^= dig_%d z% return struct.pack({accum_vars}) z9<generated by passlib.crypto.digest._get_pbkdf2_looper()>�exec)r �struct�helper) � _looper_cacherl � _have_64_bit�NotImplementedErrorr �dict�joinr rw �compile�evalZ __source__) r5 �countZfmtr� Ztdictrg r� �codeZgdictZldictr� r: r: r; r� � sH ��� r� )r� �hexlify)r� )� int_to_bytesc C s t S r@ )r� r� r: r: r; r� � s c C sL t }t||�d�}t|d �D ] }| |�}|t||�d�N }q t|t|��S )Nr& rx )�_hexlifyr� r r� r� )r� ri r� r� r� rF r: r: r; r� s r� c C s g | ] }|r|�qS r: r: )r� �br: r: r; � <listcomp> s �r� � fastpbkdf2z hashlib-sslzbuiltin-r� gffffff�?rx )FT)r )T)F)N)N)Orb Z __future__r r ZloggingZ getLoggerr` rQ r r� ra �debug� ImportErrorrI �osr� r �warningsr r� r� Zpasslibr Z passlib.utilsr r r r r r Zpasslib.utils.compatr r r r r Zpasslib.utils.decorr �__all__r� Z MAX_UINT64rA rz r< rk rV rc r �clearr� r r rn r4 ro r� �environrr r� r� r r �packr� Z_force_backend� functoolsr� r� r� Z_builtin_backendr� r� r� Zbinasciir� r� r� ZPBKDF2_BACKENDSZPBKDF2_SPEED_FACTORr: r: r: r; �<module> s� $�@1 � v # 1 P ? h f �