mg,LdZddlmZddlmZmZmZmZmZm Z m Z m Z  ddl Z ddl m Z mZmZmZddl mZmZddlmZddlmZd Zd d lmZd d lmZmZd dlm Z m!Z!m"Z"d dlm#Z#m$Z$ede e%e&e'dffZ(ee'e&fZ)ee)dfZ*erejVeejXeiZ-ej\ej^ej`ejbej^ejdej`ej\ej^ejfejhejjd Z6Gdde"Z7GddZ8d"d dddddde'dee'de%dee'deedee'deedee7fd Z9yd"d dddddde'dee'de%dee'deedee'deededfd!Z9y#eef$rd ZY^wxYw)#zPKCS#11 smart card handler) TracebackType)DictListOptionalSequenceTupleTypeUnioncastN) AttributeKeyType Mechanism ObjectClass) PrivateKeyToken)encode_rsa_public_key)encode_ec_public_keyTF) BytesOrStr)MPIntString)SSHCertificateSSHKey SSHKeyPair)import_certificate_chainimport_public_keyr rSSHPKCS11Session) sssh-rsas rsa-sha2-256s rsa-sha2-512sssh-rsa-sha224@ssh.comsssh-rsa-sha256@ssh.comsssh-rsa-sha384@ssh.comsssh-rsa-sha512@ssh.coms rsa1024-sha1srsa2048-sha256secdsa-sha2-nistp256secdsa-sha2-nistp384secdsa-sha2-nistp521c ZeZdZdZdZ d dddededeeffd Z dd Z d e d e fd Z xZ S)SSHPKCS11KeyPairz3Surrogate for a key accessed via a PKCS#11 providerpkcs11sessionrprivkeypubkeycertc t||j|j|j|j|j|j |d||_||_y)NT) use_executor)super__init__ algorithmsig_algorithms public_datalabel_session_privkey)selfr!r"r#r$ __class__s /lib/python3.12/site-packages/asyncssh/pkcs11.pyr(zSSHPKCS11KeyPair.__init__FsZ G V--v/?/?#22F4I4I#//*.  0 $DM#DMreturnc8|jjyN)r-closer/s r1__del__zSSHPKCS11KeyPair.__del__Ps MM   !r2datac|j}|jdr|dd}|jj|t|}|jj t jk(rWt|dz}tj|d|d}tj||dd}t|t|z}t|t|zS)z*Sign a block of data with this private keysx509v3-N) mechanismbig) sig_algorithm startswithr.sign mechanismskey_typer EClenint from_bytesrr)r/r9r?siglengthrss r1rAzSSHPKCS11KeyPair.signSs!..M'' 3 -ab 1 --$$TZ 5N$OC}}%%3SQNN3w<7NN3vw<7Ahq)-(6#;6 6r2r5r3N)__name__ __module__ __qualname____doc__ _key_typerrrrr(r8bytesrA __classcell__)r0s@r1rrAsSA GK $$6 $ $# $+3N+C $ " 7U 7u 7r2rc eZdZUdZiZeed<dedede e fdZ ddZ d e ed ed edd fd Zedede e ddfdZddZdede e de edeefdZy )rz>Work around PKCS#11 sessions not supporting simultaneous opens _sessionstoken_idtokenpincN||_|j||_d|_y)N)user_pinr) _token_idopenr- _refcount)r/rVrWrXs r1r(zSSHPKCS11Session.__init__ks"%DN!JJJ4DMDNr2r3c|S)z6Allow SSHPKCS11Session to be used as a context managerr7s r1 __enter__zSSHPKCS11Session.__enter__qs Kr2 _exc_type _exc_value _tracebackNc$|jy)z.Drop one reference to the session when exitingN)r6)r/rarbrcs r1__exit__zSSHPKCS11Session.__exit__vs JJLr2c|j|jf} |j|}|xjdz c_|S#t$r||||}||j|<Y;wxYw)z1Open a new session, or return an already-open oner)manufacturer_idserialrUKeyErrorr])clsrWrXrVr!s r1r\zSSHPKCS11Session.open}sp--u||>2#r2 load_certs key_labelkey_idc .t|trtj|}tj t jtjdi}|||tj<|||tj<tj t ji}|r|jj|Dcgc],}ttt|tj .}}|Dcic]2}|r.dt|j"vr|j$j&|4}}ni}g} |jj|D]} tt(| } t*j-| j.} | s5t1| | } |j-| j&}|r| j3t5|| | || j3t5|| | |xj6t9| z c_| Scc}wcc}w)z+Return the private keys found on this tokenTAttest) isinstancestrrRfromhexr CLASSr PRIVATE_KEYSIGNLABEL OBJECT_ID CERTIFICATEr- get_objectsrr VALUEsubjectkeyr+rencodersgetrCrappendrr]rE)r/rlrmrn key_attrs cert_attrsr$certscertdictkeysr}r"encoderr#s r1get_keyszSSHPKCS11Session.get_keyss &#&v.$-OO[5L5L$-NND$:I$-6 )//*!17 )--.%.__k6M6M$NJ&*]]%>%>z%JL%JT2eT)//%:;=%JLDIK54#DLL8I(I!HH00$65KD}}00;z3/",,w'7'78.ww/?@F#<<(:(:;D $4T75;T%CDKK 0w GH< NNc$i 'NK9LKs ?1H 67H)r3rrL)rMrNrOrPrU _SessionMap__annotations___TokenIDrrrrr(r`r BaseExceptionrre classmethodr\r6boolrrrrr_r2r1rrfsL!# ;# X e "3-     d=&9 !. !. 37   U # ;M    30 t0  0 %j10 )*0 r2)rl token_label token_serialrmrnproviderrXrlrrrmrnr3c @tj|}g}t|tr|j d}|j ||D]C} t j| |5} |j| j|||dddE|S#1swYQxYw)a Load PIV keys and X.509 certificates from a PKCS#11 token This function loads a list of SSH keypairs with optional X.509 cerificates from attached PKCS#11 security tokens. The PKCS#11 provider must be specified, along with a user PIN if the tokens are set to require one. By default, this function loads both private key handles and the X.509 certificates associated with them, allowing for X.509 certificate based auth to SSH servers that support it. To disable loading of these certificates and perform only key-based authentication, load_certs may be set to `False`. If token_label and/or token_serial are specified, only tokens matching those values will be accessed. If key_label and/or key_id are specified, only keys matching those values will be loaded. Key IDs can be specified as either raw bytes or a string containing hex digits. .. note:: If you have an active asyncio event loop at the time you call this function, you may want to consider running it via a call to :meth:`asyncio.AbstractEventLoop.run_in_executor`. While retrieving the keys generally takes only a fraction of a second, calling this function directly could block asyncio event processing until it completes. :param provider: The path to the PKCS#11 provider's shared library. :param pin: (optional) The PIN to use when accessing tokens, if needed. :param load_certs: (optional) Whether or not to load X.509 certificates from the security tokens. :param token_label: (optional) A token label to match against. If set, only security tokens with this label will be accessed. :param token_serial: (optional) A token serial number to match against. If set, only security tokens with this serial number will be accessed. :param key_label: (optional) A key label to match against. If set, only keys with this label will be loaded. :param key_id: (optional) A key ID to match against. If set, only keys with this ID will be loaded. :type provider: `str` :type pin: `str` :type load_certs: `bool` :type token_label: `str` :type token_serial: `bytes` or `str` :type key_label: `str` :type key_id: `bytes` or `str` :returns: list of class:`SSHKeyPair` zutf-8)rrN) r librqrrencode get_tokensrr\extendr) rrXrlrrrmrnrrrWr!s r1load_pkcs11_keysrsFjj"') lC ('..w7L^^ 1=$?E!&&uc2g G,,ZFKL32?  32s %#BB ctdd)z,Report that PKCS#11 support is not availablezPKCS#11 support not availableN) ValueError)rrXrlrrrmrns r1rrs89tCr2r5):rPtypesrtypingrrrrrr r r r r r rrrrpkcs11.util.rsarpkcs11.util.ecrpkcs11_available ImportErrorModuleNotFoundErrormiscrpacketrr public_keyrrrrrrrRrr _AttrDictrrRSArDr~ SHA1_RSA_PKCSSHA256_RSA_PKCSSHA512_RSA_PKCSSHA224_RSA_PKCSSHA384_RSA_PKCS ECDSA_SHA256 ECDSA_SHA384 ECDSA_SHA512rBrrrr_r2r1rsZ*!KKKAA(53!::C eD%m$CDD E e 8//0  2 13H.7-D-D-6-F-F-6-F-F-6-F-F-6-F-F-6-F-F-6-F-F-6-D-D-6-F-F-6-C-C-6-C-C-6-C-C EJ"7:"7J__DO,06:>B488< O3OXc]O%)O&.smO(0 ';O%-SM O "**!5 O % & Ob D,06:>B488< D3 DXc] D%) D&.sm D(0 '; D%-SM D "**!5 D ' ( Dq ()s&F F#"F#