ruạṛ
a ���fTO � @ s d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z m Z d dl m Z d dl mZmZ d dlmZmZ d dlmZmZmZ d d lmZmZmZmZ d d l m Z d d l m Z e e�!d d �d �Z"e"Z#dd� Z$dd� Z%G dd� de �Z&G dd� de �Z'dd� Z(dS )� N)�six)�default_backend)�Cipher�modes)�Lock)�serialize_header� deserialize_header_from_stream)�EncryptedDataHeader�$EncryptedDataHeaderDataEncryptionKey)� DEFAULT_MAX_GCM_ENCRYPTION_SIZE�DEFAULT_ALGORITHM�$DEFAULT_MAX_ENCRYPTION_SIZE_SENTINEL)�convert_to_bytes�convert_to_str�generate_random_iv�$convert_encryption_context_to_string)� Algorithm)�CryptoResultStream� � � c C sf d}t |�tkrVd}t|�}|t }|||� }t |�dkr>qb|| j|d�7 }|}q n | j|d�}|S )N� r )�data)�len�2MAX_ENCRYPTOR_DECRYPTOR_UPDATE_CHUNK_SIZE_IN_BYTES� memoryview�update)Zcryptorr �result� start_index�memviewZ end_indexZ next_data� r �E/usr/lib/python3.9/site-packages/oci/encryption/internal/streaming.py�_update_cryptor_with_data( s r" c C s& | d u r d S t | t�s td��g }g }g }t�| �D ]n\}}ttkrNt |t�sZt |tj�sf|�|� n|� d�rz|�|� ttkr�t |t�s�t |tj�s4|�|� q4|s�|r�td� t|�t|����|r�t d� t|����zt � | � W n8 t �y } z t d� t|����W Y d }~n d }~0 0 d S )Nz!encryption_context must be a dictzoci-zjencryption_context must be a dict with string keys and string values. Invalid keys: {}. Invalid values: {}zKencryption_context cannot contain keys with prefix 'oci-'. Invalid keys: {}z7encryption_context must be JSON serializable. Error: {})� isinstance�dict� TypeErrorr Z iteritems�str�bytesZ string_types�append� startswith�format� ValueError�json�dumps)�encryption_contextZ invalid_keysZinvalid_valuesZinvalid_prefix_keys�key�value�er r r! � _validate_encryption_context< s@ ���� �r2 c @ s\ e Zd Zedfdd�Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z ddd�Z dS )�StreamEncryptorNc C s t | _|�� | _| js td��| j�| j�| _|| _t|� || _ t t |��| _ t | jj�| _t| j�| jj�| j�| j�t� d�}|�� | _d| _|tu r�| jjjtjjkr�t| _q�td� t | j����n |dur�t |t �s�t d��|| _d| _!d| _"d| _#d| _$d| _%t&� | _'d| _(dS ) a� Provides a stream that wraps 'stream_to_encrypt' and allows reading data from the underlying stream encrypted under the provided master key. :param int max_encryption_size: (optional) Max number of bytes able to be encrypted by this StreamEncryptor. The default value differs based on the algorithm used. For GCM (the default algorithm) the default value is 2147483647 bytes. This is provided mainly for use with authenticated encryption algorithms that require verification of an authentication tag upon decryption. Because decrypting using these algorithms will buffer the entire payload into memory before returning it, this max_encryption_size provides a sanity check against encrypting payloads too large to decrypt. This is possible because encryption does not require holding the entire payload in memory. The 2147483647 byte limit was chosen because that is the maximum number of bytes that can be encrypted or decrypted by the OCI Java SDK. This is to avoid users accidentally encrypting payloads in Python that cannot be decrypted in Java. Explicitly passing this value as None will disable the size check and allow encrypting payloads up to the maximum size supported by the algorithm. :param dict encryption_context: (optional) Optional additional data to be provided as input to authenticated encryption algorithms. This must be a dict with keys that are strings and values that are strings. Keys may NOT match the prefix oci-* as that namespace is reserved for OCI internal keys that may be added to the AAD. zNmaster_key_provider must contain a primary master key in order to encrypt data�� algorithm�modeZbackendNz#Unrecognized algorithm provided: {}z/argument max_encryption_size must be an integerr r F))r � _algorithmZget_primary_master_key�_primary_master_keyr+ Z generate_data_encryption_key�_data_encryption_key�_stream_to_encryptr2 �_encryption_contextr r �_encryption_context_bytesr Ziv_len�ivr r5 Zplaintext_key_bytesr6 r � encryptor�_max_encryption_sizer �namer ZGCMr r* r& r# �intr% �_header_content�_buffer�_bytes_written_total� _bytes_written_excluding_header� _finalizedr �_lock�_closed)�self�master_key_providerZstream_to_encryptZmax_encryption_sizer. �cipherr r r! �__init__h sL ��� � zStreamEncryptor.__init__c C sF t | j�� | jj| jj| jjd�g}t|| j| j j | j d�}t |d�S )N)� master_key_id�vault_id�region�encrypted_data_key_bytes)�encrypted_data_keys�iv_bytes� algorithm_id�#additional_authenticated_data_bytes)�encrypted_data_header) r r8 Zget_identifierrN rO r9 Zencrypted_key_bytesr r= r7 �idr< r )rI rQ rU r r r! �_build_header_content� s �� �z%StreamEncryptor._build_header_contentc C s> | j �dtj�}| j �dtj� | j �� }| j �|� || S )Nr )r: �seek�os�SEEK_CUR�SEEK_END�tell)rI Zcur_pos�lengthr r r! �=_get_bytes_remaining_in_stream_to_encrypt_using_seek_and_tell� s zMStreamEncryptor._get_bytes_remaining_in_stream_to_encrypt_using_seek_and_tellc C sx | j | }|dkrNt| jd�rNt| jd�rNt| jd�rN| j�� rN| j | �� }| jd urt|| jkrttd�|| j���d S )N���rX r\ �seekablezqAttempted to encrypt > _max_encryption_size bytes. Total bytes requested to encrypt: {}. Max encryption size: {}.)rE �hasattrr: r` r^ r? r+ r* )rI �size_of_next_readZ!_total_bytes_requested_to_encryptr r r! � _enforce_max_encryption_size� s �. � ���z,StreamEncryptor._enforce_max_encryption_sizec C s | S �Nr �rI r r r! � __enter__� s zStreamEncryptor.__enter__c C s | � � d S rd ��close�rI �typer0 � tracebackr r r! �__exit__� s zStreamEncryptor.__exit__c C s6 | j �� zd| _d| _W | j �� n | j �� 0 d S �NTr �rG �acquirerH rC �releasere r r r! rh � s zStreamEncryptor.closec C s | j S rd )r; re r r r! �get_encryption_context� s z&StreamEncryptor.get_encryption_contextr_ c C s� | j �� �z�| jr td��|dkr4W | j �� dS |dk}| jsp| �� | _| j| j7 _| jrp| j � | j� | j |d� | j �s(|t | j�ks�|�r(|r�d}n|t | j� }d}|r�t| j�� �}nt| j�|��}t |�}t| j |�}||k p�|}|�r|| j �� | j j 7 }d| _ | j|7 _|�rD| jdd� }d| _n | jd|� }| j|d� | _| jt |�7 _| jt | j�k�r�| jt | j� | _nd| _| j dd� |W | j �� S | j �� 0 dS ) � Read up to size bytes from the object and return them. As a convenience, if size is unspecified or -1, all bytes until EOF are returned. If 0 bytes are returned, and size was not 0, this indicates end of file. :param int size: (optional) The number of bytes to attempt to read from the underlying stream. :rtype: bytes � Cannot read from closed streamr r r_ )rb FTN)rG ro rH r+ rp rB rW rC r< r> � authenticate_additional_datarc rF r r r: �readr" �finalize�tagrD rE ) rI �size�READ_ALLZsize_to_read_into_bufferZ reached_endZbytes_to_encryptZtotal_bytes_to_encrypt_sizeZ ciphertext�outputr r r! ru � sn K � � � � ��� �zStreamEncryptor.read)r_ ) �__name__� __module__� __qualname__r rL rW r^ rc rf rl rh rq ru r r r r! r3 g s � R r3 c @ sN e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z ddd�Z dS )�StreamDecryptorc C sB || _ || _d| _d| _d| _d| _d| _i | _t� | _ d| _ dS )a Returns a StreamDecryptor which produces decrypted data based on the underlying stream supplied as 'stream_to_decrypt'. :param oci.encryption.MasterKeyProvider master_key_provider: (required) A MasterKeyProvider to use for decrypting the data. :param stream stream_to_encrypt: (required) The stream to be decrypted. Nr F) �_stream_to_decrypt�_master_key_provider� _decryptorr7 rC �_header_deserializedrF r; r rG rH )rI Zstream_to_decryptrJ r r r! rL ` s zStreamDecryptor.__init__c C s | S rd r re r r r! rf y s zStreamDecryptor.__enter__c C s | � � d S rd rg ri r r r! rl | s zStreamDecryptor.__exit__c C s6 | j �� zd| _d| _W | j �� n | j �� 0 d S rm rn re r r r! rh s zStreamDecryptor.closec s� � fdd�t D �}|s(td�� j���n |d | _� jd }| jj|j|j |j d�}|� |j �}t �|�}t| j�|�| j�� j�t� d�}|�� | _t� j�r�t�t� j��| _| j� � j� d S )Nc s g | ]}� j |jkr|�qS r )rS rV )�.0Zalgo��headerr r! � <listcomp>� r zMStreamDecryptor._init_decryptor_and_header_related_fields.<locals>.<listcomp>zGCould not decrypt payload encrypted using unrecognized algorithm ID: {}r )rM rN rO r4 ) r r+ r* rS r7 rQ r� Zget_master_keyrM rN rO ZdecryptrP �base64Z b64decoder r5 r6 rR r Z decryptorr� r rT r, �loadsr r; rt )rI r� Zmatching_algosZencrypted_data_keyZprimary_master_keyZdecrypted_dek_bytesZdek_plaintext_bytesrK r r� r! �)_init_decryptor_and_header_related_fields� s> �� �� � ��z9StreamDecryptor._init_decryptor_and_header_related_fieldsc C s2 | j s.| jrtd��d| _ t| j�}| �|� d S )Nrs T)r� rH r+ r r r� )rI r� r r r! �_handle_header� s z StreamDecryptor._handle_headerc C s6 | j �� z| �� | jW | j �� S | j �� 0 d S rd )rG ro r� r; rp re r r r! rq � s �z&StreamDecryptor.get_encryption_contextr_ c C s | j �� z�| jrtd��|dkr2W | j �� dS | �� |dk}| js�d| _tt| j ��}|| j j d� }|d| j j � }t | j |�}|| j �|�7 }| j|7 _|r�| jdd� }d| _n&| jd|� }t| j�}||d� | _|W | j �� S | j �� 0 dS )rr rs r r r_ TN)rG ro rH r+ rp r� rF r �_read_full_stream_contentr r7 Ztag_lenr" r� Zfinalize_with_tagrC r )rI rx ry Zbytes_to_decryptrw Zdecrypted_datarz r r r r! ru � s< ( �� �zStreamDecryptor.readN)r_ ) r{ r| r} rL rf rl rh r� r� rq ru r r r r! r~ _ s ) r~ c C s$ t | d�rt| j�S t| �� �S d S )N�readall)ra r r� ru )�streamr r r! r� s r� ))rY r� Zmathr, Z oci._vendorr Z cryptography.hazmat.backendsr Z&cryptography.hazmat.primitives.ciphersr r � threadingr Z%oci.encryption.internal.serializationr r Z oci.encryption.internal.modelsr r Z oci.encryption.internal.defaultsr r r Z oci.encryption.internal.utilsr r r r Zoci.encryption.algorithmsr Zoci.encryption.modelsr rA �powZMAX_32_BIT_SIGNED_INTEGERr r" r2 r3 r~ r� r r r r! �<module> s, + y #
cải xoăn