a f@sdZddlmZddlmZddlmZmZmZddl m Z m Z ddl m Z ddlmZdd lmZdd lTGd d d eZGd ddeZdS)z0 Module to assist in verifying a signed header. )six)default_backend)hasheshmac serialization)rsapadding)InvalidSignature) b64decode)Signer)*c@seZdZdZddZdS)Verifierz Verifies signed text against a secret. For HMAC, the secret is the shared secret. For RSA, the secret is the PUBLIC key. cCst|tjr|d}t|tjr,|d}|jdkrrz$|jt||t | WdSt ynYdS0n,|jdkr| |}t|}||kSt ddS)z Verifies the data matches a signed version with the given signature. `data` is the message to verify `signature` is a base64-encoded signature to verify against `data` asciirTFrzUnsupported algorithm.N) isinstancerZ string_typesencodeZsign_algorithmZ _rsa_publicverifyr rZPKCS1v15Z_rsahashr Z _sign_hmacHttpSigException)selfdata signaturehsrC/usr/lib/python3.9/site-packages/oci/_vendor/httpsig_cffi/verify.py_verifys(         zVerifier._verifyN)__name__ __module__ __qualname____doc__rrrrrrsrcs*eZdZdZdfdd ZddZZS)HeaderVerifierz8 Verifies an HTTP signature from given headers. Ncs|pdg}t|d}t|dkr.|d|_ntdt||_dd|D|_||_||_||_ t t |j ||jdd d S) a( Instantiate a HeaderVerifier object. :param headers: A dictionary of headers from the HTTP request. :param secret: The HMAC secret or RSA *public* key. :param required_headers: Optional. A list of headers required to be present to validate, even if the signature is otherwise valid. Defaults to ['date']. :param method: Optional. The HTTP method used in the request (eg. "GET"). Required for the '(request-target)' header. :param path: Optional. The HTTP path requested, exactly as sent (including query arguments and fragments). Required for the '(request-target)' header. :param host: Optional. The value to use for the Host header, if not supplied in :param:headers. dateZ authorizationr zInvalid authorization header.cSsg|] }|qSr)lower).0rrrr Tz+HeaderVerifier.__init__.. algorithm)r'N) Zparse_authorization_headerlen auth_dictrZCaseInsensitiveDictheadersrequired_headersmethodpathhostsuperr __init__)rr*Zsecretr+r,r-r.Zauth __class__rrr0@s     zHeaderVerifier.__init__cCsz|jddd}tt|jt|dkrPtddt|jt|t ||j |j |j |j }|||jdS)z Verify the headers based on the arguments passed at creation and current properties. Raises an Exception if a required header (:param:required_headers) is not found in the signature. Returns True or False. r*r! rz{} is a required header(s)z, r)r)getsplitr(setr+ ExceptionformatjoinZgenerate_messager*r.r,r-r)rZ auth_headersZ signing_strrrrr[s "zHeaderVerifier.verify)NNNN)rrrrr0r __classcell__rrr1rr <sr N)rZ oci._vendorrZcryptography.hazmat.backendsrZcryptography.hazmat.primitivesrrrZ)cryptography.hazmat.primitives.asymmetricrrZcryptography.exceptionsr base64r signr Zutilsrr rrrrs     %