
    ~)                         d Z ddlmZ ddlmZ ddlmZ ddlZddlZddlmZ	 ddl
mZ ddl
mZ ddlmZ dd	lmZ dd
lmZ ddlmZ  G d dej&                        Zy)z=Import a provided key from file into KMS using an Import Job.    )absolute_import)division)unicode_literalsN)base)
exceptions)flags)maps)log)filesc                   J    e Zd ZdZed        Zd Zd Zd Zd Z	d Z
d Zd	 Zy
)Importa  Import a version into an existing crypto key.

  Imports wrapped key material into a new version within an existing crypto key
  following the import procedure documented at
  https://cloud.google.com/kms/docs/importing-a-key.

  ## EXAMPLES

  The following command will read the files 'path/to/ephemeral/key' and
  'path/to/target/key' and use them to create a new version with algorithm
  'google-symmetric-encryption'  within the 'frodo' crypto key, 'fellowship'
  keyring, and 'us-central1' location using import job 'strider' to unwrap the
  provided key material.

    $ {command} --location=global \
         --keyring=fellowship \
         --key=frodo \
         --import-job=strider \
         --wrapped-key-file=path/to/target/key \
         --algorithm=google-symmetric-encryption
  c                 ^   t        j                  | d       t        j                  | d       t        j                  | d       t        j                  | d       t        j
                  |        t        j                  | d       t        j                  |        t        j                  |        y )Nz"The containing key to import into.z8to re-import into. Omit this field for first-time importz	to importzto import from)	r   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddRsaAesWrappedKeyFileFlagAddWrappedKeyFileFlagAddImportedVersionAlgorithmFlagAddRequiredImportJobArgumentAddPublicKeyFileFlagAddTargetKeyFileFlag)parsers    'lib/surface/kms/keys/versions/import.pyArgszImport.Args8   s    	f&JK	!!JL	%%fk:	4	))&1	&&v/?@	v&	v&    c                     t        j                  |      }t        |      |kD  r$t        j                  dj                  |            |S )Nz6The file is larger than the maximum size of {0} bytes.)r   ReadBinaryFileContentslenr   BadFileExceptionformat)selfpath	max_bytesdatas       r   	_ReadFilezImport._ReadFileD   sI    ''-D
4y9''
B
I
I  Kr   c                    ||j                   j                  j                  |j                   j                  j                  |j                   j                  j                  |j                   j                  j
                  fv S N)	ImportJobImportMethodValueValuesEnumRSA_OAEP_3072_SHA256RSA_OAEP_4096_SHA256RSA_OAEP_3072_SHA256_AES_256RSA_OAEP_4096_SHA256_AES_256r    import_methodmessagess      r   _IsSha2ImportMethodzImport._IsSha2ImportMethodL   sj    66KK66KK66	%	%x'9'9	$	$%A%AC C Cr   c                    ||j                   j                  j                  |j                   j                  j                  |j                   j                  j                  |j                   j                  j
                  fv S r&   )r'   r(   RSA_OAEP_3072_SHA1_AES_256RSA_OAEP_4096_SHA1_AES_256r+   r,   r-   s      r   _IsRsaAesWrappingImportMethodz$Import._IsRsaAesWrappingImportMethodT   sg    X//KK88%//KK88%//KK::%//KK::< < <r   c                     	 | j                  |j                  d      S # t        j                  $ r4}t	        j
                  dj                  |j                  |            d }~ww xY w)N   r"   z)Failed to read public key file [{0}]: {1})r$   public_key_filer   Errorr   r   r   )r    argses      r   _ReadPublicKeyByteszImport._ReadPublicKeyBytes^   s`    (^^D00E^BB;; (''
5
<
<""A'( ((s    A&/A!!A&c                    |j                   j                  |j                  |            }|j                  |j                  j
                  j                  k7  r0t        j                  ddj                  ||j                              |S )N)namez
import-jobz.Import job [{0}] is not active (state is {1}).)
&projects_locations_keyRings_importJobsGet5CloudkmsProjectsLocationsKeyRingsImportJobsGetRequeststater'   StateValueValuesEnumACTIVEr   BadArgumentExceptionr   )r    r:   import_job_nameclientr/   
import_jobs         r   _FetchImportJobzImport._FetchImportJobf   s    >>BBFF  	G 	"#J 8--BBIII++
HOOz//12 2 r   c                    	 ddl m} ddlm} ddl m} ddlm}	 ddl m}
 
j                         }| j                  ||      r|
j!                         }| j#                  ||      s||j$                  j&                  j(                  k(  rd	}n@||j$                  j&                  j*                  k(  rd
}nt-        dj/                  |            |d|j0                  z  z
  dz
  }t3        |      |kD  r%t5        j6                  ddj/                  |            d}|}j9                  |              }| j#                  ||      r-t;        j<                  d      }j?                  || |             }|jA                  |	jC                  |	jE                  |      |d             }||z   S # t        $ r8 t        j                  j                  d       t        j                  d       Y w xY w)Nr   )serialization)default_backend)keywrap)padding)hasheszCannot load the Pyca cryptography library. Either the library is not installed, or site packages are not enabled for the Google Cloud SDK. Please consult https://cloud.google.com/kms/docs/crypto for further instructions.   i  i   zunexpected import method: {0}   ztarget-key-filezFThe file is larger than the import method's maximum size of {0} bytes.r   )backend    )mgf	algorithmlabel)#cryptography.hazmat.primitivesrK   cryptography.hazmat.backendsrL   rM   )cryptography.hazmat.primitives.asymmetricrN   rO   ImportErrorr
   errPrintsysexitSHA1r0   SHA256r4   r'   r(   r)   r*   
ValueErrorr   digest_sizer   r   r   load_pem_public_keyosurandomaes_key_wrap_with_paddingencryptOAEPMGF1)r    r.   public_key_bytestarget_key_bytesrG   r/   rK   rL   rM   rN   rO   shamodulus_byte_lengthmax_target_key_sizeaes_wrapped_keyto_be_rsa_wrapped_key
public_keyrsa_wrapped_keys                     r   _CkmRsaAesKeyWrapzImport._CkmRsaAesKeyWrapp   s    ?>8C7 ++-Cx8MMOc --mXF
;;PPQ (
;;PPQ (8??NOO/1s3FG!K		!4	4))V/0
 	
 O,22/"3 3 5J))-B jjn99
!1?3DFo ((c*cFHO _,,_  	ggmm $ %
 
hhqks   F% %=G&%G&c                    t        j                         }t        j                         }t        j                  |      j                         }d }|j                  r.|j                  }|j                  r"t        j                  dd      |j                  }t        |      t        |j                        k(  rt        j                  dd      d }|r	 | j                  |d      }| j#                  ||||      }|j                  rd }		 | j                  |j                  d      }	d }
|j$                  r| j'                  |      }
n%|j(                  j*                  j-                  d
      }
| j/                  |j0                  |
|	||      }|j3                  t        j4                  |      j                               }|j7                  t8        j:                  j=                  |j>                        ||      |_         |jB                  r2t        jD                  |      j                         |j@                  _#        |jH                  jK                  |      S # t        j                  $ r*}t        j                  dj!                  ||            d }~ww xY w# t        j                  $ r4}t        j                  d	j!                  |j                  |            d }~ww xY w)N)z--wrapped-key-filez--rsa-aes-wrapped-key-filezGEither wrapped-key-file or rsa-aes-wrapped-key-file should be provided.)z--target-key-filez---wrapped-key-file/--rsa-aes-wrapped-key-filezAEither a pre-wrapped key or a key to be wrapped must be provided.r6   r7   z*Failed to read wrapped key file [{0}]: {1}i    z)Failed to read target key file [{0}]: {1}ascii)parent)rU   	importJob
wrappedKey)&cloudkms_baseGetClientInstanceGetMessagesModuler   ParseImportJobNameRelativeNamewrapped_key_filersa_aes_wrapped_key_filer   OneOfArgumentsRequiredExceptionbooltarget_key_filer$   r   r9   r   r   rI   r8   r<   	publicKeypemencoders   importMethodICloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsImportRequestParseCryptoKeyNameImportCryptoKeyVersionRequestr	   ALGORITHM_MAPPER_FOR_IMPORTGetEnumForChoicerU   importCryptoKeyVersionRequestversionParseCryptoKeyVersionNamecryptoKeyVersion8projects_locations_keyRings_cryptoKeys_cryptoKeyVersionsr   )r    r:   rG   r/   rF   r~   wrapped_key_bytesr;   rH   rk   rj   reqs               r   Runz
Import.Run   s   ,,.F..0H..t4AACO ..		&	&88@UW 	W 66d&:&:!;;66
P
MO O & NN+;uNM %%dOVXNJ*>>$*>*>$>O 			33D9%//33::7C001H1H1A1A619; 
\
\''-::< ] >C(0(N(N22CCNN!$	 )O )&C% ||;@;Z;Z
< 
''8 JJQQ S [[ &))8?? !%& 	&& [[ *))7>>$$a)* 	**s0   I J J&%JJK&/KKN)__name__
__module____qualname____doc__staticmethodr   r$   r0   r4   r<   rI   rs   r    r   r   r   r   !   sA    , 	' 	'C<(<-|Dr   r   )r   
__future__r   r   r   rd   r]   googlecloudsdk.api_lib.cloudkmsr   ry   googlecloudsdk.callioper   googlecloudsdk.command_lib.kmsr   r	   googlecloudsdk.corer
   googlecloudsdk.core.utilr   Commandr   r   r   r   <module>r      sA    D &  ' 	 
 A ( . 0 / # *QT\\ Qr   