U
    EZhg                    @   s  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZmZ d dlmZm Z m!Z! d dl"m#Z#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z4 d dl5m6Z6 d dl7m8Z8m9Z9 d dl:m;Z; d dl<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZD d dlEmFZFmGZGmHZHmIZI d dlJmKZKmLZL d dlMmNZNmOZO d dlPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\ d dl]m^Z^m_Z_m`Z`maZambZbmcZcmdZdmeZemfZf d dlgmhZh d dlimjZj d dlkmlZlmmZmmnZnmoZompZp e qdd d!gZrG d"d# d#ZsG d$d% d%ZtG d&d' d'ZueteQd(d)d*Zvet ZwdS )+    N)contextmanager)utilsx509)UnsupportedAlgorithm_Reasons)aead)_CipherContext_CMACContext)_dh_params_dup_DHParameters_DHPrivateKey_DHPublicKey)_DSAParameters_DSAPrivateKey_DSAPublicKey)_EllipticCurvePrivateKey_EllipticCurvePublicKey)_ED448_KEY_SIZE_Ed448PrivateKey_Ed448PublicKey)_Ed25519PrivateKey_Ed25519PublicKey_HashContext_HMACContext)_POLY1305_KEY_SIZE_Poly1305Context)_RSAPrivateKey_RSAPublicKey)_X448PrivateKey_X448PublicKey)openssl)binding)hashesserialization)AsymmetricPadding)dhdsaeced448ed25519rsax448x25519)MGF1OAEPPSSPKCS1v15)PrivateKeyTypesPublicKeyTypes)BlockCipherAlgorithmCipherAlgorithm)AESAES128AES256ARC4SM4CamelliaChaCha20	TripleDES_BlowfishInternal_CAST5Internal_IDEAInternal_SEEDInternal)	CBCCFBCFB8CTRECBGCMOFBXTSMode)scrypt)ssh)PBESPKCS12CertificatePKCS12KeyAndCertificatesPKCS12PrivateKeyTypes_PKCS12CATypes
_MemoryBIObioZchar_ptrc                   @   s   e Zd ZdS )_RC2N)__name__
__module____qualname__ rZ   rZ   s/home/aprabhat/apps/x.techxrdev.in/venv/lib/python3.8/site-packages/cryptography/hazmat/backends/openssl/backend.pyrV   {   s   rV   c                   @   s	  e Zd ZdZdZddddddhZefZej	ej
ejejejejejejejejejejfZejejejejfZd	Zd
Zdd	> Zd	Zde> Z ddddZ!e"dddZ#d+e$e%j&e%j'e(j)  ddddZ*e$dddZ+ddddZ,ddddZ-e.j/dd Z0ddddZ1e"ddd Z2e"dd!d"Z3e4dd#d$Z5e6ej7e8d%d&d'Z9ej7d(d)d*Z:ej7d(d+d,Z;ej7e$d-d.d/Z<ej7e$d-d0d1Z=e$dd2d3Z>ej7e$d-d4d5Z?ej7ej@d-d6d7ZAeBeCe$d8d9d:ZDddd;d<ZEddd=d>ZFeBeCeGd8d?d@ZHeBeCeGd8dAdBZIej7e$d-dCdDZJej7e4e6e4e6e6dEdFdGZKe%j'e(j) ddHdIZLe4ddJdKZMd,e4dLdMdNZNe4e4eOjPdOdPdQZQe4e4e$dOdRdSZReOjSe$eOjPdTdUdVZTeOjUeOjVdWdXdYZWdZd[ ZXd\d] ZYe6eZd^d_d`Z[dadb Z\e6ddcddZ]e$e^dedfdgZ_e`ddhdiZaej7e$d-djdkZbece$dldmdnZdece$dldodpZee4efjgdqdrdsZhefjgefjidtdudvZje4efjidqdwdxZkdddydzZlefjmefjidWd{d|ZnefjoefjpdWd}d~ZqefjrefjgdWddZsdd Zte$dddZuej7e$d-ddZve$dddZwexeyd-ddZze6e%j&e6 e$e^dddZ{e6e`d^ddZ|e6e}j~d^ddZe6e%j&e6 e$e^dddZdd Ze6e`d^ddZe6e}j~d^ddZeje%jdddZe%jejdddZddddZe^dddZe%jdddZeje$dddZejeje$dddZejejdddZejejdWddZejejdWddZeje6ejdddZe4ejejdddZejdddZe4dddZejeje$dddZdd Zeje4dddĄZe/ddƄ Ze4e4ddǜddɄZejejeje6dʜdd̄Ze6ddd΄Ze6dddЄZejeje6dќddӄZe$dddՄZe4e4e}j~d֜dd؄Zddڄ Ze}j~e}jdtdd܄Ze4e4e}jd֜ddބZe}je}jdWddZe}je}jdWddZe}je}j~dWddZd-e4e4e%j&e4 e$dddZe$dddZe6ejd^ddZe6ejd^ddZdd ZejdddZe$dddZe6ejd^ddZe6ejd^ddZejdddZe$dddZe$dddZe6ejd^ddZe6ejd^d dZejdddZe$dddZe6ejd^ddZe6ejd^dd	Zejdd
dZe6e6e4e4e4e4e6dddZe$dddZe4ddddZe.j/dd Ze6e%j&e6 e%je%j&e^ e%j&ej e%j'ej f dddZe6e%j&e6 eݐdddZe%j&e6 e%j&e e%j&ej e%j&e%j'e  eje6dddZe$dddZe6ed d!d"Ze$dd#d$Ze6e%j'ej d^d%d&Ze6e%j'ej d^d'd(Ze%j'ej dd)d*ZdS (.  Backendz)
    OpenSSL API binding interfaces.
    r#   s   aes-128-ccms   aes-192-ccms   aes-256-ccms   aes-128-gcms   aes-192-gcms   aes-256-gcm   i     N)returnc                 C   s   t  | _| jj| _| jj| _|  | _i | _	| 
  | jrR| jjrRtdt n|   | jjg| _| jjr~| j| jj d S )Nz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r$   ZBinding_bindingffi_ffilib_lib_is_fips_enabled_fips_enabled_cipher_registry_register_default_ciphers"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEwarningswarnUserWarningactivate_osrandom_engineZEVP_PKEY_DH	_dh_typesCryptography_HAS_EVP_PKEY_DHXappendZEVP_PKEY_DHXselfrZ   rZ   r[   __init__   s     



zBackend.__init__c                 C   s   d |  | j| jjS )Nz3<OpenSSLBackend(version: {}, FIPS: {}, Legacy: {})>)formatopenssl_version_textrf   r`   _legacy_provider_loadedrq   rZ   rZ   r[   __repr__   s
    zBackend.__repr__)okerrorsr_   c                 C   s   t j| j||dS )N)ry   )r$   Z_openssl_assertrd   )rr   rx   ry   rZ   rZ   r[   openssl_assert   s    zBackend.openssl_assertc                 C   s>   | j jr| j | jj}n
| j  }|dkr6| j   t|S Nr   )rd   ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrb   NULLZ	FIPS_modeZERR_clear_errorbool)rr   moderZ   rZ   r[   re      s    

zBackend._is_fips_enabledc                 C   s$   | j   |  st|  | _d S N)r`   _enable_fipsre   AssertionErrorrf   rq   rZ   rZ   r[   r      s    
zBackend._enable_fipsc                 C   sf   | j jrb| j  }|| jjkrb| j | | j | jj}| |dk | j |}| |dk d S Nr^   )	rd   ri   ZENGINE_get_default_RANDrb   r|   ZENGINE_unregister_RANDRAND_set_rand_methodrz   ENGINE_finishrr   eresrZ   rZ   r[   activate_builtin_random   s    
zBackend.activate_builtin_randomc              
   c   s   | j | j j}| || jjk | j |}| |dk z
|V  W 5 | j |}| |dk | j |}| |dk X d S r   )	rd   ZENGINE_by_idZCryptography_osrandom_engine_idrz   rb   r|   ZENGINE_initZENGINE_freer   r   rZ   rZ   r[   _get_osurandom_engine   s    
zBackend._get_osurandom_enginec              	   C   s`   | j jr\|   |   }| j |}| |dk W 5 Q R X | j | jj}| |dk d S r   )	rd   ri   r   r   ZENGINE_set_default_RANDrz   r   rb   r|   r   rZ   rZ   r[   rm   
  s    
z Backend.activate_osrandom_enginec              	   C   s`   | j dd}|  2}| j|dt||| j jd}| |dk W 5 Q R X | j |	dS )Nchar[]@   s   get_implementationr   ascii)
rb   newr   rd   ZENGINE_ctrl_cmdlenr|   rz   stringdecode)rr   bufr   r   rZ   rZ   r[   osrandom_engine_implementation  s    
     z&Backend.osrandom_engine_implementationc                 C   s   | j | j| jjdS )z
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r   )rb   r   rd   ZOpenSSL_versionOPENSSL_VERSIONr   rq   rZ   rZ   r[   ru     s
    zBackend.openssl_version_textc                 C   s
   | j  S r   )rd   ZOpenSSL_version_numrq   rZ   rZ   r[   openssl_version_number*  s    zBackend.openssl_version_number)key	algorithmr_   c                 C   s   t | ||S r   r   )rr   r   r   rZ   rZ   r[   create_hmac_ctx-  s    zBackend.create_hmac_ctx)r   c                 C   sL   |j dks|j dkr0d|j |jd d}n|j d}| j|}|S )Nblake2bblake2sz{}{}   r   )namert   digest_sizeencoderd   ZEVP_get_digestbyname)rr   r   algevp_mdrZ   rZ   r[   _evp_md_from_algorithm2  s     zBackend._evp_md_from_algorithmc                 C   s    |  |}| || jjk |S r   )r   rz   rb   r|   rr   r   r   rZ   rZ   r[   _evp_md_non_null_from_algorithm=  s    
z'Backend._evp_md_non_null_from_algorithm)r   r_   c                 C   s,   | j rt|| jsdS | |}|| jjkS NF)rf   
isinstance_fips_hashesr   rb   r|   r   rZ   rZ   r[   hash_supportedB  s    
zBackend.hash_supportedc                 C   s    | j rt|tjrdS | |S r   rf   r   r%   SHA1r   rr   r   rZ   rZ   r[   signature_hash_supportedI  s    z Backend.signature_hash_supportedc                 C   s   | j r
dS | jjdkS d S NFr^   )rf   rd   ZCryptography_HAS_SCRYPTrq   rZ   rZ   r[   scrypt_supportedR  s    zBackend.scrypt_supportedc                 C   s    | j rt|tjrdS | |S )NTr   r   rZ   rZ   r[   hmac_supportedX  s    zBackend.hmac_supportedc                 C   s
   t | |S r   r   r   rZ   rZ   r[   create_hash_ctx_  s    zBackend.create_hash_ctx)cipherr~   r_   c                 C   s`   | j rt|| jsdS z| jt|t|f }W n tk
rF   Y dS X || ||}| jj|kS r   )rf   r   _fips_ciphersrg   typeKeyErrorrb   r|   )rr   r   r~   adapter
evp_cipherrZ   rZ   r[   cipher_supportedd  s    zBackend.cipher_supportedc                 C   s0   ||f| j krtd|||| j ||f< d S )Nz"Duplicate registration for: {} {}.)rg   
ValueErrorrt   )rr   
cipher_clsmode_clsr   rZ   rZ   r[   register_cipher_adapterr  s     zBackend.register_cipher_adapterc                 C   s  t ttfD ].}ttttttt	fD ]}| 
||td q q
tttttfD ]}| 
t|td qHttttfD ]}| 
t|td ql| 
tttd | 
ttd td | 
t tt tttttfD ]}| 
t|td q| jjs| jjsttttfD ]}| 
t|td qttttfD ]}| 
t|td q"tttgttttgD ]\}}| 
||td qT| 
ttd td	 | 
ttd td
 d S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3Zchacha20zsm4-{mode.name}zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2)r8   r9   r:   rD   rG   rH   rJ   rE   rF   rI   r   GetCipherByNamer=   r?   r>   r   rK   _get_xts_cipherr<   r`   rv   rd   #CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr@   rC   	itertoolsproductrA   rB   r;   rV   )rr   r   r   rZ   rZ   r[   rh   {  s            
    z!Backend._register_default_ciphersc                 C   s   t | ||t jS r   )r   Z_ENCRYPTrr   r   r~   rZ   rZ   r[   create_symmetric_encryption_ctx  s    z'Backend.create_symmetric_encryption_ctxc                 C   s   t | ||t jS r   )r   Z_DECRYPTr   rZ   rZ   r[   create_symmetric_decryption_ctx  s    z'Backend.create_symmetric_decryption_ctxc                 C   s
   |  |S r   )r   r   rZ   rZ   r[   pbkdf2_hmac_supported  s    zBackend.pbkdf2_hmac_supported)r   lengthsalt
iterationskey_materialr_   c           
   
   C   sh   | j d|}| |}| j |}| j|t||t|||||}	| |	dk | j |d d  S )Nunsigned char[]r^   )	rb   r   r   from_bufferrd   ZPKCS5_PBKDF2_HMACr   rz   buffer)
rr   r   r   r   r   r   r   r   key_material_ptrr   rZ   rZ   r[   derive_pbkdf2_hmac  s    

zBackend.derive_pbkdf2_hmacc                 C   s   t  S r   )rust_opensslZcapture_error_stackrq   rZ   rZ   r[   _consume_errors  s    zBackend._consume_errorsc                 C   sz   || j jkst| | j|  | j|}| j d|}| j||}| |dk t	
| j |d | d}|S )Nr   r   big)rb   r|   r   rz   rd   ZBN_is_negativeZBN_num_bytesr   Z	BN_bn2binint
from_bytesr   )rr   bnZbn_num_bytesZbin_ptrZbin_lenvalrZ   rZ   r[   
_bn_to_int  s    zBackend._bn_to_int)numc                 C   sn   |dks|| j jkst|dkr(| j j}|t| d d d}| j|t||}| 	|| j jk |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @r^   r   )
rb   r|   r   to_bytesr   
bit_lengthrd   Z	BN_bin2bnr   rz   )rr   r   r   binaryZbn_ptrrZ   rZ   r[   
_int_to_bn  s    zBackend._int_to_bn)public_exponentkey_sizer_   c                 C   s   t || | j }| || jjk | j|| jj}| 	|}| j|| jj
}| j|||| jj}| |dk | |}t| ||ddS )Nr^   Tunsafe_skip_rsa_key_validation)r-   Z_verify_rsa_parametersrd   RSA_newrz   rb   r|   gcRSA_freer   BN_freeZRSA_generate_key_ex_rsa_cdata_to_evp_pkeyr   )rr   r   r   	rsa_cdatar   r   evp_pkeyrZ   rZ   r[   generate_rsa_private_key  s(    

   
   z Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )N   r^   r   i   rZ   )rr   r   r   rZ   rZ   r[   !generate_rsa_parameters_supported  s
    
z)Backend.generate_rsa_parameters_supported)numbersr   r_   c              
   C   s6  t |j|j|j|j|j|j|jj	|jj
 | j }| || jjk | j|| jj}| |j}| |j}| |j}| |j}| |j}| |j}	| |jj	}
| |jj
}| j|||}| |dk | j|||
|}| |dk | j||||	}| |dk | |}t| |||dS )Nr^   r   )r-   Z_check_private_key_componentspqddmp1dmq1iqmppublic_numbersr   nrd   r   rz   rb   r|   r   r   r   ZRSA_set0_factorsRSA_set0_keyZRSA_set0_crt_paramsr   r   )rr   r   r   r   r   r   r   r   r   r   r   r   r   r   rZ   rZ   r[   load_rsa_private_numbers$  sD    


z Backend.load_rsa_private_numbers)r   r_   c                 C   s   t |j|j | j }| || jjk | j	|| jj
}| |j}| |j}| j|||| jj}| |dk | |}t| ||S r   )r-   Z_check_public_key_componentsr   r   rd   r   rz   rb   r|   r   r   r   r   r   r    )rr   r   r   r   r   r   r   rZ   rZ   r[   load_rsa_public_numbersM  s    

zBackend.load_rsa_public_numbersc                 C   s2   | j  }| || jjk | j|| j j}|S r   )rd   ZEVP_PKEY_newrz   rb   r|   r   EVP_PKEY_freerr   r   rZ   rZ   r[   _create_evp_pkey_gc\  s    
zBackend._create_evp_pkey_gcc                 C   s(   |   }| j||}| |dk |S r   )r   rd   ZEVP_PKEY_set1_RSArz   )rr   r   r   r   rZ   rZ   r[   r   b  s    zBackend._rsa_cdata_to_evp_pkey)datar_   c                 C   sH   | j |}| j|t|}| || j jk t| j || jj	|S )z
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rb   r   rd   ZBIO_new_mem_bufr   rz   r|   rT   r   BIO_free)rr   r   data_ptrrU   rZ   rZ   r[   _bytes_to_bioh  s    zBackend._bytes_to_bioc                 C   sP   | j  }| || jjk | j |}| || jjk | j|| j j}|S )z.
        Creates an empty memory BIO.
        )rd   Z	BIO_s_memrz   rb   r|   ZBIO_newr   r   )rr   Z
bio_methodrU   rZ   rZ   r[   _create_mem_bio_gcu  s    
zBackend._create_mem_bio_gcc                 C   s\   | j d}| j||}| |dk | |d | j jk | j |d |dd }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rb   r   rd   ZBIO_get_mem_datarz   r|   r   )rr   rU   r   Zbuf_lenbio_datarZ   rZ   r[   _read_mem_bio  s    zBackend._read_mem_bio)r   r_   c           
      C   sP  | j |}|| j jkrX| j |}| || jjk | j|| j j}t	| |||dS || j j
kr| j js| j js| j js| j |}| || jjk | j|| j j}|  }| j ||}| |dk | j| |d|dS || j jkr0| j |}| || jjk | j|| j j}t| ||S || j jkrz| j |}| || jjk | j|| j j}t| ||S || jkr| j |}	| |	| jjk | j|	| j j}	t| |	|S |t| j ddkrt| |S |t| j ddkrt | |S || j j!kr&t"j#$t%| j&d|S |t| j ddkrDt'| |S t(d	dS )
zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        r   r^   N)passwordr   EVP_PKEY_ED25519EVP_PKEY_X448	uintptr_tEVP_PKEY_ED448Unsupported key type.))rd   EVP_PKEY_idEVP_PKEY_RSAEVP_PKEY_get1_RSArz   rb   r|   r   r   r   EVP_PKEY_RSA_PSSCRYPTOGRAPHY_IS_LIBRESSLCRYPTOGRAPHY_IS_BORINGSSL#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Er   i2d_RSAPrivateKey_bioload_der_private_keyr   EVP_PKEY_DSAEVP_PKEY_get1_DSADSA_freer   EVP_PKEY_ECEVP_PKEY_get1_EC_KEYEC_KEY_freer   rn   EVP_PKEY_get1_DHDH_freer   getattrr   r!   EVP_PKEY_X25519r   r/   Zprivate_key_from_ptrr   castr   r   )
rr   r   r   key_typer   rU   r   	dsa_cdataec_cdatadh_cdatarZ   rZ   r[   _evp_pkey_to_private_key  sp    




z Backend._evp_pkey_to_private_keyc           
      C   sT  | j |}|| j jkrT| j |}| || jjk | j|| j j}t	| ||S || j j
kr| j js| j js| j js| j |}| || jjk | j|| j j}|  }| j ||}| |dk | | |S || j jkr&| j |}| || jjk | j|| j j}t| ||S || j jkr~| j |}|| jjkr`|  }td|| j|| j j}t| ||S || jkr| j |}	| |	| jjk | j|	| j j}	t| |	|S |t | j ddkrt!| |S |t | j ddkrt"| |S || j j#kr*t$j%&t'| j(d|S |t | j ddkrHt)| |S t*ddS )	zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        r^   zUnable to load EC keyr   Nr   r   r  r  )+rd   r  r  r  rz   rb   r|   r   r   r    r  r  r  r	  r   i2d_RSAPublicKey_bioload_der_public_keyr   r  r  r  r   r  r  r   r   r  r   rn   r  r  r   r  r   r"   r  r   r/   Zpublic_key_from_ptrr   r  r   r   )
rr   r   r  r   rU   r   r  r  ry   r  rZ   rZ   r[   _evp_pkey_to_public_key  sb    




zBackend._evp_pkey_to_public_keyc                 C   s4   | j rt|tjrdS t|tjtjtjtjtjfS r   )rf   r   r%   r   SHA224SHA256SHA384SHA512r   rZ   rZ   r[   _oaep_hash_supported  s    zBackend._oaep_hash_supported)paddingr_   c                 C   s   t |trdS t |trNt |jtrN| jr>t |jjtjr>dS | 	|jjS n4t |t
r~t |jtr~| |jjo|| |jS dS d S )NTF)r   r3   r2   Z_mgfr0   rf   
_algorithmr%   r   r   r1   r#  rr   r$  rZ   rZ   r[   rsa_padding_supported  s     
 
zBackend.rsa_padding_supportedc                 C   s"   | j rt|trdS | |S d S r   )rf   r   r3   r'  r&  rZ   rZ   r[   rsa_encryption_supported0  s    z Backend.rsa_encryption_supported)r   r_   c              	   C   s~   |dkrt d| j }| || jjk | j|| jj}| j||| jjd| jj| jj| jj}| |dk t	| |S )N)i   r]   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   r^   )
r   rd   DSA_newrz   rb   r|   r   r  ZDSA_generate_parameters_exr   )rr   r   ctxr   rZ   rZ   r[   generate_dsa_parameters6  s$    

zBackend.generate_dsa_parameters)
parametersr_   c                 C   sT   | j |j}| || jjk | j|| j j}| j | | 	|}t
| ||S r   )rd   ZDSAparams_dupZ
_dsa_cdatarz   rb   r|   r   r  ZDSA_generate_key_dsa_cdata_to_evp_pkeyr   )rr   r,  r*  r   rZ   rZ   r[   generate_dsa_private_keyN  s    
z Backend.generate_dsa_private_keyc                 C   s   |  |}| |S r   )r+  r.  )rr   r   r,  rZ   rZ   r[   'generate_dsa_private_key_and_parameters[  s    
z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j ||||}| |dk | j |||}| |dk d S r   )rd   DSA_set0_pqgrz   ZDSA_set0_key)rr   r  r   r   gpub_keypriv_keyr   rZ   rZ   r[   _dsa_cdata_set_valuesa  s    zBackend._dsa_cdata_set_valuesc           
      C   s   t | |jj}| j }| || jjk | j	|| jj
}| |j}| |j}| |j}| |jj}| |j}| |||||| | |}	t| ||	S r   )r)   Z_check_dsa_private_numbersr   parameter_numbersrd   r)  rz   rb   r|   r   r  r   r   r   r1  yxr4  r-  r   )
rr   r   r5  r  r   r   r1  r2  r3  r   rZ   rZ   r[   load_dsa_private_numbersi  s    


z Backend.load_dsa_private_numbersc           	      C   s   t |j | j }| || jjk | j|| jj	}| 
|jj}| 
|jj}| 
|jj}| 
|j}| jj}| |||||| | |}t| ||S r   )r)   _check_dsa_parametersr5  rd   r)  rz   rb   r|   r   r  r   r   r   r1  r6  r4  r-  r   )	rr   r   r  r   r   r1  r2  r3  r   rZ   rZ   r[   load_dsa_public_numbers~  s    

zBackend.load_dsa_public_numbersc                 C   s   t | | j }| || jjk | j|| jj}| 	|j
}| 	|j}| 	|j}| j||||}| |dk t| |S r   )r)   r9  rd   r)  rz   rb   r|   r   r  r   r   r   r1  r0  r   )rr   r   r  r   r   r1  r   rZ   rZ   r[   load_dsa_parameter_numbers  s    

z"Backend.load_dsa_parameter_numbersc                 C   s(   |   }| j||}| |dk |S r   )r   rd   ZEVP_PKEY_set1_DSArz   )rr   r  r   r   rZ   rZ   r[   r-    s    zBackend._dsa_cdata_to_evp_pkeyc                 C   s   | j  S r   )rf   rq   rZ   rZ   r[   dsa_supported  s    zBackend.dsa_supportedc                 C   s   |   sdS | |S r   )r<  r   r   rZ   rZ   r[   dsa_hash_supported  s    zBackend.dsa_hash_supportedc                 C   s   |  |td|j S )N    )r   rD   
block_sizer   rZ   rZ   r[   cmac_algorithm_supported  s     z Backend.cmac_algorithm_supportedc                 C   s
   t | |S r   r	   r   rZ   rZ   r[   create_cmac_ctx  s    zBackend.create_cmac_ctx)r   r   r   r_   c                 C   s   |  | jj|||S r   )	_load_keyrd   ZPEM_read_bio_PrivateKey)rr   r   r   r   rZ   rZ   r[   load_pem_private_key  s    zBackend.load_pem_private_keyc                 C   s   |  |}| jd}| j|j| jj| j| jjd|}|| jjkrd| j	|| jj
}| |S |   | j|j}| |dk | j|j| jj| j| jjd|}|| jjkr| j	|| jj}| |}t| ||S |   d S )NCRYPTOGRAPHY_PASSWORD_DATA *Cryptography_pem_password_cbr^   )r   rb   r   rd   ZPEM_read_bio_PUBKEYrU   r|   	addressof_original_libr   r   r  r   	BIO_resetrz   ZPEM_read_bio_RSAPublicKeyr   r   r    _handle_key_loading_error)rr   r   mem_biouserdatar   r   r   rZ   rZ   r[   load_pem_public_key  s>    
 
 
zBackend.load_pem_public_keyc                 C   s^   |  |}| j|j| jj| jj| jj}|| jjkrR| j|| jj}t| |S | 	  d S r   )
r   rd   ZPEM_read_bio_DHparamsrU   rb   r|   r   r  r   rI  )rr   r   rJ  r  rZ   rZ   r[   load_pem_parameters  s    
   
zBackend.load_pem_parametersc                 C   s>   |  |}| ||}|r&| ||S | | jj|||S d S r   )r   "_evp_pkey_from_der_traditional_keyr  rB  rd   Zd2i_PKCS8PrivateKey_bio)rr   r   r   r   r   r   rZ   rZ   r[   r    s    

 zBackend.load_der_private_keyc                 C   sV   | j |j| jj}|| jjkrF| j|| j j}|d k	rBtd|S |   d S d S )N4Password was given but private key is not encrypted.)	rd   Zd2i_PrivateKey_biorU   rb   r|   r   r   	TypeErrorr   )rr   r   r   r   rZ   rZ   r[   rN    s    z*Backend._evp_pkey_from_der_traditional_keyc                 C   s   |  |}| j|j| jj}|| jjkrF| j|| jj}| |S | 	  | j
|j}| |dk | j|j| jj}|| jjkr| j|| jj}| |}t| ||S |   d S r   )r   rd   Zd2i_PUBKEY_biorU   rb   r|   r   r   r  r   rH  rz   Zd2i_RSAPublicKey_bior   r   r    rI  )rr   r   rJ  r   r   r   rZ   rZ   r[   r  "  s"    

 
zBackend.load_der_public_keyc                 C   s   |  |}| j|j| jj}|| jjkrF| j|| jj}t| |S | jj	r| 
  | j|j}| |dk | j|j| jj}|| jjkr| j|| jj}t| |S |   d S r   )r   rd   Zd2i_DHparams_biorU   rb   r|   r   r  r   ro   r   rH  rz   Zd2i_DHxparams_biorI  )rr   r   rJ  r  r   rZ   rZ   r[   load_der_parameters9  s    


zBackend.load_der_parameters)certr_   c                 C   sT   | tjj}| |}| j|j| jj	}| 
|| jj	k | j|| jj}|S r   )Zpublic_bytesr&   EncodingDERr   rd   Zd2i_X509_biorU   rb   r|   rz   r   	X509_free)rr   rR  r   rJ  r   rZ   rZ   r[   
_cert2osslK  s    
zBackend._cert2ossl)x509_ptrr_   c                 C   s4   |   }| j||}| |dk t| |S r   )r   rd   Zi2d_X509_biorz   r   Zload_der_x509_certificater   )rr   rW  rU   r   rZ   rZ   r[   
_ossl2certS  s    zBackend._ossl2certc                 C   s"   | j |j|jdkrtdd S )Nr^   zKeys do not correspond)rd   ZEVP_PKEY_cmp	_evp_pkeyr   )rr   key1key2rZ   rZ   r[   _check_keys_correspondY  s    zBackend._check_keys_correspondc           	      C   s"  |  |}| jd}|d k	rFtd| | j|}||_t||_||j	| jj
| j| jjd|}|| jj
kr|jdkr|   |jdkrtdq|jdksttd|jd	 n|   | j|| jj}|d k	r|jdkrtd
|d k	r|jd	ks|d kst| ||S )NrD  r   rE  r   z3Password was not given but private key is encryptedzAPasswords longer than {} bytes are not supported by this backend.r^   rO  )r   rb   r   r   _check_bytesliker   r   r   r   rU   r|   rF  rd   rG  errorr   rP  r   r   rt   maxsizerI  r   r   Zcalledr  )	rr   Zopenssl_read_funcr   r   r   rJ  rK  Zpassword_ptrr   rZ   rZ   r[   rB  ]  sZ    

 	

 zBackend._load_keyc                    s      }|stdn|d  jj jjsf|d  jj jjsf jjrp|d  jj	 jj
rptdn*t fdd|D rtdn
td|d S )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3   s"   | ]}|  jj jjV  qd S r   )_lib_reason_matchrd   ERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM).0r`  rq   rZ   r[   	<genexpr>  s
   z4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.zCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r   r   rb  rd   rc  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZERR_LIB_PROVZPROV_R_BAD_DECRYPTany)rr   ry   rZ   rq   r[   rI    s>     	


z!Backend._handle_key_loading_error)curver_   c                 C   sv   z|  |}W n tk
r*   | jj}Y nX | j|}|| jjkrP|   dS | || jjk | j	| dS d S )NFT)
_elliptic_curve_to_nidr   rd   	NID_undefZEC_GROUP_new_by_curve_namerb   r|   r   rz   ZEC_GROUP_free)rr   rg  	curve_nidgrouprZ   rZ   r[   elliptic_curve_supported  s    z Backend.elliptic_curve_supported)signature_algorithmrg  r_   c                 C   s   t |tjsdS | |S r   )r   r*   ZECDSArl  )rr   rm  rg  rZ   rZ   r[   ,elliptic_curve_signature_algorithm_supported  s    z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   s^   |  |rD| |}| j|}| |dk | |}t| ||S td|j dt	j
dS )z@
        Generate a new private key on the named curve.
        r^   z Backend object does not support .N)rl  _ec_key_new_by_curverd   ZEC_KEY_generate_keyrz   _ec_cdata_to_evp_pkeyr   r   r   r   UNSUPPORTED_ELLIPTIC_CURVE)rr   rg  r  r   r   rZ   rZ   r[   #generate_elliptic_curve_private_key  s    


z+Backend.generate_elliptic_curve_private_keyc              	   C   sH  |j }| |j}| j| |j| jj}| j	||}|dkrR| 
  td|  }| ||j|j| | j|}| || jjk tj|}| || jjk | j|}	| |	| jjk | j|	| jj}	| j||	|| jj| jj|}| |dk | j|||	|dkr(tdW 5 Q R X | |}
t| ||
S )Nr^   Invalid EC key.r   )r   rp  rg  rb   r   r   private_valuerd   BN_clear_freeEC_KEY_set_private_keyr   r   _tmp_bn_ctx)_ec_key_set_public_key_affine_coordinatesr7  r6  EC_KEY_get0_grouprz   r|   backendZEC_KEY_get0_public_keyEC_POINT_newEC_POINT_freeEC_POINT_mulZEC_POINT_cmprq  r   )rr   r   publicr  ru  r   bn_ctxrk  Z	set_pointZcomputed_pointr   rZ   rZ   r[   #load_elliptic_curve_private_numbers  s`    
 
       
z+Backend.load_elliptic_curve_private_numbersc              	   C   sJ   |  |j}|  }| ||j|j| W 5 Q R X | |}t| ||S r   )rp  rg  rx  ry  r7  r6  rq  r   )rr   r   r  r  r   rZ   rZ   r[   "load_elliptic_curve_public_numbers$  s    
   
z*Backend.load_elliptic_curve_public_numbers)rg  point_bytesr_   c           	   	   C   s   |  |}| j|}| || jjk | j|}| || jjk | j|| jj}| 	 6}| j
|||t||}|dkr|   tdW 5 Q R X | j||}| |dk | |}t| ||S )Nr^   z(Invalid public bytes for the given curve)rp  rd   rz  rz   rb   r|   r|  r   r}  rx  ZEC_POINT_oct2pointr   r   r   EC_KEY_set_public_keyrq  r   )	rr   rg  r  r  rk  pointr  r   r   rZ   rZ   r[    load_elliptic_curve_public_bytes0  s*    

    
z(Backend.load_elliptic_curve_public_bytes)ru  rg  r_   c              	   C   sb  |  |}| j|}| || jjk | j|}| || jjk | j|| jj}| 	|}| j|| jj
}|  v}| j|||| jj| jj|}| |dk | j|}	| j|}
| j|||	|
|}|dkr|   tdW 5 Q R X | j||}| |dk | 	|}| j|| jj
}| j||}| |dk | |}t| ||S )Nr^   z'Unable to derive key from private_value)rp  rd   rz  rz   rb   r|   r|  r   r}  r   rv  rx  r~  Z
BN_CTX_getZEC_POINT_get_affine_coordinatesr   r   r  rw  rq  r   )rr   ru  rg  r  rk  r  valuer  r   Zbn_xZbn_yprivater   rZ   rZ   r[   !derive_elliptic_curve_private_keyF  sL    


         

z)Backend.derive_elliptic_curve_private_key)rg  c                 C   s   |  |}| |S r   )rh  _ec_key_new_by_curve_nid)rr   rg  rj  rZ   rZ   r[   rp  p  s    
zBackend._ec_key_new_by_curve)rj  c                 C   s0   | j |}| || jjk | j|| j jS r   )rd   ZEC_KEY_new_by_curve_namerz   rb   r|   r   r  )rr   rj  r  rZ   rZ   r[   r  t  s    z Backend._ec_key_new_by_curve_nid)r   rg  r_   c                 C   s,   | j rt|| jsdS | |o*t|tjS r   )rf   r   _fips_ecdh_curvesrl  r*   ECDH)rr   r   rg  rZ   rZ   r[   +elliptic_curve_exchange_algorithm_supportedy  s      z3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   s(   |   }| j||}| |dk |S r   )r   rd   ZEVP_PKEY_set1_EC_KEYrz   )rr   r  r   r   rZ   rZ   r[   rq    s    zBackend._ec_cdata_to_evp_pkeyc                 C   sN   ddd}| |j|j}| j| }|| jjkrJt|j dtj|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z" is not a supported elliptic curve)	getr   rd   Z
OBJ_sn2nidr   ri  r   r   rr  )rr   rg  Zcurve_aliasesZ
curve_namerj  rZ   rZ   r[   rh    s    

zBackend._elliptic_curve_to_nidc              	   c   sX   | j  }| || jjk | j|| j j}| j | z
|V  W 5 | j | X d S r   )	rd   Z
BN_CTX_newrz   rb   r|   r   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)rr   r  rZ   rZ   r[   rx    s    

zBackend._tmp_bn_ctx)r7  r6  r_   c                 C   s   |dk s|dk rt d| j| || jj}| j| || jj}| j|}| || jjk | j	|}| || jjk | j|| jj
}| j|||||}|dkr|   t d| j||}| |dk dS )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.r^   rt  N)r   rb   r   r   rd   r   rz  rz   r|   r|  r}  ZEC_POINT_set_affine_coordinatesr   r  )rr   r  r7  r6  r  rk  r  r   rZ   rZ   r[   ry    s.        z1Backend._ec_key_set_public_key_affine_coordinates)encodingrt   encryption_algorithmr_   c           
      C   s`  t |tjstdt |tjs(tdt |tjs<tdt |tjrNd}nbt |tjrv|j}t	|dkrt
dn:t |tjr|j|  krtjjkrn n|j}nt
d|tjjkr|tjjkr| jj}n|tjjkr| jj}nt
d| |||S |tjjkr"| jr*t |tjs*t
d	| j|}	|tjjkr|	| jjkr\| jj}n8|	| jjkrt| jj}n |	| jjkr| jj}nt
d
| |||S |tjjkr|rt
d|	| jjkr| jj}n8|	| jjkr| jj}n |	| jjkr| jj }nt
d
| !||S t
d|tjjkrT|tjjkrLt"#|||S t
dt
dd S )N/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instance    i  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingformat is invalid with this key)$r   r&   rS  rP  PrivateFormatKeySerializationEncryptionNoEncryptionBestAvailableEncryptionr   r   r   _KeySerializationEncryption_formatOpenSSHZPKCS8PEMrd   ZPEM_write_bio_PKCS8PrivateKeyrT  Zi2d_PKCS8PrivateKey_bio_private_key_bytes_via_bioZTraditionalOpenSSLrf   r  r  ZPEM_write_bio_RSAPrivateKeyr  ZPEM_write_bio_DSAPrivateKeyr  ZPEM_write_bio_ECPrivateKeyr
  Zi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bio_bio_func_outputrN   Z_serialize_ssh_private_key)
rr   r  rt   r  r   r   cdatar   	write_bior  rZ   rZ   r[   _private_key_bytes  s    
   


  
 


  


  zBackend._private_key_bytesc              	   C   s<   |s| j j}n| jd}| ||||t|| j j| j jS )Ns   aes-256-cbc)rb   r|   rd   EVP_get_cipherbynamer  r   )rr   r  r   r   r   rZ   rZ   r[   r  B  s    
z"Backend._private_key_bytes_via_bioc                 G   s.   |   }||f| }| |dk | |S r   )r   rz   r   )rr   r  argsrU   r   rZ   rZ   r[   r  U  s    zBackend._bio_func_output)r  rt   r_   c                 C   s  t |tjstdt |tjs(td|tjjkrt|tjjkrJ| jj}n|tjj	kr`| jj
}ntd| ||S |tjjkr| j|}|| jjkrtd|tjjkr| jj}n|tjj	kr| jj}ntd| ||S |tjjkr|tjjkrt|S tdtdd S )Nr  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingr  )r   r&   rS  rP  PublicFormatZSubjectPublicKeyInfor  rd   ZPEM_write_bio_PUBKEYrT  Zi2d_PUBKEY_bior   r  ZPKCS1r  r  ZPEM_write_bio_RSAPublicKeyr  r  rN   Zserialize_ssh_public_key)rr   r  rt   r   r   r  r  r  rZ   rZ   r[   _public_key_bytes[  s@    




zBackend._public_key_bytesc                 C   s
   | j j S r   rd   r  rq   rZ   rZ   r[   dh_supported  s    zBackend.dh_supported)	generatorr   r_   c                 C   s   |t jk rtdt j|dkr*td| j }| || jjk | j	|| jj
}| j|||| jj}|dkr|  }td|t| |S )Nz$DH key_size must be at least {} bits)      zDH generator must be 2 or 5r^   z Unable to generate DH parameters)r(   Z_MIN_MODULUS_SIZEr   rt   rd   DH_newrz   rb   r|   r   r  ZDH_generate_parameters_exr   r   )rr   r  r   Zdh_param_cdatar   ry   rZ   rZ   r[   generate_dh_parameters  s*    

   
zBackend.generate_dh_parametersc                 C   s(   |   }| j||}| |dk |S r   )r   rd   ZEVP_PKEY_set1_DHrz   )rr   r  r   r   rZ   rZ   r[   _dh_cdata_to_evp_pkey  s    zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| }| j|}| |dk | |}t| ||S r   )r   Z	_dh_cdatard   ZDH_generate_keyrz   r  r   )rr   r,  Zdh_key_cdatar   r   rZ   rZ   r[   generate_dh_private_key  s     
zBackend.generate_dh_private_keyc                 C   s   |  | ||S r   )r  r  )rr   r  r   rZ   rZ   r[   &generate_dh_private_key_and_parameters  s    
z.Backend.generate_dh_private_key_and_parametersc                 C   s>  |j j}| j }| || jjk | j|| jj}| 	|j
}| 	|j}|jd k	rf| 	|j}n| jj}| 	|j j}| 	|j}| j||||}	| |	dk | j|||}	| |	dk | jdd}
| j||
}	| |	dk |
d dkr(|jdkr |
d | jjA dks(td| |}t| ||S )Nr^   int[]r   r  z.DH private numbers did not pass safety checks.)r   r5  rd   r  rz   rb   r|   r   r  r   r   r1  r   r6  r7  DH_set0_pqgDH_set0_keyr   DH_checkZDH_NOT_SUITABLE_GENERATORr   r  r   )rr   r   r5  r  r   r1  r   r2  r3  r   codesr   rZ   rZ   r[   load_dh_private_numbers  s4    



zBackend.load_dh_private_numbersc           
      C   s   | j  }| || jjk | j|| j j}|j}| |j	}| |j
}|jd k	rd| |j}n| jj}| |j}| j ||||}| |dk | j ||| jj}| |dk | |}	t| ||	S r   )rd   r  rz   rb   r|   r   r  r5  r   r   r1  r   r6  r  r  r  r   )
rr   r   r  r5  r   r1  r   r2  r   r   rZ   rZ   r[   load_dh_public_numbers  s     


zBackend.load_dh_public_numbersc                 C   s   | j  }| || jjk | j|| j j}| |j}| |j	}|j
d k	r^| |j
}n| jj}| j ||||}| |dk t| |S r   )rd   r  rz   rb   r|   r   r  r   r   r1  r   r  r   )rr   r   r  r   r1  r   r   rZ   rZ   r[   load_dh_parameter_numbers  s    

z!Backend.load_dh_parameter_numbers)r   r1  r   r_   c                 C   s   | j  }| || jjk | j|| j j}| |}| |}|d k	rV| |}n| jj}| j ||||}| |dk | j	dd}| j 
||}| |dk |d dkS )Nr^   r  r   )rd   r  rz   rb   r|   r   r  r   r  r   r  )rr   r   r1  r   r  r   r  rZ   rZ   r[   dh_parameters_supported+  s    


zBackend.dh_parameters_supportedc                 C   s   | j jdkS r   )rd   ro   rq   rZ   rZ   r[   dh_x942_serialization_supportedC  s    z'Backend.dh_x942_serialization_supportedc                 C   s   t j|S r   )r   r/   Zfrom_public_bytesrr   r   rZ   rZ   r[   x25519_load_public_bytesF  s    z Backend.x25519_load_public_bytesc                 C   s   t j|S r   )r   r/   Zfrom_private_bytesr  rZ   rZ   r[   x25519_load_private_bytesI  s    z!Backend.x25519_load_private_bytesc                 C   s   | j || jj}| || jjk | j|| j j}| j |}| |dk | jd}| j 	||}| |dk | |d | jjk | j|d | j j
}|S )Nr^   EVP_PKEY **r   )rd   ZEVP_PKEY_CTX_new_idrb   r|   rz   r   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr   ZEVP_PKEY_keygenr   )rr   nidZevp_pkey_ctxr   Z	evp_ppkeyr   rZ   rZ   r[   _evp_pkey_keygen_gcN  s    zBackend._evp_pkey_keygen_gcc                 C   s
   t j S r   )r   r/   Zgenerate_keyrq   rZ   rZ   r[   x25519_generate_key[  s    zBackend.x25519_generate_keyc                 C   s   | j r
dS | jj S r   )rf   rd   Z#CRYPTOGRAPHY_LIBRESSL_LESS_THAN_370rq   rZ   rZ   r[   x25519_supported^  s    zBackend.x25519_supportedc                 C   s`   t |dkrtd| j| jj| jj|t |}| || jjk | j|| jj	}t
| |S )N8   z#An X448 public key is 56 bytes long)r   r   rd   EVP_PKEY_new_raw_public_keyNID_X448rb   r|   rz   r   r   r"   rr   r   r   rZ   rZ   r[   x448_load_public_bytesc  s       zBackend.x448_load_public_bytesc                 C   sl   t |dkrtd| j|}| j| jj| jj|t |}| || jjk | j	|| jj
}t| |S )Nr  z$An X448 private key is 56 bytes long)r   r   rb   r   rd   EVP_PKEY_new_raw_private_keyr  r|   rz   r   r   r!   rr   r   r   r   rZ   rZ   r[   x448_load_private_bytesn  s       zBackend.x448_load_private_bytesc                 C   s   |  | jj}t| |S r   )r  rd   r  r!   r   rZ   rZ   r[   x448_generate_keyz  s    zBackend.x448_generate_keyc                 C   s   | j r
dS | jj o| jj S r   )rf   rd   r  r  rq   rZ   rZ   r[   x448_supported~  s
    
zBackend.x448_supportedc                 C   s   | j r
dS | jjS r   )rf   rd   Z CRYPTOGRAPHY_HAS_WORKING_ED25519rq   rZ   rZ   r[   ed25519_supported  s    zBackend.ed25519_supportedc                 C   sn   t d| t|tjkr"td| j| jj| j	j
|t|}| || j	j
k | j	|| jj}t| |S )Nr   z&An Ed25519 public key is 32 bytes long)r   _check_bytesr   r,   _ED25519_KEY_SIZEr   rd   r  NID_ED25519rb   r|   rz   r   r   r   r  rZ   rZ   r[   ed25519_load_public_bytes  s       z!Backend.ed25519_load_public_bytesc                 C   sz   t |tjkrtdtd| | j|}| j	| jj
| jj|t |}| || jjk | j|| jj}t| |S )Nz'An Ed25519 private key is 32 bytes longr   )r   r,   r  r   r   r_  rb   r   rd   r  r  r|   rz   r   r   r   r  rZ   rZ   r[   ed25519_load_private_bytes  s       z"Backend.ed25519_load_private_bytesc                 C   s   |  | jj}t| |S r   )r  rd   r  r   r   rZ   rZ   r[   ed25519_generate_key  s    zBackend.ed25519_generate_keyc                 C   s   | j r
dS | jj o| jj S r   )rf   rd   Z#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Br  rq   rZ   rZ   r[   ed448_supported  s
    
zBackend.ed448_supportedc                 C   sl   t d| t|tkr td| j| jj| jj	|t|}| 
|| jj	k | j|| jj}t| |S )Nr   z$An Ed448 public key is 57 bytes long)r   r  r   r   r   rd   r  	NID_ED448rb   r|   rz   r   r   r   r  rZ   rZ   r[   ed448_load_public_bytes  s       zBackend.ed448_load_public_bytesc                 C   sx   t d| t|tkr td| j|}| j| jj	| jj
|t|}| || jj
k | j|| jj}t| |S )Nr   z%An Ed448 private key is 57 bytes long)r   r_  r   r   r   rb   r   rd   r  r  r|   rz   r   r   r   r  rZ   rZ   r[   ed448_load_private_bytes  s       z Backend.ed448_load_private_bytesc                 C   s   |  | jj}t| |S r   )r  rd   r  r   r   rZ   rZ   r[   ed448_generate_key  s    zBackend.ed448_generate_key)r   r   r   r   rr   r_   c                 C   s   | j d|}| j |}| j|t||t||||tj||
}	|	dkrr|  }
d| | d }t	d
||
| j |d d  S )Nr   r^      i   zJNot enough memory to derive key. These parameters require {} MB of memory.)rb   r   r   rd   ZEVP_PBE_scryptr   rM   Z
_MEM_LIMITr   MemoryErrorrt   r   )rr   r   r   r   r   r  r   r   r   r   ry   Z
min_memoryrZ   rZ   r[   derive_scrypt  s0    	zBackend.derive_scryptc                 C   sL   t |}| jr|| jkrdS |dr4| jjdkS | j|| jj	kS d S )NFs   -sivr^   )
r   Z_aead_cipher_namerf   
_fips_aeadendswithrd   r   r  rb   r|   )rr   r   cipher_namerZ   rZ   r[   aead_cipher_supported  s    

zBackend.aead_cipher_supported)r   r_   c                 C   s   t |D ]}d||< qd S r{   )range)rr   r   r   irZ   rZ   r[   
_zero_data  s    zBackend._zero_datac                 c   sf   |dkr| j jV  nNt|}| j d|d }| j ||| z
|V  W 5 | | j d|| X dS )a  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr   r^   z	uint8_t *)rb   r|   r   r   Zmemmover  r  )rr   r   Zdata_lenr   rZ   rZ   r[   _zeroed_null_terminated_buf  s    
z#Backend._zeroed_null_terminated_buf)r   r   r_   c                 C   s2   |  ||}|j|jr|jjnd dd |jD fS )Nc                 S   s   g | ]
}|j qS rZ   )certificate)rd  rR  rZ   rZ   r[   
<listcomp>0  s     zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)load_pkcs12r   rR  r  Zadditional_certs)rr   r   r   Zpkcs12rZ   rZ   r[   %load_key_and_certificates_from_pkcs12%  s
    z-Backend.load_key_and_certificates_from_pkcs12c              	   C   sj  |d k	rt d| | |}| j|j| jj}|| jjkrN|   t	d| j
|| jj}| jd}| jd}| jd}| |}| j|||||}	W 5 Q R X |	dkr|   t	dd }
d }g }|d | jjkr| j
|d | jj}| j|dd	}|d | jjkrt| j
|d | jj}| |}d }| j|| jj}|| jjkrj| j|}t||}
|d | jjkr^| j
|d | jj}| j|d }| jjs| jjrt|}ntt|}|D ]}| j||}| || jjk | j
|| jj}| |}d }| j|| jj}|| jjkrJ| j|}|t|| qt||
|S )
Nr   z!Could not deserialize PKCS12 datar  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 dataFr   ) r   r_  r   rd   Zd2i_PKCS12_biorU   rb   r|   r   r   r   PKCS12_freer   r  ZPKCS12_parser   r  rU  rX  ZX509_alias_get0r   rP   sk_X509_freesk_X509_numr   r  r  reversedsk_X509_valuerz   rp   rQ   )rr   r   r   rU   p12Zevp_pkey_ptrrW  Zsk_x509_ptrpassword_bufr   rR  r   Zadditional_certificatesr   r   Zcert_objr   Z
maybe_namesk_x509r   indicesr  Z	addl_certZ	addl_namerZ   rZ   r[   r  3  sz    
     



zBackend.load_pkcs12)r   r   rR  casr  r_   c                 C   sf  d }|d k	rt d| t|tjr@d}d}d}	d}
| jj}nDt|tjr| jj	rf| jj
}| jj
}n| jj}| jj}d}	d}
| jj}|j}nt|tjr||jtjjkr|d}d}d}	d}
|j}|j}|tjkr| jj}| jj}n>|tjkr| jj	std| jj
}| jj
}n|d ks"t|jd k	r`| jjs@td| |j}| || jjk n| jj}|jd k	r|j}	ntd|d kst|dkr| jj}n| j }| j|| jj }g }|D ]}t|t!r0|j"}| #|j$}|d kr| j%|| jjd}n| j%||t|}| |dk n
| #|}|&| | j'||}t(|dk q| )|}| )|V}|r| #|n| jj}|d k	r|j*}n| jj}| j+||||||||	|
d
}W 5 Q R X | jjr
|| jjkr
| j,||d| jjd|
| W 5 Q R X | || jjk | j|| jj-}| . }| j/||}| |dk | 0|S )	Nr   r]  r   i N  r^   z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption type)1r   r  r   r&   r  rb   r|   r  rd   r   ZNID_aes_256_cbcZ&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr   r  r  r  ZPKCS12Z_key_cert_algorithmrO   ZPBESv1SHA1And3KeyTripleDESCBCZPBESv2SHA256AndAES256CBCr   r   Z
_hmac_hashZCryptography_HAS_PKCS12_SET_MACr   rz   Z_kdf_roundsr   r   Zsk_X509_new_nullr   r  rP   Zfriendly_namerV  r  ZX509_alias_set1rp   Zsk_X509_pushr{  r  rY  ZPKCS12_createZPKCS12_set_macr  r   Zi2d_PKCS12_bior   )rr   r   r   rR  r  r  r   Znid_certZnid_keyZpkcs12_iterZmac_iterZmac_algZ
keycertalgr  Zossl_cascaZca_aliasZossl_car   r  Zname_bufZ	ossl_certr   r  rU   rZ   rZ   r[   (serialize_key_and_certificates_to_pkcs12~  s     
 	







    




z0Backend.serialize_key_and_certificates_to_pkcs12c                 C   s   | j r
dS | jjdkS r   )rf   rd   ZCryptography_HAS_POLY1305rq   rZ   rZ   r[   poly1305_supported	  s    zBackend.poly1305_supported)r   r_   c                 C   s*   t d| t|tkr tdt| |S )Nr   zA poly1305 key is 32 bytes long)r   r_  r   r   r   r   )rr   r   rZ   rZ   r[   create_poly1305_ctx"	  s    zBackend.create_poly1305_ctxc                 C   s
   | j j S r   r  rq   rZ   rZ   r[   pkcs7_supported)	  s    zBackend.pkcs7_supportedc                 C   sn   t d| | |}| j|j| jj| jj| jj}|| jjkrR|   t	d| j
|| jj}| |S Nr   zUnable to parse PKCS7 data)r   r  r   rd   ZPEM_read_bio_PKCS7rU   rb   r|   r   r   r   
PKCS7_free_load_pkcs7_certificatesrr   r   rU   p7rZ   rZ   r[   load_pem_pkcs7_certificates,	  s    
   z#Backend.load_pem_pkcs7_certificatesc                 C   sb   t d| | |}| j|j| jj}|| jjkrF|   t	d| j
|| jj}| |S r  )r   r  r   rd   Zd2i_PKCS7_biorU   rb   r|   r   r   r   r  r  r  rZ   rZ   r[   load_der_pkcs7_certificates;	  s    
z#Backend.load_der_pkcs7_certificatesc           	      C   s   | j |j}| || j jk || j jkr>td|tj	|j
jj}| j |}g }t|D ]8}| j ||}| || jjk | |}|| q`|S )NzNOnly basic signed structures are currently supported. NID for this data was {})rd   ZOBJ_obj2nidr   rz   ri  ZNID_pkcs7_signedr   rt   r   ZUNSUPPORTED_SERIALIZATIONr   signrR  r  r  r  rb   r|   rX  rp   )	rr   r  r  r  r   certsr  r   rR  rZ   rZ   r[   r  H	  s$    

z Backend._load_pkcs7_certificates)N)N)N)rW   rX   rY   __doc__r   r  r8   r   r%   r  r   r!  r"  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r   r*   Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1r  Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrs   strrw   r}   typingOptionalListr   ZOpenSSLErrorrz   re   r   r   
contextlibr   r   rm   r   ru   r   r   bytesZHashAlgorithmr   r   r   r   r   r   r   r   ZHashContextr   r7   rL   r   r   rh   r   r   r   r   r   r   r   r   r-   ZRSAPrivateKeyr   r   ZRSAPrivateNumbersr   ZRSAPublicNumbersZRSAPublicKeyr   r   r   rT   r   r   r   r4   r  r5   r  r#  r'   r'  r(  r)   ZDSAParametersr+  ZDSAPrivateKeyr.  r/  r4  ZDSAPrivateNumbersr8  ZDSAPublicNumbersZDSAPublicKeyr:  ZDSAParameterNumbersr;  r-  r<  r=  r@  r6   r
   rA  rC  rL  r(   ZDHParametersrM  r  rN  r  rQ  r   ZCertificateAnyrV  rX  r\  rB  NoReturnrI  ZEllipticCurverl  ZEllipticCurveSignatureAlgorithmrn  ZEllipticCurvePrivateKeyrs  ZEllipticCurvePrivateNumbersr  ZEllipticCurvePublicNumbersZEllipticCurvePublicKeyr  r  r  rp  r  r  r  rq  rh  rx  ry  r&   rS  r  r  r  r  r  r  r  r  r  r  ZDHPrivateKeyr  r  ZDHPrivateNumbersr  ZDHPublicNumbersZDHPublicKeyr  ZDHParameterNumbersr  r  r  r/   ZX25519PublicKeyr  ZX25519PrivateKeyr  r  r  r  r.   ZX448PublicKeyr  ZX448PrivateKeyr  r  r  r  r,   ZEd25519PublicKeyr  ZEd25519PrivateKeyr  r  r  r+   ZEd448PublicKeyr  ZEd448PrivateKeyr  r  r  r  r  r  Tupler  rQ   r  rR   rS   r  r  r   r  r  r  r  r  rZ   rZ   rZ   r[   r\      s\  


	 		E    *H;	*4.5  * 
#|7  1  # 

 M
  

r\   c                   @   s,   e Zd ZedddZeeedddZdS )r   )fmtc                 C   s
   || _ d S r   )_fmt)rr   r	  rZ   rZ   r[   rs   _	  s    zGetCipherByName.__init__)r{  r   r~   c                 C   sd   | j j||d }|j|d}||jjkrX|jjrX|j	|jj|d|jj}|
  |S )N)r   r~   r   )r
  rt   lowerrd   r  r   rb   r|   ZCryptography_HAS_300_EVP_CIPHERZEVP_CIPHER_fetchr   )rr   r{  r   r~   r  r   rZ   rZ   r[   __call__b	  s    
zGetCipherByName.__call__N)	rW   rX   rY   r   rs   r\   r7   rL   r  rZ   rZ   rZ   r[   r   ^	  s   r   )r{  r   c                 C   s$   d|j d  d}| j|dS )Nzaes-r  z-xtsr   )r   rd   r  r   )r{  r   r~   r  rZ   rZ   r[   r   w	  s    r   )xcollectionsr  r   r  rj   r   Zcryptographyr   r   Zcryptography.exceptionsr   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr
   Z'cryptography.hazmat.backends.openssl.dhr   r   r   r   Z(cryptography.hazmat.backends.openssl.dsar   r   r   Z'cryptography.hazmat.backends.openssl.ecr   r   Z*cryptography.hazmat.backends.openssl.ed448r   r   r   Z,cryptography.hazmat.backends.openssl.ed25519r   r   Z+cryptography.hazmat.backends.openssl.hashesr   Z)cryptography.hazmat.backends.openssl.hmacr   Z-cryptography.hazmat.backends.openssl.poly1305r   r   Z(cryptography.hazmat.backends.openssl.rsar   r    Z)cryptography.hazmat.backends.openssl.x448r!   r"   Z"cryptography.hazmat.bindings._rustr#   r   Z$cryptography.hazmat.bindings.opensslr$   Zcryptography.hazmat.primitivesr%   r&   Z*cryptography.hazmat.primitives._asymmetricr'   Z)cryptography.hazmat.primitives.asymmetricr(   r)   r*   r+   r,   r-   r.   r/   Z1cryptography.hazmat.primitives.asymmetric.paddingr0   r1   r2   r3   Z/cryptography.hazmat.primitives.asymmetric.typesr4   r5   Z&cryptography.hazmat.primitives.ciphersr6   r7   Z1cryptography.hazmat.primitives.ciphers.algorithmsr8   r9   r:   r;   r<   r=   r>   r?   r@   rA   rB   rC   Z,cryptography.hazmat.primitives.ciphers.modesrD   rE   rF   rG   rH   rI   rJ   rK   rL   Z"cryptography.hazmat.primitives.kdfrM   Z,cryptography.hazmat.primitives.serializationrN   Z3cryptography.hazmat.primitives.serialization.pkcs12rO   rP   rQ   rR   rS   
namedtuplerT   rV   r\   r   r   r{  rZ   rZ   rZ   r[   <module>   sp   (
8,                 p