U
    EZh6                     @   s  U d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZmZmZmZ d dlm
Z d dlmZmZmZ d dlmZmZmZmZmZm Z  zd d	l!m"Z# d
Z$W n4 e%k
r   dZ$dre&e&e'e'e(e&dddZ#Y nX dZ)dZ*dZ+dZ,dZ-dZ.dZ/dZ0dZ1e2dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:e2e5d  e6 ej;Z<e=e>e?d!d"Z@ejAd#ejBdfejAd#ejCdfd$ZDejEe&ejFejGejA e'ejHejGejB ejGejC f e'f f eId%< e,e-e.d&ZJejHd' e&d(d)d*ZKejLe&d+d,d-ZMe5d. e6d. fe&e&e&e&d/d0d1ZNe&e'dd2d3d4ZOe&dd5d6d7ZPe&ejQe& e&e'eejHejCejBf  d8d9d:ZRe=ejFe'e=f d5d;d<ZSe=ejFe'e=f d5d=d>ZTe=ejFe=e=f d5d?d@ZUe=ejFe'e=f d5dAdBZVe'e&dCdDdEZWG dFdG dGZXG dHdI dIZYG dJdK dKZZG dLdM dMZ[G dNdO dOZ\e*eY e+eZ e)e\ e,e[dPe] e-e[dQe^ e.e[dRe_ iZ`e&dSdTdUZaejHejbejcejdejef Zfdse&ejQe& ejgefdVdWdXZhefe&ee&dYdZd[ZiejHejLejjejkejlf ZmejHejLejjejlf ZnG d\d] d]ejoZpG d^d_ d_Zqejrejsd`dadbZtdte&ejHeqemf d5dcddZue&ejHeqemf d5dedfZve=ejEe&e&f dgdhdiZwdue&ejgemdjdkdlZxeme&d+dmdnZyejHejbejcejef ZzdoZ{G dpdq dqZ|dS )v    N)encodebytes)utilsUnsupportedAlgorithm)hashes)dsaeced25519paddingrsa)Cipher
algorithmsmodes)EncodingKeySerializationEncryptionNoEncryptionPrivateFormatPublicFormat_KeySerializationEncryption)kdfTF)passwordsaltdesired_key_bytesroundsignore_few_roundsreturnc                 C   s   t dd S )NzNeed bcrypt moduler   )r   r   r   r   r    r   w/home/aprabhat/apps/x.techxrdev.in/venv/lib/python3.8/site-packages/cryptography/hazmat/primitives/serialization/ssh.py_bcrypt_kdf*   s    r   s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   rsa-sha2-256s   rsa-sha2-512s   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   none
   aes256-ctr   s   (.*?)          )r   s
   aes256-cbc_SSH_CIPHERS)Z	secp256r1Z	secp384r1Z	secp521r1)SSHPrivateKeyTypesSSHPublicKeyTypes)keyr   c                 C   s   t | tjrt|  }nft | tjr0t| }nPt | tjtjfrHt	}n8t | t
jt
jfr`t}n t | tjtjfrxt}ntd|S )NUnsupported key type)
isinstancer   EllipticCurvePrivateKey_ecdsa_key_type
public_keyEllipticCurvePublicKeyr   RSAPrivateKeyRSAPublicKey_SSH_RSAr   DSAPrivateKeyDSAPublicKey_SSH_DSAr	   Ed25519PrivateKeyEd25519PublicKey_SSH_ED25519
ValueError)r'   key_typer   r   r   _get_ssh_key_typef   s    
 
r9   r,   r   c                 C   s*   | j }|jtkr td|jt|j S )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPEr7   )r,   r;   r   r   r   r+   {   s    

r+      
)dataprefixsuffixr   c                 C   s   d |t| |gS )N    )join_base64_encode)r?   r@   rA   r   r   r   _ssh_pem_encode   s    rE   )r?   	block_lenr   c                 C   s    | rt | | dkrtddS )zRequire data to be full blocksr   zCorrupt data: missing paddingN)lenr7   )r?   rF   r   r   r   _check_block_size   s    rH   r?   r   c                 C   s   | rt ddS )z!All data should have been parsed.zCorrupt data: unparsed dataN)r7   r?   r   r   r   _check_empty   s    rK   )
ciphernamer   r   r   r   c           	      C   sR   |st dt|  \}}}}t|||| |d}t||d| |||d S )z$Generate key + iv and return cipher.zKey is password-protected.TN)r7   r$   r   r   )	rL   r   r   r   algoZkey_lenmodeZiv_lenseedr   r   r   _init_cipher   s
    rP   c                 C   s6   t | dk rtdtj| dd dd| dd fS )ZUint32   Invalid dataNbig	byteorderrG   r7   int
from_bytesrJ   r   r   r   _get_u32   s    rY   c                 C   s6   t | dk rtdtj| dd dd| dd fS )ZUint64   rR   NrS   rT   rV   rJ   r   r   r   _get_u64   s    r[   c                 C   s8   t | \}} |t| kr td| d| | |d fS )zBytes with u32 length prefixrR   N)rY   rG   r7   )r?   nr   r   r   _get_sshstr   s    r]   c                 C   s4   t | \}} |r$|d dkr$tdt|d| fS )zBig integer.r      rR   rS   )r]   r7   rW   rX   )r?   valr   r   r   
_get_mpint   s    r`   r_   r   c                 C   s4   | dk rt d| sdS |  d d }t| |S )z!Storage format for signed bigint.r   znegative mpint not allowedrB   rZ   )r7   
bit_lengthr   Zint_to_bytes)r_   nbytesr   r   r   	_to_mpint   s    rd   c                   @   s   e Zd ZU dZeje ed< dejeje  ddddZ	edddd	Z
eddd
dZeddddZejed f ddddZeddddZedddZdeeedddZedddZdS )	_FragListz,Build recursive structure without data copy.flistN)initr   c                 C   s   g | _ |r| j | d S N)rf   extend)selfrg   r   r   r   __init__   s    z_FragList.__init__ra   c                 C   s   | j | dS )zAdd plain bytesN)rf   appendrj   r_   r   r   r   put_raw   s    z_FragList.put_rawc                 C   s   | j |jddd dS )zBig-endian uint32rQ   rS   lengthrU   Nrf   rl   to_bytesrm   r   r   r   put_u32   s    z_FragList.put_u32c                 C   s   | j |jddd dS )zBig-endian uint64rZ   rS   ro   Nrq   rm   r   r   r   put_u64   s    z_FragList.put_u64c                 C   sL   t |tttfr,| t| | j| n| |  | j	|j dS )zBytes prefixed with u32 lengthN)
r)   bytes
memoryview	bytearrayrs   rG   rf   rl   sizeri   rm   r   r   r   
put_sshstr   s
    z_FragList.put_sshstrc                 C   s   |  t| dS )z*Big-endian bigint prefixed with u32 lengthN)ry   rd   rm   r   r   r   	put_mpint   s    z_FragList.put_mpintr   c                 C   s   t tt| jS )zCurrent number of bytes)summaprG   rf   rj   r   r   r   rx      s    z_FragList.sizer   )dstbufposr   c                 C   s2   | j D ]&}t|}|||  }}||||< q|S )zWrite into bytearray)rf   rG   )rj   r   r   fragZflenstartr   r   r   render   s
    
z_FragList.renderc                 C   s"   t t|  }| | | S )zReturn as bytes)rv   rw   rx   r   tobytes)rj   bufr   r   r   r     s    
z_FragList.tobytes)N)r   )__name__
__module____qualname____doc__typingListru   __annotations__Optionalrk   rn   rW   rs   rt   Unionry   rz   rx   rv   r   r   r   r   r   r   re      s   
 	re   c                   @   s~   e Zd ZdZedddZeejej	ef dddZ
eejejef ddd	Zej	ed
dddZejed
dddZd
S )_SSHFormatRSAzhFormat for RSA keys.

    Public:
        mpint e, n
    Private:
        mpint n, e, d, iqmp, p, q
    rJ   c                 C   s$   t |\}}t |\}}||f|fS )zRSA public fieldsr`   )rj   r?   er\   r   r   r   
get_public  s    z_SSHFormatRSA.get_publicrI   c                 C   s.   |  |\\}}}t||}| }||fS )zMake RSA public key from data.)r   r   RSAPublicNumbersr,   )rj   r?   r   r\   public_numbersr,   r   r   r   load_public  s    z_SSHFormatRSA.load_publicc              	   C   s   t |\}}t |\}}t |\}}t |\}}t |\}}t |\}}||f|kr\tdt||}	t||}
t||}t||||	|
||}| }||fS )zMake RSA private key from data.z Corrupt data: rsa field mismatch)r`   r7   r   Zrsa_crt_dmp1Zrsa_crt_dmq1r   ZRSAPrivateNumbersprivate_key)rj   r?   	pubfieldsr\   r   diqmppqZdmp1Zdmq1r   private_numbersr   r   r   r   load_private   s,          z_SSHFormatRSA.load_privateNr,   f_pubr   c                 C   s$   |  }||j ||j dS )zWrite RSA public keyN)r   rz   r   r\   )rj   r,   r   Zpubnr   r   r   encode_public6  s    z_SSHFormatRSA.encode_publicr   f_privr   c                 C   sZ   |  }|j}||j ||j ||j ||j ||j ||j dS )zWrite RSA private keyN)	r   r   rz   r\   r   r   r   r   r   )rj   r   r   r   r   r   r   r   encode_private>  s    z_SSHFormatRSA.encode_private)r   r   r   r   rv   r   r   Tupler   r/   r   r.   r   re   r   r   r   r   r   r   r     s    
 	 r   c                   @   s   e Zd ZdZeejejef dddZeejej	ef dddZ
eejejef dddZej	ed	d
ddZejed	dddZejd	dddZd	S )_SSHFormatDSAzhFormat for DSA keys.

    Public:
        mpint p, q, g, y
    Private:
        mpint p, q, g, y, x
    rI   c                 C   s@   t |\}}t |\}}t |\}}t |\}}||||f|fS )zDSA public fieldsr   )rj   r?   r   r   gyr   r   r   r   W  s
    z_SSHFormatDSA.get_publicc           	      C   sJ   |  |\\}}}}}t|||}t||}| | | }||fS )zMake DSA public key from data.)r   r   DSAParameterNumbersDSAPublicNumbers	_validater,   )	rj   r?   r   r   r   r   parameter_numbersr   r,   r   r   r   r   a  s    
z_SSHFormatDSA.load_publicc                 C   sz   |  |\\}}}}}t|\}}||||f|kr:tdt|||}t||}	| |	 t||	}
|
 }||fS )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r   r`   r7   r   r   r   r   ZDSAPrivateNumbersr   )rj   r?   r   r   r   r   r   xr   r   r   r   r   r   r   r   l  s    
z_SSHFormatDSA.load_privateNr   c                 C   sL   |  }|j}| | ||j ||j ||j ||j dS )zWrite DSA public keyN)r   r   r   rz   r   r   r   r   )rj   r,   r   r   r   r   r   r   r   |  s    
z_SSHFormatDSA.encode_publicr   c                 C   s$   |  | | || j dS )zWrite DSA private keyN)r   r,   rz   r   r   )rj   r   r   r   r   r   r     s    z_SSHFormatDSA.encode_private)r   r   c                 C   s    |j }|j dkrtdd S )Ni   z#SSH supports only 1024 bit DSA keys)r   r   rb   r7   )rj   r   r   r   r   r   r     s    z_SSHFormatDSA._validate)r   r   r   r   rv   r   r   r   r   r2   r   r1   r   re   r   r   r   r   r   r   r   r   r   N  s&   	  r   c                   @   s   e Zd ZdZeejdddZee	j
e	j
ef dddZee	j
ejef ddd	Zee	j
ejef dd
dZejeddddZejeddddZdS )_SSHFormatECDSAzFormat for ECDSA keys.

    Public:
        str curve
        bytes point
    Private:
        str curve
        bytes point
        mpint secret
    ssh_curve_namer;   c                 C   s   || _ || _d S rh   r   )rj   r   r;   r   r   r   rk     s    z_SSHFormatECDSA.__init__rI   c                 C   sJ   t |\}}t |\}}|| jkr*td|d dkr>td||f|fS )zECDSA public fieldszCurve name mismatchr   rQ   zNeed uncompressed point)r]   r   r7   NotImplementedError)rj   r?   r;   pointr   r   r   r     s    
z_SSHFormatECDSA.get_publicc                 C   s.   |  |\\}}}tj| j| }||fS )z Make ECDSA public key from data.)r   r   r-   Zfrom_encoded_pointr;   r   )rj   r?   
curve_namer   r,   r   r   r   r     s     z_SSHFormatECDSA.load_publicc                 C   sH   |  |\\}}}t|\}}||f|kr2tdt|| j}||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r   r`   r7   r   Zderive_private_keyr;   )rj   r?   r   r   r   secretr   r   r   r   r     s    z_SSHFormatECDSA.load_privateNr   c                 C   s*   | tjtj}|| j || dS )zWrite ECDSA public keyN)public_bytesr   ZX962r   ZUncompressedPointry   r   )rj   r,   r   r   r   r   r   r     s     z_SSHFormatECDSA.encode_publicr   c                 C   s,   |  }| }| || ||j dS )zWrite ECDSA private keyN)r,   r   r   rz   Zprivate_value)rj   r   r   r,   r   r   r   r   r     s    z_SSHFormatECDSA.encode_private)r   r   r   r   ru   r   EllipticCurverk   rv   r   r   r   r-   r   r*   r   re   r   r   r   r   r   r   r     s&     r   c                   @   s   e Zd ZdZeejejef dddZeejej	ef dddZ
eejejef dddZej	ed	d
ddZejed	dddZd	S )_SSHFormatEd25519z~Format for Ed25519 keys.

    Public:
        bytes point
    Private:
        bytes point
        bytes secret_and_point
    rI   c                 C   s   t |\}}|f|fS )zEd25519 public fields)r]   )rj   r?   r   r   r   r   r     s    z_SSHFormatEd25519.get_publicc                 C   s(   |  |\\}}tj| }||fS )z"Make Ed25519 public key from data.)r   r	   r5   Zfrom_public_bytesr   )rj   r?   r   r,   r   r   r   r     s
    z_SSHFormatEd25519.load_publicc                 C   sb   |  |\\}}t|\}}|dd }|dd }||ksF|f|krNtdtj|}||fS )z#Make Ed25519 private key from data.Nr#   z$Corrupt data: ed25519 field mismatch)r   r]   r7   r	   r4   Zfrom_private_bytes)rj   r?   r   r   Zkeypairr   Zpoint2r   r   r   r   r     s    z_SSHFormatEd25519.load_privateNr   c                 C   s   | tjtj}|| dS )zWrite Ed25519 public keyN)r   r   Rawr   ry   )rj   r,   r   raw_public_keyr   r   r   r     s
     z_SSHFormatEd25519.encode_publicr   c                 C   sR   |  }|tjtjt }|tjtj}t||g}| 	|| |
| dS )zWrite Ed25519 private keyN)r,   Zprivate_bytesr   r   r   r   r   r   re   r   ry   )rj   r   r   r,   Zraw_private_keyr   Z	f_keypairr   r   r   r     s       z _SSHFormatEd25519.encode_private)r   r   r   r   rv   r   r   r   r	   r5   r   r4   r   re   r   r   r   r   r   r   r     s$   
 
 r   s   nistp256s   nistp384s   nistp521r8   c                 C   s8   t | tst|  } | tkr&t|  S td| dS )z"Return valid format or throw errorzUnsupported key type: N)r)   ru   rv   r   _KEY_FORMATSr   r   r   r   r   _lookup_kformat*  s
    
r   )r?   r   backendr   c                 C   sj  t d|  |dk	r t d| t| }|s6td|d}|d}t	t
| || } | tsrtdt
| ttd } t| \}} t| \}} t| \}} t| \}	} |	dkrtdt| \}
} t|
\}}
t|}||
\}}
t|
 t| \}} t|  ||fttfkr| }|tkrBtd||tkrZtd|t| d	 }t|| t|\}}t|\}}t| t||| |}t
| |}nd
}t|| t|\}}t|\}}||krtdt|\}}||krtd|||\}}t|\}}|tdt| krFtdt|tj rft!j"dt j#dd |S )z.Load private key from OpenSSH custom encoding.r?   Nr   zNot OpenSSH private key formatr!   zOnly one key supportedzUnsupported cipher: zUnsupported KDF:    rZ   zCorrupt data: broken checksumzCorrupt data: key type mismatchzCorrupt data: invalid paddingDSSH DSA keys are deprecated and will be removed in a future release.   
stacklevel)$r   _check_byteslike_check_bytes_PEM_RCsearchr7   r   endbinascii
a2b_base64rv   
startswith	_SK_MAGICrG   r]   rY   r   r   rK   _NONEr   r$   r   _BCRYPTrH   rP   Z	decryptorupdater   _PADDINGr)   r   r1   warningswarnDeprecatedIn40)r?   r   r   mp1Zp2rL   kdfnameZ
kdfoptionsnkeysZpubdataZpub_key_typekformatr   ZedataZciphername_bytesblklenr   Zkbufr   ciphZck1Zck2r8   r   commentr   r   r   load_ssh_private_key;  sx    









r   )r   r   encryption_algorithmr   c                 C   s  t d| t| tjr*tjdt jdd t| }t	|}t
 }|rt}t| d }t}t}	t|trv|jdk	rv|j}	td}
||
 ||	 t|||
|	}nt }}d}d}d	}td}d
}t
 }|| ||  | t
||g}|| || | || |td|| |    t
 }|t || || || || || || | }| }tt|| }| | || }|dk	r|! "||| ||d  t#|d| S )z3Serialize private key with OpenSSH custom encoding.r   ISSH DSA key support is deprecated and will be removed in a future releaserQ   r   r   Nr    rZ   r!   rB   )$r   r   r)   r   r1   r   r   r   r9   r   re   _DEFAULT_CIPHERr$   r   _DEFAULT_ROUNDSr   Z_kdf_roundsosurandomry   rs   rP   r   r   r,   r   rn   r   rx   r   rv   rw   r   Z	encryptorZupdate_intorE   )r   r   r   r8   r   Zf_kdfoptionsrL   r   r   r   r   r   r   Zcheckvalr   Zf_public_keyZ	f_secretsZf_mainslenmlenr   Zofsr   r   r   _serialize_ssh_private_key  sl    















 r   c                   @   s   e Zd ZdZdZdS )SSHCertificateTyper!   r   N)r   r   r   USERZHOSTr   r   r   r   r     s   r   c                   @   sH  e Zd Zeeeeeeje eeej	eef ej	eef eeeeeeedddZ
eedddZedddZeedd	d
ZeedddZeedddZeeje dddZeedddZeedddZeej	eef dddZeej	eef dddZedddZedddZddddZdS ) SSHCertificate)_nonce_public_key_serial_cctype_key_id_valid_principals_valid_after_valid_before_critical_options_extensions	_sig_type_sig_key_inner_sig_type
_signature_tbs_cert_body_cert_key_type
_cert_bodyc                 C   s   || _ || _|| _zt|| _W n tk
r<   tdY nX || _|| _|| _|| _	|	| _
|
| _|| _|| _|| _|| _|| _|| _|| _d S )NzInvalid certificate type)r   r   r   r   _typer7   r   r   r   r   r   r   r   r   r   r   r   r   r   )rj   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rk     s(    zSSHCertificate.__init__r{   c                 C   s
   t | jS rh   )ru   r   r~   r   r   r   nonce  s    zSSHCertificate.noncec                 C   s   t t| jS rh   )r   castSSHCertPublicKeyTypesr   r~   r   r   r   r,     s    zSSHCertificate.public_keyc                 C   s   | j S rh   )r   r~   r   r   r   serial#  s    zSSHCertificate.serialc                 C   s   | j S rh   )r   r~   r   r   r   type'  s    zSSHCertificate.typec                 C   s
   t | jS rh   )ru   r   r~   r   r   r   key_id+  s    zSSHCertificate.key_idc                 C   s   | j S rh   )r   r~   r   r   r   valid_principals/  s    zSSHCertificate.valid_principalsc                 C   s   | j S rh   )r   r~   r   r   r   valid_before3  s    zSSHCertificate.valid_beforec                 C   s   | j S rh   )r   r~   r   r   r   valid_after7  s    zSSHCertificate.valid_afterc                 C   s   | j S rh   )r   r~   r   r   r   critical_options;  s    zSSHCertificate.critical_optionsc                 C   s   | j S rh   )r   r~   r   r   r   
extensions?  s    zSSHCertificate.extensionsc                 C   s&   t | j}|| j\}}t| |S rh   )r   r   r   r   rK   )rj   Z	sigformatsignature_keyZsigkey_restr   r   r   r  C  s    
zSSHCertificate.signature_keyc                 C   s"   t | jd tjt | jdd S )N    F)newline)ru   r   r   
b2a_base64r   r~   r   r   r   r   I  s    zSSHCertificate.public_bytesNc                 C   s   |   }t|tjr.|t| jt| j nt|tj	rt
| j\}}t
|\}}t| t||}t|j}||t| jt| nnt|tjst| jtkrt }n*| jtkrt }n| jtkstt }|t| jt| jt | d S rh   )r  r)   r	   r5   verifyru   r   r   r   r-   r`   rK   
asym_utilsZencode_dss_signature_get_ec_hash_algr;   ECDSAr   r/   AssertionErrorr   r0   r   SHA1_SSH_RSA_SHA256SHA256_SSH_RSA_SHA512SHA512r
   PKCS1v15)rj   r  rr?   sZcomputed_sighash_algr   r   r   verify_cert_signatureP  s<     
  



z$SSHCertificate.verify_cert_signature)r   r   r   rv   r&   rW   r   r   ru   Dictrk   propertyr   r   r,   r   r   r   r   r   r   r  r  r  r  r   r  r   r   r   r   r     sP   )r   )r;   r   c                 C   sD   t | tjrt S t | tjr(t S t | tjs8tt	 S d S rh   )
r)   r   	SECP256R1r   r  	SECP384R1SHA384	SECP521R1r  r  )r;   r   r   r   r
  q  s    r
  c           "      C   s  t d|  t| }|s"td|d }}|d}d}|tr^d}|d tt  }|t	krr|srt
dt|}ztt|}W n" ttjfk
r   tdY nX |r|}	t|\}
}|
|krtd	|rt|\}}||\}}|rpt|\}}t|\}}t|\}}t|\}}g }|rPt|\}}|t| q,t|\}}t|\}}t|\}}t|}t|\}}t|}t|\}}t|\}}t|\}}|t	kr|st
d
|	d t|  }t|\}}t| t|\}} |tkr|tttfks,|tkr4||kr4tdt| \}!} t|  t||||||||||||||!|||	S t| |S d S )Nr?   zInvalid line formatr!   r   FTz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)r   r   _SSH_PUBKEY_RCmatchr7   groupendswith_CERT_SUFFIXrG   r3   r   r   rv   r   r   	TypeErrorErrorr]   r   r[   rY   rl   ru   _parse_exts_optsrK   r0   r  r  r   )"r?   _legacy_dsa_allowedr   r8   Zorig_key_typeZkey_bodyZ	with_certr   restZ	cert_bodyZinner_key_typer   r,   r   Zcctyper   Z
principalsr   Z	principalr  r   Zcrit_optionsr  extsr  _Zsig_key_rawZsig_typeZsig_keyZtbs_cert_bodyZsignature_rawZinner_sig_typeZsig_rest	signaturer   r   r   _load_ssh_public_identity{  s    


r*  c                 C   s   t | S rh   )r*  rJ   r   r   r   load_ssh_public_identity  s    r+  )	exts_optsr   c                 C   sj   i }d }| rft | \}} t|}||kr0td|d k	rH||k rHtdt | \}} t|||< |}q|S )NzDuplicate namezFields not lexically sorted)r]   ru   r7   )r,  result	last_namer<   Zbnamevaluer   r   r   r$    s    r$  )r?   r   r   c                 C   sF   t | dd}t|tr | }n|}t|tjrBtjdtj	dd |S )NT)r%  r   r   r   )
r*  r)   r   r,   r   r2   r   r   r   r   )r?   r   Zcert_or_keyr,   r   r   r   load_ssh_public_key  s    

r0  c                 C   sl   t | tjrtjdtjdd t| }t|}t	 }|
| || | t|  }d|d|gS )z&One-line public key format for OpenSSHr   rQ   r   rB   r  )r)   r   r2   r   r   r   r   r9   r   re   ry   r   r   r  r   striprC   )r,   r8   r   r   Zpubr   r   r   serialize_ssh_public_key  s    
r2     c                   @   sR  e Zd Zddddg dddg g f
eje eje eje eje ej	e e
eje eje ej	ejeef  ej	ejeef  d
ddZed dddZed d	d
dZed dddZed dddZej	e d dddZdd Zejeef d dddZejeef d dddZeed dddZeed dd d!Zeed"d#d$ZdS )%SSHCertificateBuilderNF
r   r   r   r   r   _valid_for_all_principalsr   r   r   r   c                 C   s@   || _ || _|| _|| _|| _|| _|| _|| _|	| _|
| _	d S rh   r5  )rj   r   r   r   r   r   r6  r   r   r   r   r   r   r   rk   %  s    zSSHCertificateBuilder.__init__r:   c                 C   s^   t |tjtjtjfstd| jd k	r0t	dt
|| j| j| j| j| j| j| j| j| jd
S )Nr(   zpublic_key already setr5  )r)   r   r-   r   r/   r	   r5   r"  r   r7   r4  r   r   r   r   r6  r   r   r   r   )rj   r,   r   r   r   r,   =  s,    
z SSHCertificateBuilder.public_key)r   r   c                 C   sp   t |tstdd|  kr&dk s0n td| jd k	rBtdt| j|| j| j| j	| j
| j| j| j| jd
S )Nzserial must be an integerr               z"serial must be between 0 and 2**64zserial already setr5  )r)   rW   r"  r7   r   r4  r   r   r   r   r6  r   r   r   r   )rj   r   r   r   r   r   Y  s$    

zSSHCertificateBuilder.serial)r   r   c                 C   sR   t |tstd| jd k	r$tdt| j| j|| j| j	| j
| j| j| j| jd
S )Nz"type must be an SSHCertificateTypeztype already setr5  )r)   r   r"  r   r7   r4  r   r   r   r   r6  r   r   r   r   )rj   r   r   r   r   r   n  s     

zSSHCertificateBuilder.type)r   r   c                 C   sR   t |tstd| jd k	r$tdt| j| j| j|| j	| j
| j| j| j| jd
S )Nzkey_id must be byteszkey_id already setr5  )r)   ru   r"  r   r7   r4  r   r   r   r   r6  r   r   r   r   )rj   r   r   r   r   r     s     

zSSHCertificateBuilder.key_id)r   r   c                 C   s|   | j rtdtdd |D r$|s,td| jr:tdt|tkrNtdt| j| j	| j
| j|| j | j| j| j| jd
S )NzDPrincipals can't be set because the cert is valid for all principalsc                 s   s   | ]}t |tV  qd S rh   )r)   ru   ).0r   r   r   r   	<genexpr>  s     z9SSHCertificateBuilder.valid_principals.<locals>.<genexpr>z5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsr5  )r6  r7   allr"  r   rG   _SSHKEY_CERT_MAX_PRINCIPALSr4  r   r   r   r   r   r   r   r   )rj   r   r   r   r   r     s:    z&SSHCertificateBuilder.valid_principalsc                 C   sJ   | j rtd| jrtdt| j| j| j| j| j d| j| j	| j
| jd
S )Nz@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTr5  )r   r7   r6  r4  r   r   r   r   r   r   r   r   r~   r   r   r   valid_for_all_principals  s$    z.SSHCertificateBuilder.valid_for_all_principals)r   r   c                 C   sv   t |ttfstdt|}|dk s.|dkr6td| jd k	rHtdt| j| j| j	| j
| j| j|| j| j| jd
S )Nz$valid_before must be an int or floatr   r7  zvalid_before must [0, 2**64)zvalid_before already setr5  )r)   rW   floatr"  r7   r   r4  r   r   r   r   r   r6  r   r   r   )rj   r   r   r   r   r     s&    
z"SSHCertificateBuilder.valid_before)r  r   c                 C   sv   t |ttfstdt|}|dk s.|dkr6td| jd k	rHtdt| j| j| j	| j
| j| j| j|| j| jd
S )Nz#valid_after must be an int or floatr   r7  zvalid_after must [0, 2**64)zvalid_after already setr5  )r)   rW   r=  r"  r7   r   r4  r   r   r   r   r   r6  r   r   r   )rj   r  r   r   r   r    s&    
z!SSHCertificateBuilder.valid_after)r<   r/  r   c                 C   sr   t |trt |tstd|dd | jD kr8tdt| j| j| j| j	| j
| j| j| j| j||fg | jd
S )Nname and value must be bytesc                 S   s   g | ]\}}|qS r   r   r8  r<   r(  r   r   r   
<listcomp>  s     z=SSHCertificateBuilder.add_critical_option.<locals>.<listcomp>zDuplicate critical option namer5  )r)   ru   r"  r   r7   r4  r   r   r   r   r   r6  r   r   r   rj   r<   r/  r   r   r   add_critical_option  s     z)SSHCertificateBuilder.add_critical_optionc                 C   sr   t |trt |tstd|dd | jD kr8tdt| j| j| j| j	| j
| j| j| j| j| j||fg d
S )Nr>  c                 S   s   g | ]\}}|qS r   r   r?  r   r   r   r@    s     z7SSHCertificateBuilder.add_extension.<locals>.<listcomp>zDuplicate extension namer5  )r)   ru   r"  r   r7   r4  r   r   r   r   r   r6  r   r   r   rA  r   r   r   add_extension  s     z#SSHCertificateBuilder.add_extension)r   r   c              	   C   s  t |tjtjtjfstd| jd kr0t	d| j
d kr>dn| j
}| jd krVt	d| jd krddn| j}| js~| js~t	d| jd krt	d| jd krt	d| j| jkrt	d	| jjd
d d | jjdd d t| j}|t }td}t|}t }|| || || j| || || jj || t }	| jD ]}
|	|
 qT||	  || j || j t }| jD ]\}}|| || q||  t }| jD ]\}}|| || q||  |d t|}t|}t }|| ||  | ||  t |tjr|!| }t }|| || ||  nt |tjrt"|j#}|!| t$|}t%&|\}}t }|| t }|'| |'| ||  ||  nTt |tjs$t(t }|t) |!| t*+ t,- }|| ||  t./| 0 }t12t3t4d5|d|gS )NzUnsupported private key typezpublic_key must be setr   ztype must be setrB   zAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforec                 S   s   | d S Nr   r   r   r   r   r   <lambda>U  rB   z,SSHCertificateBuilder.sign.<locals>.<lambda>)r'   c                 S   s   | d S rD  r   rE  r   r   r   rF  V  rB   r#   r  )6r)   r   r*   r   r.   r	   r4   r"  r   r7   r   r   r   r   r6  r   r   r   sortr   r9   r!  r   r   r   re   ry   r   rt   rs   r/  r   r,   signr
  r;   r  r	  Zdecode_dss_signaturerz   r  r  r
   r  r   r  r   r  r1  r   r   r   r+  rC   )rj   r   r   r   r8   Zcert_prefixr   r   fZfprincipalsr   Zfcritr<   r/  ZfextZca_typeZcaformatZcafr)  Zfsigr  r  r  ZfsigblobZ	cert_datar   r   r   rH  *  s    





















  
zSSHCertificateBuilder.sign)r   r   r   r   r   r   rW   r   ru   r   boolr   rk   r,   r   r   r   r   r<  r   r=  r   r  rB  rC  SSHCertPrivateKeyTypesr   rH  r   r   r   r   r4  $  s^   $  r4  )F)N)F)N)}r   enumr   rer   r   base64r   rD   Zcryptographyr   Zcryptography.exceptionsr   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   r   r	   r
   r   r	  Z&cryptography.hazmat.primitives.ciphersr   r   r   Z,cryptography.hazmat.primitives.serializationr   r   r   r   r   r   Zbcryptr   r   Z_bcrypt_supportedImportErrorru   rW   rJ  r6   r0   r3   Z_ECDSA_NISTP256Z_ECDSA_NISTP384Z_ECDSA_NISTP521r!  r  r  compiler  r   Z	_SK_STARTZ_SK_ENDr   r   r   r   DOTALLr   rv   rw   ranger   ZAESZCTRZCBCr$   r  r   Typer   r   r=   r9   r-   r+   rE   rH   rK   r   rP   rY   r[   r]   r`   rd   re   r   r   r   r   r  r  r  r   r   r*   r.   r1   r4   r%   Anyr   r   r/   r2   r5   r&   r   Enumr   r   r   ZHashAlgorithmr
  r*  r+  r$  r0  r2  rK  r;  r4  r   r   r   r   <module>   sR    	 



8FHGD      
	 VM  `  	