3 ꅭh��@s�ddlmZmZmZddlZddlZddlZddlZddlmZddl Z ddl mZddlm Z mZddlmZmZddlmZmZmZmZmZddlmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%dd l&m'Z'dd l(m)Z)ddl*m+Z+ddl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5dd l6m7Z7m8Z8m9Z9m:Z:ddl;mZ>ddl?m@Z@mAZAddlBmCZCmDZDddlEmFZFmGZGmHZHddlImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRddlSmTZTddlUmVZVddlWmXZXmYZYddlZm[Z[m\Z\ddl]m^Z^m_Z_ddl`maZambZbddlcmdZdmeZeddlfmgZgmhZhmiZimjZjddlkmlZlddlmmnZnmoZoddlpmqZqmrZrmsZsmtZtmuZuddlvmwZwmxZxmyZymzZzddl{m|Z|m}Z}m~Z~mZm�Z�m�Z�m�Z�m�Z�m�Z�dd l�m�Z�m�Z�m�Z�m�Z�m�Z�m�Z�m�Z�m�Z�dd!l�m�Z�dd"l�m�Z�m�Z�dd#l�m�Z�ej�d$d%d&g�Z�Gd'd(�d(e��Z�e j�e�e j�e�e j�e�e j�e�e j�e�e j�e�e j�e �e j�e�e j�e!�e j�e#�e j�e"�e j�e%�e j�elj��j�j�e$�Gd)d*�d*e��Z�Gd+d,�d,e��Z�d-d.�Z�e��Z�dS)/�)�absolute_import�division�print_functionN)�contextmanager)�range)�utils�x509)�UnsupportedAlgorithm�_Reasons)�INTEGER�NULL�SEQUENCE� encode_der�encode_der_integer) �CMACBackend� CipherBackend�DERSerializationBackend� DHBackend� DSABackend�EllipticCurveBackend�HMACBackend�HashBackend�PBKDF2HMACBackend�PEMSerializationBackend� RSABackend� ScryptBackend�X509Backend)�aead)�_CipherContext)�_CMACContext) �_CRL_ENTRY_REASON_ENUM_TO_CODE�_CRL_EXTENSION_HANDLERS�_EXTENSION_HANDLERS_BASE�_EXTENSION_HANDLERS_SCT�"_OCSP_BASICRESP_EXTENSION_HANDLERS�_OCSP_REQ_EXTENSION_HANDLERS�'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCT�_REVOKED_EXTENSION_HANDLERS�_X509ExtensionParser)� _DHParameters� _DHPrivateKey�_DHPublicKey�_dh_params_dup)�_DSAParameters�_DSAPrivateKey� _DSAPublicKey)�_EllipticCurvePrivateKey�_EllipticCurvePublicKey)�_Ed25519PrivateKey�_Ed25519PublicKey)�_ED448_KEY_SIZE�_Ed448PrivateKey�_Ed448PublicKey) �$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERS�_CRL_EXTENSION_ENCODE_HANDLERS�_EXTENSION_ENCODE_HANDLERS�)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERS�'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERS�_encode_asn1_int_gc�_encode_asn1_str_gc�_encode_name_gc�_txt2obj_gc)�_HashContext)�_HMACContext)�_OCSPRequest� _OCSPResponse)�_POLY1305_KEY_SIZE�_Poly1305Context)�_RSAPrivateKey� _RSAPublicKey)�_X25519PrivateKey�_X25519PublicKey)�_X448PrivateKey�_X448PublicKey)�_Certificate�_CertificateRevocationList�_CertificateSigningRequest�_RevokedCertificate)�binding)�hashes� serialization)�dsa�ec�ed25519�ed448�rsa)�MGF1�OAEP�PKCS1v15�PSS) �AES�ARC4�Blowfish�CAST5�Camellia�ChaCha20�IDEA�SEED� TripleDES)�CBC�CFB�CFB8�CTR�ECB�GCM�OFB�XTS)�scrypt)�pkcs7�ssh)�ocsp� _MemoryBIO�bioZchar_ptrc@seZdZdS)�_RC2N)�__name__� __module__�__qualname__�rwrw�/usr/lib64/python3.6/backend.pyrs�srsc @s|eZdZdZdZddddddhZeefZe j e je je j e je je je je je je je je jf Zd Zd Zdd >Zd Zde>Zdd �Z�d-dd�Zdd�Zdd�Z e!j"dd��Z#dd�Z$dd�Z%dd�Z&dd�Z'dd �Z(d!d"�Z)d#d$�Z*d%d&�Z+d'd(�Z,d)d*�Z-d+d,�Z.d-d.�Z/d/d0�Z0d1d2�Z1d3d4�Z2d5d6�Z3d7d8�Z4d9d:�Z5d;d<�Z6d=d>�Z7d?d@�Z8dAdB�Z9�d.dCdD�Z:dEdF�Z;dGdH�ZdMdN�Z?dOdP�Z@dQdR�ZAdSdT�ZBdUdV�ZCdWdX�ZDdYdZ�ZEd[d\�ZFd]d^�ZGd_d`�ZHdadb�ZIdcdd�ZJdedf�ZKdgdh�ZLdidj�ZMdkdl�ZNdmdn�ZOdodp�ZPdqdr�ZQdsdt�ZRdudv�ZSdwdx�ZTdydz�ZUd{d|�ZVd}d~�ZWdd��ZXd�d��ZYd�d��ZZd�d��Z[d�d��Z\d�d��Z]d�d��Z^d�d��Z_d�d��Z`d�d��Zad�d��Zbd�d��Zcd�d��Zdd�d��Zed�d��Zfd�d��Zgd�d��Zhd�d��Zid�d��Zjd�d��Zkd�d��Zld�d��Zmd�d��Znd�d��Zod�d��Zpd�d��Zqd�d��Zrd�d��Zsd�d��Ztd�d��Zud�d��Zvd�d��Zwd�d��Zxd�dZyd�dĄZzd�dƄZ{d�dȄZ|d�dʄZ}d�d̄Z~e"d�d΄�Zd�dЄZ�d�d҄Z�d�dԄZ�d�dքZ�d�d؄Z�d�dڄZ�d�d܄Z�d�dބZ�d�d��Z�d�d�Z�d�d�Z�d�d�Z�d�d�Z�d�d�Z��d/d�d�Z�d�d�Z�d�d��Z�d�d�Z�d�d�Z�d�d��Z�d�d��Z�d�d��Z�d�d��Z�d�d��Z�d��d�Z��d�d�Z��d�d�Z��d�d�Z��d�d�Z��d �d �Z��d�d�Z��d �d�Z��d�d�Z��d�d�Z��d�d�Z��d�d�Z�e!j"�d�d��Z��d�d�Z�e!j"�d�d��Z��d�d�Z��d�d �Z��d!�d"�Z��d#�d$�Z��d%�d&�Z��d'�d(�Z��d)�d*�Z��d+�d,�Z�dS(0�Backendz) OpenSSL API binding interfaces. Zopensslsaes-128-ccmsaes-192-ccmsaes-256-ccmsaes-128-gcmsaes-192-gcmsaes-256-gcmii�cCs�tj�|_|jj|_|jj|_|j�|_i|_ |j �|j�|j�|jrb|jj rbtjdt�n|j�|jjg|_|jjr�|jj|jj�dS)Nz�sz*Backend._is_fips_enabled..r)�getattrr~ZERR_clear_error�bool)r�Z fips_mode�moderwrwrxr�s zBackend._is_fips_enabledcCsf|jjrb|jj�}||jjkrb|jj|�|jj|jj�}|j|dk�|jj|�}|j|dk�dS)Nrz) r~r�ZENGINE_get_default_RANDr|rZENGINE_unregister_RAND�RAND_set_rand_methodr�� ENGINE_finish)r��e�resrwrwrx�activate_builtin_random�s zBackend.activate_builtin_randomccs�|jj|jj�}|j||jjk�|jj|�}|j|dk�z |VWd|jj|�}|j|dk�|jj|�}|j|dk�XdS)Nrz) r~ZENGINE_by_idZCryptography_osrandom_engine_idr�r|rZENGINE_initZENGINE_freer�)r�r�r�rwrwrx�_get_osurandom_engines zBackend._get_osurandom_enginec Cs`|jjr\|j�|j�� }|jj|�}|j|dk�WdQRX|jj|jj�}|j|dk�dS)Nrz) r~r�r�r�ZENGINE_set_default_RANDr�r�r|r)r�r�r�rwrwrxr�s z Backend.activate_osrandom_enginecCs`|jjdd�}|j��2}|jj|dt|�||jjd�}|j|dk�WdQRX|jj|�j d�S)Nzchar[]�@sget_implementationr�ascii) r|�newr�r~ZENGINE_ctrl_cmd�lenrr��string�decode)r��bufr�r�rwrwrx�osrandom_engine_implementation+s z&Backend.osrandom_engine_implementationcCs|jj|jj|jj��jd�S)z� Friendly string name of the loaded OpenSSL library. This is not necessarily the same version as it was compiled against. Example: OpenSSL 1.1.1d 10 Sep 2019 r�)r|r�r~ZOpenSSL_versionZOPENSSL_VERSIONr�)r�rwrwrx�openssl_version_text4szBackend.openssl_version_textcCs |jj�S)N)r~ZOpenSSL_version_num)r�rwrwrx�openssl_version_number?szBackend.openssl_version_numbercCst|||�S)N)rA)r��key� algorithmrwrwrx�create_hmac_ctxBszBackend.create_hmac_ctxcCsL|jdks|jdkr0dj|j|jd�jd�}n|jjd�}|jj|�}|S)NZblake2bZblake2sz{}{}�r�)�name�formatZdigest_size�encoder~ZEVP_get_digestbyname)r�r�Zalg�evp_mdrwrwrx�_evp_md_from_algorithmEszBackend._evp_md_from_algorithmcCs |j|�}|j||jjk�|S)N)r�r�r|r)r�r�r�rwrwrx�_evp_md_non_null_from_algorithmPs z'Backend._evp_md_non_null_from_algorithmcCs.|jrt||j�rdS|j|�}||jjkS)NF)r�� isinstance�_fips_hashesr�r|r)r�r�r�rwrwrx�hash_supportedUs zBackend.hash_supportedcCs |j|�S)N)r�)r�r�rwrwrx�hmac_supported\szBackend.hmac_supportedcCs t||�S)N)r@)r�r�rwrwrx�create_hash_ctx_szBackend.create_hash_ctxcCs`|jrt||j�rdSy|jt|�t|�f}Wntk rFdSX||||�}|jj|kS)NF)r�r�� _fips_ciphersr��type�KeyErrorr|r)r��cipherr��adapter� evp_cipherrwrwrx�cipher_supportedbszBackend.cipher_supportedcCs0||f|jkrtdj||��||j||f<dS)Nz"Duplicate registration for: {} {}.)r�� ValueErrorr�)r�� cipher_cls�mode_clsr�rwrwrx�register_cipher_adapterls zBackend.register_cipher_adaptercCsnx,tttttttgD]}|jt|t d��qWx(tttttgD]}|jt |t d��q>Wx&ttttgD]}|jt|t d��qfW|jttt d��x&ttttgD]}|jt|t d��q�Wx&ttttgD]}|jt |t d��q�Wx6tjttgttttg�D]\}}|j||t d��q�W|jttd�t d��|jttd�t d��|jttd�t d ��|jttt�dS) Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20)rerhrirkrfrgrjr�r\�GetCipherByNamer`rdr^rc� itertools�productr_rbr]r�rsrarl�_get_xts_cipher)r�r�r�rwrwrxr�usBz!Backend._register_default_cipherscCs�tj�}tj�}|jjr,|jt�|jt�t||jj |jj |d�|_t||jj|jj |d�|_t||jj|jjtd�|_t||jj|jjtd�|_t||jj|jjtd�|_t||jj|jjtd�|_t||jj|jj|d�|_ dS)N)Z ext_countZget_ext�handlers)!r"�copyr'r~ZCryptography_HAS_SCT�updater#r&r(ZX509_get_ext_countZX509_get_extZ_certificate_extension_parserZsk_X509_EXTENSION_numZsk_X509_EXTENSION_valueZ_csr_extension_parserZX509_REVOKED_get_ext_countZX509_REVOKED_get_extZ_revoked_cert_extension_parserZX509_CRL_get_ext_countZX509_CRL_get_extr!Z_crl_extension_parserZOCSP_REQUEST_get_ext_countZOCSP_REQUEST_get_extr%Z_ocsp_req_ext_parserZOCSP_BASICRESP_get_ext_countZOCSP_BASICRESP_get_extr$Z_ocsp_basicresp_ext_parserZOCSP_SINGLERESP_get_ext_countZOCSP_SINGLERESP_get_extZ_ocsp_singleresp_ext_parser)r�Zext_handlersZsingleresp_handlersrwrwrxr��sP z"Backend._register_x509_ext_parserscCs6tj�|_tj�|_tj�|_tj�|_t j�|_ dS)N)r9r��_extension_encode_handlersr8�_crl_extension_encode_handlersr7�$_crl_entry_extension_encode_handlersr;�'_ocsp_request_extension_encode_handlersr:�)_ocsp_basicresp_extension_encode_handlers)r�rwrwrxr��s zBackend._register_x509_encoderscCst|||tj�S)N)rZ_ENCRYPT)r�r�r�rwrwrx�create_symmetric_encryption_ctx�sz'Backend.create_symmetric_encryption_ctxcCst|||tj�S)N)rZ_DECRYPT)r�r�r�rwrwrx�create_symmetric_decryption_ctx�sz'Backend.create_symmetric_decryption_ctxcCs |j|�S)N)r�)r�r�rwrwrx�pbkdf2_hmac_supported�szBackend.pbkdf2_hmac_supportedc Csh|jjd|�}|j|�}|jj|�}|jj|t|�|t|�||||�} |j| dk�|jj|�dd�S)Nzunsigned char[]rz) r|r�r��from_bufferr~ZPKCS5_PBKDF2_HMACr�r��buffer) r�r��length�saltZ iterations�key_materialr�r��key_material_ptrr�rwrwrx�derive_pbkdf2_hmac�s zBackend.derive_pbkdf2_hmaccCstj|j�S)N)rP�_consume_errorsr~)r�rwrwrxr�szBackend._consume_errorscCstj|j�S)N)rP�_consume_errors_with_textr~)r�rwrwrxr�sz!Backend._consume_errors_with_textcCs�||jjkst�tjs~|jj|�}|jjd|�}|jj||�}|j |dk�t j|jj|�d|�d�}|jj |�rz|}|S|jj|�}|j ||jjk�|jj|�}|jj|�t |d�SdS)Nzunsigned char[]r�big�)r|r�AssertionError�six�PY2r~ZBN_num_bytesr�Z BN_bn2binr��int� from_bytesr�ZBN_is_negativeZ BN_bn2hexr��OPENSSL_free)r��bnZbn_num_bytesZbin_ptrZbin_len�valZ hex_cdataZhex_strrwrwrx� _bn_to_intszBackend._bn_to_intcCs�|dks||jjkst�|dkr(|jj}tjst|jt|j�dd�d�}|jj |t |�|�}|j||jjk�|St|�j d�dd�jd�}|jjd�}||d <|jj||�}|j|d k�|j|d |jjk�|d SdS) a Converts a python integer to a BIGNUM. The returned BIGNUM will not be garbage collected (to support adding them to structs that take ownership of the object). Be sure to register it for GC if it will be discarded after use. Ng @rzr��L�r�z BIGNUM **r)r|rr�r�r��to_bytesr�� bit_lengthr~Z BN_bin2bnr�r��hex�rstripr�r�Z BN_hex2bn)r��numr�ZbinaryZbn_ptrZhex_numr�rwrwrx� _int_to_bnszBackend._int_to_bncCs�tj||�|jj�}|j||jjk�|jj||jj�}|j |�}|jj||jj �}|jj||||jj�}|j|dk�|j|�}t |||�S)Nrz)rWZ_verify_rsa_parametersr~�RSA_newr�r|r�gc�RSA_freer��BN_freeZRSA_generate_key_ex�_rsa_cdata_to_evp_pkeyrF)r��public_exponent�key_size� rsa_cdatar�r��evp_pkeyrwrwrx�generate_rsa_private_key=s z Backend.generate_rsa_private_keycCs|dko|d@dko|dkS)N�rzrirw)r�r�r�rwrwrx�!generate_rsa_parameters_supportedOsz)Backend.generate_rsa_parameters_supportedc Cs2tj|j|j|j|j|j|j|jj |jj �|jj�}|j ||jjk�|jj||jj�}|j|j�}|j|j�}|j|j�}|j|j�}|j|j�}|j|j�}|j|jj �} |j|jj �} |jj|||�}|j |dk�|jj|| | |�}|j |dk�|jj||||�}|j |dk�|j|�}t|||�S)Nrz)rWZ_check_private_key_components�p�q�d�dmp1�dmq1�iqmp�public_numbersr��nr~r�r�r|rr�r�r�ZRSA_set0_factors�RSA_set0_keyZRSA_set0_crt_paramsr�rF) r��numbersr�r�r�r�r�r�r�r�r�r�r�rwrwrx�load_rsa_private_numbersVs8 z Backend.load_rsa_private_numberscCs�tj|j|j�|jj�}|j||jjk�|jj ||jj �}|j|j�}|j|j�}|jj||||jj�}|j|dk�|j |�}t|||�S)Nrz)rWZ_check_public_key_componentsr�r�r~r�r�r|rr�r�r�r�r�rG)r�rr�r�r�r�r�rwrwrx�load_rsa_public_numbersvs zBackend.load_rsa_public_numberscCs2|jj�}|j||jjk�|jj||jj�}|S)N)r~ZEVP_PKEY_newr�r|rr�� EVP_PKEY_free)r�r�rwrwrx�_create_evp_pkey_gc�s zBackend._create_evp_pkey_gccCs(|j�}|jj||�}|j|dk�|S)Nrz)rr~ZEVP_PKEY_set1_RSAr�)r�r�r�r�rwrwrxr��szBackend._rsa_cdata_to_evp_pkeycCsH|jj|�}|jj|t|��}|j||jjk�t|jj||jj �|�S)z� Return a _MemoryBIO namedtuple of (BIO, char*). The char* is the storage for the BIO and it must stay alive until the BIO is finished with. ) r|r�r~ZBIO_new_mem_bufr�r�rrqr��BIO_free)r��data�data_ptrrrrwrwrx� _bytes_to_bio�szBackend._bytes_to_biocCsP|jj�}|j||jjk�|jj|�}|j||jjk�|jj||jj�}|S)z. Creates an empty memory BIO. )r~Z BIO_s_memr�r|rZBIO_newr�r)r�Z bio_methodrrrwrwrx�_create_mem_bio_gc�s zBackend._create_mem_bio_gccCs\|jjd�}|jj||�}|j|dk�|j|d|jjk�|jj|d|�dd�}|S)zE Reads a memory BIO. This only works on memory BIOs. zchar **rN)r|r�r~ZBIO_get_mem_datar�rr�)r�rrr�Zbuf_len�bio_datarwrwrx� _read_mem_bio�szBackend._read_mem_biocCs�|jj|�}||jjkrT|jj|�}|j||jjk�|jj||jj�}t |||�S||jj kr�|jj|�}|j||jjk�|jj||jj�}t |||�S||jjkr�|jj|�}|j||jjk�|jj||jj�}t|||�S||jk�r,|jj|�}|j||jjk�|jj||jj�}t|||�S|t|jdd�k�rJt||�S|t|jdd�k�rht||�S|t|jdd�k�r�t||�S|t|jdd�k�r�t||�Std��dS)zd Return the appropriate type of PrivateKey given an evp_pkey cdata pointer. �EVP_PKEY_ED25519N� EVP_PKEY_X448�EVP_PKEY_X25519�EVP_PKEY_ED448zUnsupported key type.)r~�EVP_PKEY_id�EVP_PKEY_RSA�EVP_PKEY_get1_RSAr�r|rr�r�rF�EVP_PKEY_DSA�EVP_PKEY_get1_DSA�DSA_freer.�EVP_PKEY_EC�EVP_PKEY_get1_EC_KEY�EC_KEY_freer0r��EVP_PKEY_get1_DH�DH_freer*r�r2rJrHr5r )r�r��key_typer�� dsa_cdata�ec_cdata�dh_cdatarwrwrx�_evp_pkey_to_private_key�s< z Backend._evp_pkey_to_private_keycCs�|jj|�}||jjkrT|jj|�}|j||jjk�|jj||jj�}t |||�S||jj kr�|jj|�}|j||jjk�|jj||jj�}t |||�S||jjkr�|jj|�}|j||jjk�|jj||jj�}t|||�S||jk�r,|jj|�}|j||jjk�|jj||jj�}t|||�S|t|jdd�k�rJt||�S|t|jdd�k�rht||�S|t|jdd�k�r�t||�S|t|jdd�k�r�t||�Std��dS)zc Return the appropriate type of PublicKey given an evp_pkey cdata pointer. rNr rrzUnsupported key type.)r~rrrr�r|rr�r�rGrrrr/rrrr1r�rrr+r�r3rKrIr6r )r�r�rr�rrrrwrwrx�_evp_pkey_to_public_key�s< zBackend._evp_pkey_to_public_keycCs6|jjr&t|tjtjtjtjtjf�St|tj�SdS)N) r~ZCryptography_HAS_RSA_OAEP_MDr�rQ�SHA1�SHA224�SHA256�SHA384�SHA512)r�r�rwrwrx�_oaep_hash_supporteds zBackend._oaep_hash_supportedcCs�t|t�rdSt|t�r2t|jt�r2|j|jj�St|t�r�t|jt�r�|j|jj�o�|j|j�o�|j dkp�t |j �dkp�|jjdkSdSdS)NTrrzF) r�rZr[Z_mgfrXr�� _algorithmrYr&Z_labelr�r~ZCryptography_HAS_RSA_OAEP_LABEL)r�Zpaddingrwrwrx�rsa_padding_supporteds zBackend.rsa_padding_supportedcCs~|dkrtd��|jj�}|j||jjk�|jj||jj�}|jj|||jjd|jj|jj|jj�}|j|dk�t ||�S) N��z0Key size must be 1024, 2048, 3072, or 4096 bits.rrz)r)r*r+r,) r�r~�DSA_newr�r|rr�rZDSA_generate_parameters_exr-)r�r��ctxr�rwrwrx�generate_dsa_parameters(s zBackend.generate_dsa_parameterscCsT|jj|j�}|j||jjk�|jj||jj�}|jj|�|j |�}t |||�S)N)r~Z DSAparams_dupZ _dsa_cdatar�r|rr�rZDSA_generate_key�_dsa_cdata_to_evp_pkeyr.)r�� parametersr.r�rwrwrx�generate_dsa_private_key@s z Backend.generate_dsa_private_keycCs|j|�}|j|�S)N)r/r2)r�r�r1rwrwrx�'generate_dsa_private_key_and_parametersIs z/Backend.generate_dsa_private_key_and_parameterscCsB|jj||||�}|j|dk�|jj|||�}|j|dk�dS)Nrz)r~�DSA_set0_pqgr�ZDSA_set0_key)r�rr�r��g�pub_key�priv_keyr�rwrwrx�_dsa_cdata_set_valuesMszBackend._dsa_cdata_set_valuesc Cs�tj|�|jj}|jj�}|j||jjk�|jj ||jj �}|j|j�}|j|j �}|j|j�}|j|jj�}|j|j�}|j||||||�|j|�} t||| �S)N)rSZ_check_dsa_private_numbersr��parameter_numbersr~r-r�r|rr�rr�r�r�r5�y�xr8r0r.) r�rr9rr�r�r5r6r7r�rwrwrx�load_dsa_private_numbersSs z Backend.load_dsa_private_numbersc Cs�tj|j�|jj�}|j||jjk�|jj||jj �}|j |jj�}|j |jj�}|j |jj �}|j |j�}|jj}|j||||||�|j|�}t|||�S)N)rS�_check_dsa_parametersr9r~r-r�r|rr�rr�r�r�r5r:r8r0r/) r�rrr�r�r5r6r7r�rwrwrx�load_dsa_public_numbersfs zBackend.load_dsa_public_numberscCs�tj|�|jj�}|j||jjk�|jj||jj�}|j |j �}|j |j�}|j |j�}|jj ||||�}|j|dk�t||�S)Nrz)rSr=r~r-r�r|rr�rr�r�r�r5r4r-)r�rrr�r�r5r�rwrwrx�load_dsa_parameter_numbersws z"Backend.load_dsa_parameter_numberscCs(|j�}|jj||�}|j|dk�|S)Nrz)rr~ZEVP_PKEY_set1_DSAr�)r�rr�r�rwrwrxr0�szBackend._dsa_cdata_to_evp_pkeycCs |j|�S)N)r�)r�r�rwrwrx�dsa_hash_supported�szBackend.dsa_hash_supportedcCsdS)NTrw)r�r�r�r5rwrwrx�dsa_parameters_supported�sz Backend.dsa_parameters_supportedcCs|j|td|j��S)N�)r�reZ block_size)r�r�rwrwrx�cmac_algorithm_supported�sz Backend.cmac_algorithm_supportedcCs t||�S)N)r)r�r�rwrwrx�create_cmac_ctx�szBackend.create_cmac_ctxcCs�t|tjtjf�r$|dk r|td��nXt|tjtj t jf�sDtd��n8t|t j�sZtd��n"t|t j�r|t|tj�r|td��dS)Nz8algorithm must be None when signing via ed25519 or ed448z;Key must be an rsa, dsa, ec, ed25519, or ed448 private key.z.Algorithm must be a registered hash algorithm.z2MD5 hash algorithm is only supported with RSA keys)r�rU�Ed25519PrivateKeyrV�Ed448PrivateKeyr�rWZ RSAPrivateKeyrSZ DSAPrivateKeyrTZEllipticCurvePrivateKey� TypeErrorrQZ HashAlgorithmZMD5)r��private_keyr�rwrwrx�_x509_check_signature_params�s z$Backend._x509_check_signature_paramsc s�t|tj�std��j||��j||�}�jj�}�j|�j j k��j j|�jj�}�jj |tjjj�}�j|dk��jj|t�|j��}�j|dk�|j�}�jj||j�}�j|dk��jj�}�j|�j j k��j j|�fdd��}�j|j�j|�jjdd��jj||�}�j|dk�xN|jD]D\} } t�| j�}�jj ||tj!j"j#j| t$| ��}�j|dk��q8W�jj%||j|�}|dk�r��j&�}t'd|��t(�|�S) NzBuilder type mismatch.rzcs�jj|�jj�jjd��S)N�X509_EXTENSION_free)r~Zsk_X509_EXTENSION_pop_freer|� addressof� _original_lib)r;)r�rwrxr��sz)Backend.create_x509_csr..F)� extensionsr��x509_obj�add_funcr�rzSigning failed))r�rZ CertificateSigningRequestBuilderrGrI�_evp_md_x509_null_if_eddsar~ZX509_REQ_newr�r|rr�� X509_REQ_freeZX509_REQ_set_versionZVersionZv1�valueZX509_REQ_set_subject_namer>� _subject_name� public_keyZX509_REQ_set_pubkey� _evp_pkeyZsk_X509_EXTENSION_new_null�_create_x509_extensions�_extensionsr�Zsk_X509_EXTENSION_insertZX509_REQ_add_extensions�_attributesr?� dotted_stringZX509_REQ_add1_attr_by_OBJr�Z _ASN1TypeZ UTF8Stringr�Z X509_REQ_signr�r�rN) r��builderrHr�r��x509_reqr�rTZsk_extensionZattr_oidZattr_val�objr�rw)r�rx�create_x509_csr�sT zBackend.create_x509_csrc Csxt|tj�std��|j||�|j||�}|jj�}|jj ||jj �}|jj||jj �}|j|dk�|jj|t||j��}|j|dk�|jj||jj�}|j|dk�t||j�}|jj||�}|j|dk�|j|jj|�|j�|j|jj|�|j�|j|j|j||jj dd�|jj!|t||j"��}|j|dk�|jj#||j|�}|dk�rn|j$�}t%d|��t&||�S)NzBuilder type mismatch.rzT)rMr�rNrOr�rzSigning failed)'r�rZCertificateBuilderrGrIrPr~ZX509_newr|r�� X509_freeZX509_set_versionZ_versionrRr�ZX509_set_subject_namer>rSZX509_set_pubkeyZ_public_keyrUr<�_serial_numberZX509_set_serialNumber�_set_asn1_timeZX509_getm_notBeforeZ_not_valid_beforeZX509_getm_notAfterZ_not_valid_afterrVrWr�ZX509_add_extZX509_set_issuer_name�_issuer_nameZ X509_signr�r�rL) r�rZrHr�r�Z x509_certr�� serial_numberr�rwrwrx�create_x509_certificate�sF zBackend.create_x509_certificatecCs(t|tjtjf�r|jjS|j|�SdS)N)r�rUrErVrFr|rr�)r�rHr�rwrwrxrP;sz"Backend._evp_md_x509_null_if_eddsacCsL|jdkr|jd�jd�}n|jd�jd�}|jj||�}|j|dk�dS)Niz %Y%m%d%H%M%SZr�z %y%m%d%H%M%SZrz)ZyearZstrftimer�r~ZASN1_TIME_set_stringr�)r�� asn1_time�timeZasn1_strr�rwrwrxr`Ds zBackend._set_asn1_timecCs>|jj�}|j||jjk�|jj||jj�}|j||�|S)N)r~Z ASN1_TIME_newr�r|rr�ZASN1_TIME_freer`)r�rerdrwrwrx�_create_asn1_timeLs zBackend._create_asn1_timecCsxt|tj�std��|j||�|j||�}|jj�}|jj ||jj �}|jj|d�}|j|dk�|jj |t||j��}|j|dk�|j|j�}|jj||�}|j|dk�|j|j�}|jj||�}|j|dk�|j|j|j||jjdd�xJ|jD]@} |jj| j�} |j| |jjk�|jj|| �}|j|dk�q�W|jj||j|�}|dk�rn|j �}t!d|��t"||�S)NzBuilder type mismatch.rzT)rMr�rNrOr�rzSigning failed)#r�rZ CertificateRevocationListBuilderrGrIrPr~ZX509_CRL_newr|r�� X509_CRL_freeZX509_CRL_set_versionr�ZX509_CRL_set_issuer_namer>rarfZ_last_updateZX509_CRL_set_lastUpdate�_next_updateZX509_CRL_set_nextUpdaterVrWr�ZX509_CRL_add_extZ_revoked_certificatesZX509_REVOKED_dupZ _x509_revokedrZX509_CRL_add0_revokedZ X509_CRL_signrUr�r�rM)r�rZrHr�r��x509_crlr�Zlast_update�next_updateZrevoked_certZrevokedr�rwrwrx�create_x509_crlSsB zBackend.create_x509_crlc Cshxbt|�D]V\}}|j||�}|j||jjk�|rF|jj||jj�}||||�} |j| dk�q WdS)Nrz)� enumerate�_create_x509_extensionr�r|rr�r~rJ) r�rMr�rNrOr��i� extensionZx509_extensionr�rwrwrxrV�szBackend._create_x509_extensionscCs.t||jj�}|jj|jj||jr&dnd|�S)Nrzr)r?�oidrYr~ZX509_EXTENSION_create_by_OBJr|r�critical)r�rorRr\rwrwrx�_create_raw_x509_extension�sz"Backend._create_raw_x509_extensioncCst|jtj�r(t||jj�}|j||�St|jtj�rfttfdd�|jD��}t||�}|j||�St|jtj �r�t|tt ��}|j||�Sy||j}Wn$tk r�t dj|j��YnX|||j�}|jj|jjjd��}|j||jjk�|jj||j�r dnd|�SdS)NcSsg|]}ttt|j��qSrw)rrrrR)�.0r;rwrwrx� �sz2Backend._create_x509_extension..zExtension not supported: {}r�rzr)r�rRrZUnrecognizedExtensionr=rrZ TLSFeaturerr Z PrecertPoisonrrpr��NotImplementedErrorr�r~ZOBJ_txt2nidrYr�r�� NID_undefZX509V3_EXT_i2drq)r�r�rorRZasn1r�Z ext_struct�nidrwrwrxrm�s0 zBackend._create_x509_extensioncCs�t|tj�std��|jj�}|j||jjk�|jj ||jj �}t||j�}|jj ||�}|j|dk�|j|j�}|jj||�}|j|dk�|j|j|j||jjdd�t|d|�S)NzBuilder type mismatch.rzT)rMr�rNrOr�)r�rZRevokedCertificateBuilderrGr~ZX509_REVOKED_newr�r|rr�ZX509_REVOKED_freer<r_ZX509_REVOKED_set_serialNumberrfZ_revocation_dateZX509_REVOKED_set_revocationDaterVrWr�ZX509_REVOKED_add_extrO)r�rZZx509_revokedrbr�Zrev_daterwrwrx�create_x509_revoked_certificate�s& z'Backend.create_x509_revoked_certificatecCs|j|jj|j||�S)N)� _load_keyr~ZPEM_read_bio_PrivateKeyr)r�r�passwordrwrwrx�load_pem_private_key�s zBackend.load_pem_private_keycCs�|j|�}|jj|j|jj|jj|jj�}||jjkrR|jj||jj�}|j|�S|j �|jj |j�}|j|dk�|jj|j|jj|jj|jj�}||jjkr�|jj||jj �}|j|�}t|||�S|j�dS)Nrz)rr~ZPEM_read_bio_PUBKEYrrr|rr�rr r�� BIO_resetr�ZPEM_read_bio_RSAPublicKeyr�r�rG�_handle_key_loading_error)r�r�mem_bior�r�r�rwrwrx�load_pem_public_key�s zBackend.load_pem_public_keycCs^|j|�}|jj|j|jj|jj|jj�}||jjkrR|jj||jj�}t||�S|j �dS)N) rr~ZPEM_read_bio_DHparamsrrr|rr�rr)r})r�rr~rrwrwrx�load_pem_parameters�s zBackend.load_pem_parameterscCs>|j|�}|j||�}|r$|j|�S|j|jj|j||�SdS)N)r�"_evp_pkey_from_der_traditional_keyrryr~Zd2i_PKCS8PrivateKey_bio)r�rrzr r�rwrwrx�load_der_private_keys zBackend.load_der_private_keycCsV|jj|j|jj�}||jjkrF|jj||jj�}|dk rBtd��|S|j�dSdS)Nz4Password was given but private key is not encrypted.) r~�d2i_PrivateKey_biorrr|rr�rrGr�)r�r rzr�rwrwrxr�sz*Backend._evp_pkey_from_der_traditional_keycCs�|j|�}|jj|j|jj�}||jjkrF|jj||jj�}|j|�S|j �|jj |j�}|j|dk�|jj|j|jj�}||jjkr�|jj||jj �}|j|�}t|||�S|j�dS)Nrz)rr~Zd2i_PUBKEY_biorrr|rr�rr r�r|r�Zd2i_RSAPublicKey_bior�r�rGr})r�rr~r�r�r�rwrwrx�load_der_public_key(s zBackend.load_der_public_keycCs�|j|�}|jj|j|jj�}||jjkrF|jj||jj�}t||�S|jj r�|j �|jj|j�}|j|dk�|jj |j|jj�}||jjkr�|jj||jj�}t||�S|j�dS)Nrz)rr~Zd2i_DHparams_biorrr|rr�rr)r�r�r|r�ZCryptography_d2i_DHxparams_bior})r�rr~rr�rwrwrx�load_der_parameters?s zBackend.load_der_parameterscCsb|j|�}|jj|j|jj|jj|jj�}||jjkrF|j�td��|jj||jj �}t ||�S)NzwUnable to load certificate. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)rr~ZPEM_read_bio_X509rrr|rr�r�r�r^rL)r�rr~rrwrwrx�load_pem_x509_certificateSs z!Backend.load_pem_x509_certificatecCsV|j|�}|jj|j|jj�}||jjkr:|j�td��|jj||jj �}t ||�S)NzUnable to load certificate)rr~Zd2i_X509_biorrr|rr�r�r�r^rL)r�rr~rrwrwrx�load_der_x509_certificatebs z!Backend.load_der_x509_certificatecCsb|j|�}|jj|j|jj|jj|jj�}||jjkrF|j�td��|jj||jj �}t ||�S)NzoUnable to load CRL. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)rr~ZPEM_read_bio_X509_CRLrrr|rr�r�r�rgrM)r�rr~rirwrwrx�load_pem_x509_crlls zBackend.load_pem_x509_crlcCsV|j|�}|jj|j|jj�}||jjkr:|j�td��|jj||jj �}t ||�S)NzUnable to load CRL)rr~Zd2i_X509_CRL_biorrr|rr�r�r�rgrM)r�rr~rirwrwrx�load_der_x509_crl{s zBackend.load_der_x509_crlcCsb|j|�}|jj|j|jj|jj|jj�}||jjkrF|j�td��|jj||jj �}t ||�S)NzsUnable to load request. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)rr~ZPEM_read_bio_X509_REQrrr|rr�r�r�rQrN)r�rr~r[rwrwrx�load_pem_x509_csr�s zBackend.load_pem_x509_csrcCsV|j|�}|jj|j|jj�}||jjkr:|j�td��|jj||jj �}t ||�S)NzUnable to load request)rr~Zd2i_X509_REQ_biorrr|rr�r�r�rQrN)r�rr~r[rwrwrx�load_der_x509_csr�s zBackend.load_der_x509_csrc Cs*|j|�}|jjd�}|dk rFtjd|�|jj|�}||_t|�|_||j |jj |jj|jj d�|�}||jj kr�|jdkr�|j�} |j| �|jd kr�td��q�|jdks�t�tdj|jd��n|j�|jj||jj�}|dk o�|jdk�r�td ��|dk �r|jdk�s"|dk�s"t�||�S)NzCRYPTOGRAPHY_PASSWORD_DATA *rzZCryptography_pem_password_cbrrzz3Password was not given but private key is encryptedr�zAPasswords longer than {} bytes are not supported by this backend.z4Password was given but private key is not encrypted.��)rr|r�r�_check_bytesliker�rzr�r�rrrrKr~rL�errorr�r�rGr�r�r��maxsizer}r�rZcalled) r�Zopenssl_read_funcZconvert_funcrrzr~ZuserdataZpassword_ptrr�r�rwrwrxry�s@ zBackend._load_keycs��j�}|std��n�|dj�jj�jj�sF|dj�jj�jj�rPtd��n�|dj�jj�jj�s�|dj�jj �jj �r�tdtj ��nLt�fdd�|D��r�td��n,|dj�jj�jj �jjfks�t�td��dS)NzCould not deserialize key data.rz Bad decrypt. Incorrect password?z0PEM data is encrypted with an unsupported cipherc3s"|]}|j�jj�jj�VqdS)N)�_lib_reason_matchr~�ERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)rsr�)r�rwrx� �sz4Backend._handle_key_loading_error..z!Unsupported public key algorithm.)r�r�r�r~r�ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZEVP_R_UNKNOWN_PBE_ALGORITHMZERR_LIB_PEMZPEM_R_UNSUPPORTED_ENCRYPTIONr r ZUNSUPPORTED_CIPHER�anyr}ZERR_LIB_ASN1r�)r�r�rw)r�rxr}�s2 z!Backend._handle_key_loading_errorcCsvy|j|�}Wntk r*|jj}YnX|jj|�}||jjkrP|j�dS|j||jjk�|jj |�dSdS)NFT) �_elliptic_curve_to_nidr r~rvZEC_GROUP_new_by_curve_namer|rr�r�Z EC_GROUP_free)r��curve� curve_nid�grouprwrwrx�elliptic_curve_supported�sz Backend.elliptic_curve_supportedcCst|tj�sdS|j|�S)NF)r�rTZECDSAr�)r�Zsignature_algorithmr�rwrwrx�,elliptic_curve_signature_algorithm_supportedsz4Backend.elliptic_curve_signature_algorithm_supportedcCs\|j|�rD|j|�}|jj|�}|j|dk�|j|�}t|||�Stdj|j �t j��dS)z@ Generate a new private key on the named curve. rzz#Backend object does not support {}.N)r��_ec_key_new_by_curver~ZEC_KEY_generate_keyr��_ec_cdata_to_evp_pkeyr0r r�r�r �UNSUPPORTED_ELLIPTIC_CURVE)r�r�rr�r�rwrwrx�#generate_elliptic_curve_private_keys z+Backend.generate_elliptic_curve_private_keycCsp|j}|j|j�}|jj|j|j�|jj�}|jj ||�}|j |dk�|j||j|j �}|j|�}t|||�S)Nrz)r�r�r�r|r�r�� private_valuer~� BN_clear_free�EC_KEY_set_private_keyr��)_ec_key_set_public_key_affine_coordinatesr;r:r�r0)r�rZpublicrr�r�r�rwrwrx�#load_elliptic_curve_private_numbers%s z+Backend.load_elliptic_curve_private_numberscCs4|j|j�}|j||j|j�}|j|�}t|||�S)N)r�r�r�r;r:r�r1)r�rrr�rwrwrx�"load_elliptic_curve_public_numbers8s z*Backend.load_elliptic_curve_public_numbersc Cs�|j|�}|jj|�}|j||jjk�|jj|�}|j||jjk�|jj||jj�}|j ��6}|jj |||t|�|�}|dkr�|j�t d��WdQRX|jj||�}|j|dk�|j|�}t|||�S)Nrzz(Invalid public bytes for the given curve)r�r~�EC_KEY_get0_groupr�r|r�EC_POINT_newr�� EC_POINT_free�_tmp_bn_ctxZEC_POINT_oct2pointr�r�r��EC_KEY_set_public_keyr�r1) r�r�Zpoint_bytesrr��point�bn_ctxr�r�rwrwrx� load_elliptic_curve_public_bytesAs z(Backend.load_elliptic_curve_public_bytescCsD|j|�}|j|�\}}|jj|�}|j||jjk�|jj||jj�}|j |�}|jj||jj �}|j��h}|jj||||jj|jj|�} |j| dk�|jj |�} |jj |�}|||| ||�} |j| dk�WdQRX|jj||�} |j| dk�|j |�}|jj||jj �}|jj||�} |j| dk�|j|�} t||| �S)Nrz)r�� _ec_key_determine_group_get_funcr~r�r�r|rr�r�r�r�r�ZEC_POINT_mulZ BN_CTX_getr�r�r�r0)r�r�r�r�get_funcr�r�rRr�r�Zbn_xZbn_yZprivater�rwrwrx�!derive_elliptic_curve_private_keyUs. z)Backend.derive_elliptic_curve_private_keycCs|j|�}|j|�S)N)r��_ec_key_new_by_curve_nid)r�r�r�rwrwrxr�xs zBackend._ec_key_new_by_curvecCsB|jj|�}|j||jjk�|jj|tjj�|jj||jj �S)N) r~ZEC_KEY_new_by_curve_namer�r|rZEC_KEY_set_asn1_flag�backendZOPENSSL_EC_NAMED_CURVEr�r)r�r�rrwrwrxr�|s z Backend._ec_key_new_by_curve_nidcCsV|j|�}|jj|j|jj�}||jjkr:|j�td��|jj||jj �}t ||�S)NzUnable to load OCSP request)rr~Zd2i_OCSP_REQUEST_biorrr|rr�r�r��OCSP_REQUEST_freerB)r�rr~Zrequestrwrwrx�load_der_ocsp_request�s zBackend.load_der_ocsp_requestcCsV|j|�}|jj|j|jj�}||jjkr:|j�td��|jj||jj �}t ||�S)NzUnable to load OCSP response)rr~Zd2i_OCSP_RESPONSE_biorrr|rr�r�r��OCSP_RESPONSE_freerC)r�rr~Zresponserwrwrx�load_der_ocsp_response�s zBackend.load_der_ocsp_responsec Cs�|jj�}|j||jjk�|jj||jj�}|j\}}}|j|�}|jj ||j |j �}|j||jjk�|jj||�}|j||jjk�|j|j |j||jjdd�t||�S)NT)rMr�rNrOr�)r~ZOCSP_REQUEST_newr�r|rr�r�Z_requestr��OCSP_cert_to_id�_x509ZOCSP_request_add0_idrVrWr�ZOCSP_REQUEST_add_extrB) r�rZZocsp_req�certZissuerr�r��certidZonereqrwrwrx�create_ocsp_request�s zBackend.create_ocsp_requestcCs�|j||�|jj�}|j||jjk�|jj||jj�}|j|j j �}|jj||j jj |j jj �}|j||jjk�|jj||jj�}|j jdkr�d}nt|j j}|j jdkr�|jj}n|j|j j�}|jj} |j jdk r�|j|j j�} |j|j j�} |jj|||j jj||| | �}|j||jjk�|j||�}|j\}} |jj}| tjjk�rb||jjO}|j dk �r�x.|j D]$}|jj!||j �}|j|dk��qvW|j"|j#|j$||jj%dd�|jj&||j |j'||jj|�}|dk�r�|j(�}t)d|��|S)NrzT)rMr�rNrOr�zAError while signing. responder_cert must be signed by private_keyr�)*rIr~ZOCSP_BASICRESP_newr�r|rr�ZOCSP_BASICRESP_freer�Z _responser'r�Z_certr�Z_issuerZOCSP_CERTID_freeZ_revocation_reasonr Z_revocation_timerfrhZ_this_updateZOCSP_basic_add1_statusZ_cert_statusrRrPZ _responder_idZOCSP_NOCERTSrpZOCSPResponderEncodingZHASHZOCSP_RESPID_KEYZ_certsZOCSP_basic_add1_certrVrWr�ZOCSP_BASICRESP_add_extZOCSP_basic_signrUr�r�)r�rZrHr��basicr�r��reasonZrev_timerjZthis_updater�Zresponder_certZresponder_encoding�flagsr�r�rwrwrx�_create_ocsp_basic_response�s| z#Backend._create_ocsp_basic_responsecCsb|tjjkr|j|||�}n|jj}|jj|j|�}|j ||jjk�|jj ||jj�}t||�S)N) rpZOCSPResponseStatusZ SUCCESSFULr�r|rr~ZOCSP_response_createrRr�r�r�rC)r�Zresponse_statusrZrHr�r�Z ocsp_resprwrwrx�create_ocsp_responses zBackend.create_ocsp_responsecCs|j|�ot|tj�S)N)r�r�rTZECDH)r�r�r�rwrwrx�+elliptic_curve_exchange_algorithm_supportedsz3Backend.elliptic_curve_exchange_algorithm_supportedcCs(|j�}|jj||�}|j|dk�|S)Nrz)rr~ZEVP_PKEY_set1_EC_KEYr�)r�rr�r�rwrwrxr�szBackend._ec_cdata_to_evp_pkeycCsNddd�}|j|j|j�}|jj|j��}||jjkrJtdj|j�tj ��|S)z/ Get the NID for a curve name. Z prime192v1Z prime256v1)Z secp192r1Z secp256r1z${} is not a supported elliptic curve) �getr�r~� OBJ_sn2nidr�rvr r�r r�)r�r�Z curve_aliasesZ curve_namer�rwrwrxr�!s zBackend._elliptic_curve_to_nidccsX|jj�}|j||jjk�|jj||jj�}|jj|�z |VWd|jj|�XdS)N) r~Z BN_CTX_newr�r|rr�ZBN_CTX_freeZBN_CTX_startZ BN_CTX_end)r�r�rwrwrxr�2s zBackend._tmp_bn_ctxcCs�|j||jjk�|jjd�}|j||jjk�|jj|�}|j||jjk�|jj|�}|j||jjk�|jj|�}|j||jjk�||kr�|jj r�|jj }n|jj}|s�t�||fS)zu Given an EC_KEY determine the group and what function is required to get point coordinates. scharacteristic-two-field) r�r|rr~r�rvr�ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFpr�)r�r.Z nid_two_fieldr��methodrwr�rwrwrxr�=s z(Backend._ec_key_determine_group_get_funccCst|dks|dkrtd��|jj|j|�|jj�}|jj|j|�|jj�}|jj|||�}|dkrp|j�td��|S)zg Sets the public key point in the EC_KEY context to the affine x and y values. rz2Invalid EC key. Both x and y must be non-negative.rzzInvalid EC key.)r�r|r�r�r~r�Z(EC_KEY_set_public_key_affine_coordinatesr�)r�r.r;r:r�rwrwrxr�Ysz1Backend._ec_key_set_public_key_affine_coordinatesc Cs*t|tj�std��t|tj�s(td��t|tj�s.) r>r|r�r~Z i2d_X509_NAMEr�rr�r�)r�r�Z x509_nameZppr�rw)r�rx�x509_name_bytes�s zBackend.x509_name_bytescCsht|�dkrtd��|j�}|jj||jj�}|j|dk�|jj||t|��}|j|dk�t||�S)N� z%An X25519 public key is 32 bytes longrz) r�r�rr~ZEVP_PKEY_set_type� NID_X25519r�ZEVP_PKEY_set1_tls_encodedpointrI)r�rr�r�rwrwrx�x25519_load_public_bytes�sz Backend.x25519_load_public_bytescCs�t|�dkrtd��d}|jd��<}||dd�<||dd�<|j|�}|jj|j|jj�}WdQRX|j ||jjk�|jj ||jj�}|j |jj|�|jj k�t||�S)Nr�z&An X25519 private key is 32 bytes longs0.0+en" �0rr�)r�r��_zeroed_bytearrayrr~r�rrr|rr�r�rrrrH)r�rZpkcs8_prefix�barrr�rwrwrx�x25519_load_private_bytes�s z!Backend.x25519_load_private_bytescCs�|jj||jj�}|j||jjk�|jj||jj�}|jj|�}|j|dk�|jjd�}|jj ||�}|j|dk�|j|d|jjk�|jj|d|jj �}|S)NrzzEVP_PKEY **r)r~ZEVP_PKEY_CTX_new_idr|rr�r�ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr�ZEVP_PKEY_keygenr)r�rwZevp_pkey_ctxr�Z evp_ppkeyr�rwrwrx�_evp_pkey_keygen_gc szBackend._evp_pkey_keygen_gccCs|j|jj�}t||�S)N)r�r~r�rH)r�r�rwrwrx�x25519_generate_key szBackend.x25519_generate_keycCs|jr dS|jjS)NF)r�r~Z#CRYPTOGRAPHY_OPENSSL_110_OR_GREATER)r�rwrwrx�x25519_supported szBackend.x25519_supportedcCs`t|�dkrtd��|jj|jj|jj|t|��}|j||jjk�|jj||jj �}t ||�S)N�8z#An X448 public key is 56 bytes long)r�r�r~�EVP_PKEY_new_raw_public_key�NID_X448r|rr�r�rrK)r�rr�rwrwrx�x448_load_public_bytes# szBackend.x448_load_public_bytescCslt|�dkrtd��|jj|�}|jj|jj|jj|t|��}|j||jjk�|jj ||jj �}t||�S)Nr�z$An X448 private key is 56 bytes long)r�r�r|r�r~�EVP_PKEY_new_raw_private_keyr�rr�r�rrJ)r�rrr�rwrwrx�x448_load_private_bytes. szBackend.x448_load_private_bytescCs|j|jj�}t||�S)N)r�r~r�rJ)r�r�rwrwrx�x448_generate_key: szBackend.x448_generate_keycCs|jr dS|jjS)NF)r�r~Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111)r�rwrwrx�x448_supported> szBackend.x448_supportedcCs|jr dS|jjS)NF)r�r~�#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111B)r�rwrwrx�ed25519_supportedC szBackend.ed25519_supportedcCsntjd|�t|�tjkr"td��|jj|jj|j j |t|��}|j||j j k�|j j||jj �}t||�S)Nrz&An Ed25519 public key is 32 bytes long)r�_check_bytesr�rU�_ED25519_KEY_SIZEr�r~r��NID_ED25519r|rr�r�rr3)r�rr�rwrwrx�ed25519_load_public_bytesH sz!Backend.ed25519_load_public_bytescCszt|�tjkrtd��tjd|�|jj|�}|jj |jj |jj|t|��}|j||jjk�|jj ||jj�}t||�S)Nz'An Ed25519 private key is 32 bytes longr)r�rUr�r�rr�r|r�r~r�r�rr�r�rr2)r�rrr�rwrwrx�ed25519_load_private_bytesV sz"Backend.ed25519_load_private_bytescCs|j|jj�}t||�S)N)r�r~r�r2)r�r�rwrwrx�ed25519_generate_keyd szBackend.ed25519_generate_keycCs|jr dS|jjS)NF)r�r~r�)r�rwrwrx�ed448_supportedh szBackend.ed448_supportedcCsltjd|�t|�tkr td��|jj|jj|jj |t|��}|j ||jj k�|jj||jj�}t ||�S)Nrz$An Ed448 public key is 57 bytes long)rr�r�r4r�r~r�� NID_ED448r|rr�r�rr6)r�rr�rwrwrx�ed448_load_public_bytesm szBackend.ed448_load_public_bytescCsxtjd|�t|�tkr td��|jj|�}|jj|jj |jj |t|��}|j||jj k�|jj||jj �}t||�S)Nrz%An Ed448 private key is 57 bytes long)rr�r�r4r�r|r�r~r�rrr�r�rr5)r�rrr�rwrwrx�ed448_load_private_bytesz sz Backend.ed448_load_private_bytescCs|j|jj�}t||�S)N)r�r~rr5)r�r�rwrwrx�ed448_generate_key� szBackend.ed448_generate_keycCs�|jjd|�}|jj|�}|jj|t|�|t|�|||tj||� } | dkrr|j�} d||d}t dj |�| ��|jj|�dd�S)Nzunsigned char[]rz�ir�zJNot enough memory to derive key. These parameters require {} MB of memory.i)r|r�r�r~ZEVP_PBE_scryptr�rmZ _MEM_LIMITr��MemoryErrorr�r�)r�r�r�r�r��rr�r�r�r�r�Z min_memoryrwrwrx� derive_scrypt� s*zBackend.derive_scryptcCs2tj|�}|jr||jkrdS|jj|�|jjkS)NF)rZ_aead_cipher_namer�� _fips_aeadr~r�r|r)r�r��cipher_namerwrwrx�aead_cipher_supported� s zBackend.aead_cipher_supportedccs&t|�}z |VWd|j||�XdS)z� This method creates a bytearray, which we copy data into (hopefully also from a mutable buffer that can be dynamically erased!), and then zero when we're done. N)� bytearray� _zero_data)r�r�r�rwrwrxr�� s zBackend._zeroed_bytearraycCsxt|�D]}d||<q WdS)Nr)r)r�rr�rnrwrwrxr� szBackend._zero_datac csf|dkr|jjVnNt|�}|jjd|d�}|jj|||�z |VWd|j|jjd|�|�XdS)a� This method takes bytes, which can be a bytestring or a mutable buffer like a bytearray, and yields a null-terminated version of that data. This is required because PKCS12_parse doesn't take a length with its password char * and ffi.from_buffer doesn't provide null termination. So, to support zeroing the data via bytearray we need to build this ridiculous construct that copies the memory, but zeroes it after use. Nzchar[]rzz uint8_t *)r|rr�r�Zmemmover�cast)r�rZdata_lenr�rwrwrx�_zeroed_null_terminated_buf� s z#Backend._zeroed_null_terminated_bufc Cs�|dk rtjd|�|j|�}|jj|j|jj�}||jjkrN|j�t d��|jj ||jj�}|jjd�}|jjd�}|jjd�}|j |��}|jj|||||�} WdQRX| dkr�|j�t d��d} d}g}|d|jjk�r|jj |d|jj�} |j| �}|d|jjk�r6|jj |d|jj�}t||�} |d|jjk�r�|jj |d|jj�}|jj|d�}xTt|�D]H}|jj||�}|j||jjk�|jj ||jj�}|jt||��qxW|| |fS)Nrzz!Could not deserialize PKCS12 datazEVP_PKEY **zX509 **zCryptography_STACK_OF_X509 **rzInvalid password or PKCS12 data)rr�rr~Zd2i_PKCS12_biorrr|rr�r�r��PKCS12_freer�rZPKCS12_parserrr^rL�sk_X509_free�sk_X509_numr� sk_X509_valuer�r�)r�rrzrr�p12Zevp_pkey_ptrZx509_ptrZsk_x509_ptr�password_bufr�r�r�Zadditional_certificatesr�r�sk_x509r�rnrwrwrx�%load_key_and_certificates_from_pkcs12� sF z-Backend.load_key_and_certificates_from_pkcs12cCs�d}|dk rtjd|�t|tj�r6d}d}d} d} n4t|tj�rb|jj}|jj}d} d} |j}nt d��|dks~t |�dkr�|jj}nL|jj �}|jj||jj�}x.t|�D]"}|jj||j�} tj| dk�q�W|j|��Z}|j|��D}|jj|||�r|jn|jj|�r|jn|jj|||| | d� }WdQRXWdQRX|j||jjk�|jj||jj�}|j�}|jj||�} |j| dk�|j|�S)Nr�rzri NzUnsupported key encryption typer�r�)rr�r�rRr�r�r~Z&NID_pbe_WithSHA1And3_Key_TripleDES_CBCrzr�r�r|r�sk_X509_new_nullr�r�reversed�sk_X509_pushr�r�r�rZ PKCS12_createrUrr Zi2d_PKCS12_bior)r�r�r�r�Zcasr�rzZnid_certZnid_keyZpkcs12_iterZmac_iterrZcar�rZname_bufrrrrwrwrx�(serialize_key_and_certificates_to_pkcs12 sT z0Backend.serialize_key_and_certificates_to_pkcs12cCs|jr dS|jjdkS)NFrz)r�r~ZCryptography_HAS_POLY1305)r�rwrwrx�poly1305_supportedF szBackend.poly1305_supportedcCs*tjd|�t|�tkr td��t||�S)Nr�zA poly1305 key is 32 bytes long)rr�r�rDr�rE)r�r�rwrwrx�create_poly1305_ctxK szBackend.create_poly1305_ctxcCsntjd|�|j|�}|jj|j|jj|jj|jj�}||jjkrR|j�t d��|jj ||jj�}|j|�S)NrzUnable to parse PKCS7 data) rr�rr~ZPEM_read_bio_PKCS7rrr|rr�r�r�� PKCS7_free�_load_pkcs7_certificates)r�rrr�p7rwrwrx�load_pem_pkcs7_certificatesR s z#Backend.load_pem_pkcs7_certificatescCsbtjd|�|j|�}|jj|j|jj�}||jjkrF|j�t d��|jj ||jj�}|j|�S)NrzUnable to parse PKCS7 data) rr�rr~Z d2i_PKCS7_biorrr|rr�r�r�rr )r�rrrr!rwrwrx�load_der_pkcs7_certificates_ s z#Backend.load_der_pkcs7_certificatesc Cs�|jj|j�}|j||jjk�||jjkr>tdj|�tj ��g}|j j|jj krV|S|j jj}|jj|�}xlt|�D]`}|jj||�}|j||jj k�|jj|�}|j|dk�|jj||jj�}|jt||��qvW|S)NzNOnly basic signed structures are currently supported. NID for this data was {}rz)r~ZOBJ_obj2nidr�r�rvZNID_pkcs7_signedr r�r ZUNSUPPORTED_SERIALIZATIONr�Zsignr|rr�rrrZX509_up_refr�r^r�rL) r�r!rw�certsrr�rnrr�rwrwrxr j s( z Backend._load_pkcs7_certificatescCs�|j|j�}|jj}d}t|j�dkr0|jj}nJ|jj�}|jj ||jj �}x,|jD]"}|jj||j�} |j | dk�qTWtjj|kr�||jjO}||jjO}|jj|jj|jj||jj|�} |j | |jjk�|jj | |jj�} d}tjj|k�r||jjO}ntjj|k�r||jjO}tjj|k�r6||jjO}xJ|jD]@\}} }|j|�}|jj| |j| j||�}|j ||jjk��q>WxD|D]<}|tjjk�r�||jjO}n|tjj k�r�||jj!O}�q�W|j"�}|t#j$j%k�r�|jj&|| |j'|�} n�|t#j$j(k�r8|jj)| |j'|�} |j | dk�|jj*|| |j'|�} n@|t#j$j+k�sJt,�|jj)| |j'|�} |j | dk�|jj-|| �} |j | dk�|j.|�S)Nrrz)/r�_datar~Z PKCS7_PARTIALr�Z_additional_certsr|rrr�rrr�r�rnZPKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDZ PKCS7_signrZNoCapabilitiesZPKCS7_NOSMIMECAPZNoAttributesZPKCS7_NOATTRZNoCertsZ PKCS7_NOCERTSZ_signersr�ZPKCS7_sign_add_signerrUZTextZ PKCS7_TEXTZBinaryZPKCS7_BINARYr rRr�ZSMIMEZSMIME_write_PKCS7rrr�ZPKCS7_finalZPEM_write_bio_PKCS7_streamr�r�Z i2d_PKCS7_bior)r�rZr�ZoptionsrrZ init_flagsZfinal_flagsr$r�r�r!Zsigner_flagsZcertificaterHZhash_algorithmZmdZp7signerinfoZoptionZbio_outrwrwrx� pkcs7_sign� sj zBackend.pkcs7_sign)N)N)N)�rtrurv�__doc__r�r r\rdr�rQr!r"r#r$r%Z SHA512_224Z SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r�Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusr�r�rr�� contextlibrr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rrrr�rr rrr r&r(r/r2r3r8r<r>r?r0r@rArCrDrIr]rcrPr`rfrkrVrrrmrxr{rr�r�r�r�r�r�r�r�r�r�r�ryr}r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rrrrrr rr�rrrrrrr"r#r r&rwrwrwrxry�sV -5 ++ HB 8" 1) # Ui0 ." .@ ryc@seZdZdd�Zdd�ZdS)r�cCs ||_dS)N)�_fmt)r�Zfmtrwrwrxr�� szGetCipherByName.__init__cCs&|jj||d�j�}|jj|jd��S)N)r�r�r�)r)r��lowerr~r�r�)r�r�r�r�rrwrwrx�__call__� szGetCipherByName.__call__N)rtrurvr�r+rwrwrwrxr�� sr�cCs"dj|jd�}|jj|jd��S)Nz aes-{}-xtsr�r�)r�r�r~r�r�)r�r�r�rrwrwrxr�� sr�)�Z __future__rrr�collectionsr(r�r�rr�Z six.movesrZcryptographyrrZcryptography.exceptionsr r Zcryptography.hazmat._derrrr rrZ'cryptography.hazmat.backends.interfacesrrrrrrrrrrrrrZ$cryptography.hazmat.backends.opensslrZ,cryptography.hazmat.backends.openssl.ciphersrZ)cryptography.hazmat.backends.openssl.cmacrZ0cryptography.hazmat.backends.openssl.decode_asn1r r!r"r#r$r%r&r'r(Z'cryptography.hazmat.backends.openssl.dhr)r*r+r,Z(cryptography.hazmat.backends.openssl.dsar-r.r/Z'cryptography.hazmat.backends.openssl.ecr0r1Z,cryptography.hazmat.backends.openssl.ed25519r2r3Z*cryptography.hazmat.backends.openssl.ed448r4r5r6Z0cryptography.hazmat.backends.openssl.encode_asn1r7r8r9r:r;r<r=r>r?Z+cryptography.hazmat.backends.openssl.hashesr@Z)cryptography.hazmat.backends.openssl.hmacrAZ)cryptography.hazmat.backends.openssl.ocsprBrCZ-cryptography.hazmat.backends.openssl.poly1305rDrEZ(cryptography.hazmat.backends.openssl.rsarFrGZ+cryptography.hazmat.backends.openssl.x25519rHrIZ)cryptography.hazmat.backends.openssl.x448rJrKZ)cryptography.hazmat.backends.openssl.x509rLrMrNrOZ$cryptography.hazmat.bindings.opensslrPZcryptography.hazmat.primitivesrQrRZ)cryptography.hazmat.primitives.asymmetricrSrTrUrVrWZ1cryptography.hazmat.primitives.asymmetric.paddingrXrYrZr[Z1cryptography.hazmat.primitives.ciphers.algorithmsr\r]r^r_r`rarbrcrdZ,cryptography.hazmat.primitives.ciphers.modesrerfrgrhrirjrkrlZ"cryptography.hazmat.primitives.kdfrmZ,cryptography.hazmat.primitives.serializationrnroZcryptography.x509rp� namedtuplerq�objectrsZregister_interfaceZregister_interface_ifr{r}ZCryptography_HAS_SCRYPTryr�r�r�rwrwrwrx�s�<,,,( 5