o h<@s2ddlmZmZmZddlZddlZddlZddlZddlZddlm Z ddl Z ddl Z ddl mZmZddlmZmZddlmZmZmZmZmZmZmZmZmZmZmZmZm Z ddl!m"Z"ddl#m$Z$dd l%m&Z&dd l'm(Z(m)Z)dd l*m+Z+m,Z,m-Z-m.Z.dd l/m0Z0m1Z1m2Z2dd l3m4Z4m5Z5ddl6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?ddl@mAZAddlBmCZCddlDmEZEmFZFddlGmHZHmIZIddlJmKZKmLZLddlMmNZNmOZOmPZPmQZQddlRmSZSddlTmUZUmVZVddlWmXZXmYZYmZZZddl[m\Z\m]Z]m^Z^m_Z_ddl`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZiddljmkZkmlZlmmZmmnZnmoZompZpmqZqmrZrddlsmtZtddlumvZvewdddgZxeyeeyeeyeeyeeyeeyeeyeeyeeyeeyeeyeeye ezeS{j|j}eGd d!d!e~ZGd"d#d#e~Zd$d%ZeZdS)&)absolute_importdivisionprint_functionN)contextmanager)utilsx509)UnsupportedAlgorithm_Reasons) CMACBackend CipherBackendDERSerializationBackend DHBackend DSABackendEllipticCurveBackend HMACBackend HashBackendPBKDF2HMACBackendPEMSerializationBackend RSABackend ScryptBackend X509Backend)aead)_CipherContext _CMACContext)_CRL_ENTRY_REASON_ENUM_TO_CODE _Integers) _DHParameters _DHPrivateKey _DHPublicKey_dh_params_dup)_DSAParameters_DSAPrivateKey _DSAPublicKey)_EllipticCurvePrivateKey_EllipticCurvePublicKey) $_CRL_ENTRY_EXTENSION_ENCODE_HANDLERS_CRL_EXTENSION_ENCODE_HANDLERS_EXTENSION_ENCODE_HANDLERS)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERS'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERS_encode_asn1_int_gc_encode_asn1_str_gc_encode_name_gc _txt2obj_gc _HashContext _HMACContext) _OCSPRequest _OCSPResponse)_RSAPrivateKey _RSAPublicKey)_X25519PrivateKey_X25519PublicKey) _Certificate_CertificateRevocationList_CertificateSigningRequest_RevokedCertificate)binding)hashes serialization)dsaecrsa)MGF1OAEPPKCS1v15PSS) AESARC4BlowfishCAST5CamelliaChaCha20IDEASEED TripleDES)CBCCFBCFB8CTRECBGCMOFBXTS)scrypt)ocsp _MemoryBIObiochar_ptrc@seZdZdZdZddZddZddZej d d Z d d Z d dZ ddZ ddZddZddZddZddZddZddZdd Zd!d"Zd#d$Zd%d&Zd'd(Zd)d*Zd+d,Zd-d.Zd/d0Zdd2d3Zd4d5Zd6d7Z d8d9Z!d:d;Z"dd?Z$d@dAZ%dBdCZ&dDdEZ'dFdGZ(dHdIZ)dJdKZ*dLdMZ+dNdOZ,dPdQZ-dRdSZ.dTdUZ/dVdWZ0dXdYZ1dZd[Z2d\d]Z3d^d_Z4d`daZ5dbdcZ6dddeZ7dfdgZ8dhdiZ9djdkZ:dldmZ;dndoZdtduZ?dvdwZ@dxdyZAdzd{ZBd|d}ZCd~dZDddZEddZFddZGddZHddZIddZJddZKddZLddZMddZNddZOddZPddZQddZRddZSddZTddZUddZVddZWddZXddZYddZZddZ[ddZ\ddZ]e ddZ^ddZ_ddZ`ddZaddZbddZcddZdddZeddÄZfddńZgddDŽZhddɄZidd˄Zjdd̈́ZkddτZldddфZmddӄZnddՄZoddׄZpddلZqddۄZrdd݄Zsdd߄ZtddZud1S)Backendz) OpenSSL API binding interfaces. opensslcCs`t|_|jj|_|jj|_i|_|| |jj g|_ |jj r.|j |jjdSdSN)r=Binding_bindingffi_ffilib_lib_cipher_registry_register_default_ciphersactivate_osrandom_engine EVP_PKEY_DH _dh_typesCryptography_HAS_EVP_PKEY_DHXappend EVP_PKEY_DHXselfrp^/var/www/html/env/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/backend.py__init__fs    zBackend.__init__cCst|j|Sr_)r=_openssl_assertre)rookrprprqopenssl_assertrszBackend.openssl_assertcCsN|j}||jjkr%|j||j|j|}||dkdSdSN)reENGINE_get_default_RANDrcNULLENGINE_unregister_RAND RAND_cleanup ENGINE_finishruroeresrprprqactivate_builtin_randomus     zBackend.activate_builtin_randomc cs|j|jj}|||jjk|j|}||dkz |VW|j|}||dk|j |}||dkdS|j|}||dk|j |}||dkwrv) re ENGINE_by_idra_osrandom_engine_idrurcry ENGINE_init ENGINE_freer|r}rprprq_get_osurandom_engines     zBackend._get_osurandom_enginecCsX||}|j|}||dkWdn1s wY|jdSrv)rrreENGINE_set_default_RANDrur{r}rprprqrhs   z Backend.activate_osrandom_enginec Cst|jdd}|}|j|dt|||jjd}||dkWdn1s,wY|j| dS)Nchar[]@sget_implementationrascii) rcnewrreENGINE_ctrl_cmdlenryrustringdecode)robufr~rrprprqosrandom_engine_implementations  z&Backend.osrandom_engine_implementationcCs|j|j|jjdS)z Friendly string name of the loaded OpenSSL library. This is not necessarily the same version as it was compiled against. Example: OpenSSL 1.0.1e 11 Feb 2013 r)rcrreOpenSSL_versionOPENSSL_VERSIONrrnrprprqopenssl_version_texts zBackend.openssl_version_textcCs |jSr_)reOpenSSL_version_numrnrprprqopenssl_version_number zBackend.openssl_version_numbercCs t|||Sr_r1)rokey algorithmrprprqcreate_hmac_ctx zBackend.create_hmac_ctxcCsL|jdks |jdkrd|j|jdd}n|jd}|j|}|S)Nblake2bblake2sz{0}{1}r)nameformat digest_sizeencodereEVP_get_digestbyname)roralgevp_mdrprprq_evp_md_from_algorithms   zBackend._evp_md_from_algorithmcCs ||}|||jjk|Sr_)rrurcryrorrrprprq_evp_md_non_null_from_algorithms z'Backend._evp_md_non_null_from_algorithmcCs||}||jjkSr_)rrcryrrprprqhash_supporteds  zBackend.hash_supportedcC ||Sr_rrorrprprqhmac_supportedrzBackend.hmac_supportedcC t||Sr_r/rrprprqcreate_hash_ctxrzBackend.create_hash_ctxcCsHz |jt|t|f}Wn tyYdSw||||}|jj|kSNF)rftypeKeyErrorrcry)rociphermodeadapter evp_cipherrprprqcipher_supporteds   zBackend.cipher_supportedcCs0||f|jvrtd||||j||f<dS)Nz$Duplicate registration for: {0} {1}.)rf ValueErrorr)ro cipher_clsmode_clsrrprprqregister_cipher_adapters zBackend.register_cipher_adaptercCs@tttttttfD] }|t|t dq tttttfD] }|t |t dqttttfD] }|t |t dq.|t tt dttttfD] }|t |t dqIttttfD] }|t |t dq[tttgttttgD] \}}|||t dqs|ttdt d|ttdt d|tttdS) Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}rc4chacha20)rPrSrTrVrQrRrUrrGGetCipherByNamerKrOrIrN itertoolsproductrJrMrHrrLrW_get_xts_cipher)rorrrprprqrgsn  z!Backend._register_default_cipherscCt|||tjSr_)r_ENCRYPTrorrrprprqcreate_symmetric_encryption_ctxz'Backend.create_symmetric_encryption_ctxcCrr_)r_DECRYPTrrprprqcreate_symmetric_decryption_ctxrz'Backend.create_symmetric_decryption_ctxcCrr_)rrrprprqpbkdf2_hmac_supported rzBackend.pbkdf2_hmac_supportedc Cs\|jd|}||}|j|t||t|||||}||dk|j|ddSNunsigned char[]rw)rcrrrePKCS5_PBKDF2_HMACrrubuffer) rorlengthsalt iterations key_materialrrrrprprqderive_pbkdf2_hmac#s  zBackend.derive_pbkdf2_hmaccCs t|jSr_)r=_consume_errorsrernrprprqr4rzBackend._consume_errorscCs||jjksJtjs4|j|}|jd|}|j||}||dkt |j |d|dS|j |}|||jjk|j |}|j|t |dS)Nrrbig)rcrysixPY2re BN_num_bytesr BN_bn2binruint from_bytesr BN_bn2hexr OPENSSL_free)robn bn_num_bytesbin_ptrbin_len hex_cdatahex_strrprprq _bn_to_int7s     zBackend._bn_to_intNcCs|dus ||jjks J|dur|jj}tjs:|t|ddd}|j|t ||}| ||jjk|St | ddd d}|jd}||d <|j||}| |d k| |d |jjk|d S) a  Converts a python integer to a BIGNUM. The returned BIGNUM will not be garbage collected (to support adding them to structs that take ownership of the object). Be sure to register it for GC if it will be discarded after use. Ng @rwrLr BIGNUM **r)rcryrrto_bytesr bit_lengthre BN_bin2bnrruhexrstriprr BN_hex2bn)ronumrbinarybn_ptrhex_numrrprprq _int_to_bnJs zBackend._int_to_bncCst|||j}|||jjk|j||jj}| |}|j||jj }|j ||||jj}||dk| |}t |||Srv)rB_verify_rsa_parametersreRSA_newrurcrygcRSA_freerBN_freeRSA_generate_key_ex_rsa_cdata_to_evp_pkeyr5)ropublic_exponentkey_size rsa_cdatarrevp_pkeyrprprqgenerate_rsa_private_keyis      z Backend.generate_rsa_private_keycCs|dko |d@dko |dkS)Nrwrrp)rorrrprprq!generate_rsa_parameters_supported{sz)Backend.generate_rsa_parameters_supportedc CsRt|j|j|j|j|j|j|jj |jj |j }| ||jjk|j||j j}||j}||j}||j}||j}||j}||j}||jj } ||jj } |j |||} | | dk|j || | |} | | dk|j ||||} | | dk|j ||jj} | | dk||} t||| Srv)rB_check_private_key_componentspqddmp1dmq1iqmppublic_numbersr~nrerrurcryrrrRSA_set0_factors RSA_set0_keyRSA_set0_crt_paramsRSA_blinding_onrr5) ronumbersrrrrrrrr~r rrrprprqload_rsa_private_numberss>         z Backend.load_rsa_private_numberscCst|j|j|j}|||jjk|j ||jj }| |j}| |j}|j ||||jj}||dk| |}t|||Srv)rB_check_public_key_componentsr~r rerrurcryrrrr rr6)rorrr~r rrrprprqload_rsa_public_numberss     zBackend.load_rsa_public_numberscCs2|j}|||jjk|j||jj}|Sr_)re EVP_PKEY_newrurcryr EVP_PKEY_free)rorrprprq_create_evp_pkey_gcs zBackend._create_evp_pkey_gccC(|}|j||}||dk|Srv)rreEVP_PKEY_set1_RSAru)rorrrrprprqrzBackend._rsa_cdata_to_evp_pkeycCsJ|jd|}|j|t|}|||jjkt|j||jj |S)z Return a _MemoryBIO namedtuple of (BIO, char*). The char* is the storage for the BIO and it must stay alive until the BIO is finished with. r) rcrreBIO_new_mem_bufrruryrZrBIO_free)rodata data_char_pr[rprprq _bytes_to_bios zBackend._bytes_to_biocCsP|j}|||jjk|j|}|||jjk|j||jj}|S)z. Creates an empty memory BIO. )re BIO_s_memrurcryBIO_newrr)ro bio_methodr[rprprq_create_mem_bio_gcs  zBackend._create_mem_bio_gccCs\|jd}|j||}||dk||d|jjk|j|d|dd}|S)zE Reads a memory BIO. This only works on memory BIOs. zchar **rN)rcrreBIO_get_mem_dataruryr)ror[rbuf_lenbio_datarprprq _read_mem_bios zBackend._read_mem_biocC2|j|}||jjkr*|j|}|||jjk|j||jj}t |||S||jj krN|j |}|||jjk|j||jj }t |||S||jjkrr|j|}|||jjk|j||jj}t|||S||jvr|j|}|||jjk|j||jj}t|||Std)zd Return the appropriate type of PrivateKey given an evp_pkey cdata pointer. Unsupported key type.)re EVP_PKEY_id EVP_PKEY_RSAEVP_PKEY_get1_RSArurcryrrr5 EVP_PKEY_DSAEVP_PKEY_get1_DSADSA_freer" EVP_PKEY_ECEVP_PKEY_get1_EC_KEY EC_KEY_freer$rjEVP_PKEY_get1_DHDH_freerrrorkey_typer dsa_cdataec_cdatadh_cdatarprprq_evp_pkey_to_private_key,             z Backend._evp_pkey_to_private_keycCr%)zc Return the appropriate type of PublicKey given an evp_pkey cdata pointer. r&)rer'r(r)rurcryrrr6r*r+r,r#r-r.r/r%rjr0r1rrr2rprprq_evp_pkey_to_public_keyr8zBackend._evp_pkey_to_public_keycCs2|jjrt|tjtjtjtjtjfSt|tjSr_) reCryptography_HAS_RSA_OAEP_MD isinstancer>SHA1SHA224SHA256SHA384SHA512rrprprq_oaep_hash_supporteds zBackend._oaep_hash_supportedcCst|trdSt|trt|jtr||jjSt|trCt|jtrC||jjoB||joB|j dupBt |j dkpB|j j dkSdS)NTrrwF) r;rErF_mgfrCr _algorithmrDrA_labelrreCryptography_HAS_RSA_OAEP_LABEL)ropaddingrprprqrsa_padding_supported+s    zBackend.rsa_padding_supportedc Cs~|dvrtd|j}|||jjk|j||jj}|j|||jjd|jj|jj|jj}||dkt ||S)N)iii z+Key size must be 1024 or 2048 or 3072 bits.rrw) rreDSA_newrurcryrr,DSA_generate_parameters_exr!)rorctxrrprprqgenerate_dsa_parameters<s   zBackend.generate_dsa_parameterscCsT|j|j}|||jjk|j||jj}|j|| |}t |||Sr_) re DSAparams_dup _dsa_cdatarurcryrr,DSA_generate_key_dsa_cdata_to_evp_pkeyr")ro parametersrJrrprprqgenerate_dsa_private_keyMs    z Backend.generate_dsa_private_keycCs||}||Sr_)rKrQ)rorrPrprprq'generate_dsa_private_key_and_parametersVs  z/Backend.generate_dsa_private_key_and_parameterscCsB|j||||}||dk|j|||}||dkdSrv)re DSA_set0_pqgru DSA_set0_key)ror4rrgpub_keypriv_keyrrprprq_dsa_cdata_set_valuesZszBackend._dsa_cdata_set_valuesc Cst||jj}|j}|||jjk|j ||jj }| |j }| |j }| |j}| |jj}| |j}|||||||||} t||| Sr_)r@_check_dsa_private_numbersrparameter_numbersrerHrurcryrr,rrrrUyxrXrOr") rorrZr4rrrUrVrWrrprprqload_dsa_private_numbers`s        z Backend.load_dsa_private_numbersc Cst|j|j}|||jjk|j||jj }| |jj }| |jj }| |jj }| |j}|jj}|||||||||}t|||Sr_)r@_check_dsa_parametersrZrerHrurcryrr,rrrrUr[rXrOr#) rorr4rrrUrVrWrrprprqload_dsa_public_numbersss     zBackend.load_dsa_public_numberscCst||j}|||jjk|j||jj}| |j }| |j }| |j }|j ||||}||dkt||Srv)r@r^rerHrurcryrr,rrrrUrSr!)rorr4rrrUrrprprqload_dsa_parameter_numberss      z"Backend.load_dsa_parameter_numberscCrrv)rreEVP_PKEY_set1_DSAru)ror4rrrprprqrOrzBackend._dsa_cdata_to_evp_pkeycCrr_rrrprprqdsa_hash_supportedrzBackend.dsa_hash_supportedcCsdS)NTrp)rorrrUrprprqdsa_parameters_supportedsz Backend.dsa_parameters_supportedcCs||td|jS)N)rrP block_sizerrprprqcmac_algorithm_supportedsz Backend.cmac_algorithm_supportedcCrr_rrrprprqcreate_cmac_ctxrzBackend.create_cmac_ctxc st|tjs tdt|tjrt|tjstd|}j } |j j kj |j j}j |tjjj} |dkj |t|j} |dk|}j ||j} |dkj } |j j kj |fdd}j|jt|j jddj ||} |dkj !||j|}|dkrĈ"} | d#j j$j j%td t&|S) N.Algorithm must be a registered hash algorithm.z5MD5 is not a supported hash algorithm for EC/DSA CSRsrwcsj|jjjdS)NX509_EXTENSION_free)resk_X509_EXTENSION_pop_freerc addressof _original_lib)r\rnrprqs z)Backend.create_x509_csr..F extensionshandlersx509_objadd_funcrrDigest too big for RSA key)'r;r> HashAlgorithm TypeErrorMD5rB RSAPrivateKeyrrre X509_REQ_newrurcryr X509_REQ_freeX509_REQ_set_versionrVersionv1valueX509_REQ_set_subject_namer- _subject_name public_keyX509_REQ_set_pubkey _evp_pkeysk_X509_EXTENSION_new_null_create_x509_extensions _extensionsr(sk_X509_EXTENSION_insertX509_REQ_add_extensions X509_REQ_signr_lib_reason_match ERR_LIB_RSA RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEYr;) robuilder private_keyrrx509_reqrr sk_extensionerrorsrprnrqcreate_x509_csrsh          zBackend.create_x509_csrc Cst|tjs tdt|tjstdt|tjr$t|tjs$t d| |}|j }|j |tj j}|j ||jj}||dk|j |t||j}||dk|j ||jj}||dkt||j}|j ||}||dk||j ||j ||j !||j"|j#|j$t%||j j&dd|j '|t||j(}||dk|j )||j|}|dkr|*}||d+|j j,|j j-t dt.||S) NBuilder type mismatch.rhz=MD5 is not a supported hash algorithm for EC/DSA certificatesrwTrnrrs)/r;rCertificateBuilderrur>rtrvrBrwrrreX509_newrcrbackend X509_freeX509_set_version_versionr}ruX509_set_subject_namer-rX509_set_pubkey _public_keyrr+_serial_numberX509_set_serialNumber_set_asn1_timeX509_get_notBefore_not_valid_beforeX509_get_notAfter_not_valid_afterrrr( X509_add_extX509_set_issuer_name _issuer_name X509_signrrrrr9) rorrrr x509_certr serial_numberrrprprqcreate_x509_certificatesr          zBackend.create_x509_certificatecCsZt|}|j||}||jjkr+|}||d |jj |jj t ddS)NrzVInvalid time. This error can occur if you set a time too far in the future on Windows.) calendartimegm timetuplere ASN1_TIME_setrcryrrur ERR_LIB_ASN1ASN1_R_ERROR_GETTING_TIMEr)ro asn1_timetime timestamprrrprprqrFs zBackend._set_asn1_timecCs>|j}|||jjk|j||jj}||||Sr_)re ASN1_TIME_newrurcryrASN1_TIME_freer)rorrrprprq_create_asn1_timeVs  zBackend._create_asn1_timec Cst|tjs tdt|tjstdt|tjr$t|tjs$t d| |}|j }|j |tj j}|j |d}||dk|j |t||j}||dk||j}|j ||}||dk||j}|j ||}||dk|j|jt||j jdd|jD] } |j | j!} || |j j"k|j #|| }||dkq|j $||j%|}|dkr|&} || d'|j j(|j j)t dt*||S) Nrrhz5MD5 is not a supported hash algorithm for EC/DSA CRLsrwTrnrrs)+r;r CertificateRevocationListBuilderrur>rtrvrBrwrrre X509_CRL_newrcrr X509_CRL_freeX509_CRL_set_versionruX509_CRL_set_issuer_namer-rr _last_updateX509_CRL_set_lastUpdate _next_updateX509_CRL_set_nextUpdaterrr'X509_CRL_add_ext_revoked_certificatesCryptography_X509_REVOKED_dup _x509_revokedryX509_CRL_add0_revoked X509_CRL_signrrrrrr:) rorrrrx509_crlr last_update next_update revoked_certrevokedrrprprqcreate_x509_crl]sj           zBackend.create_x509_crlc Csdt|D]+\}}|||}|||jjk|r"|j||jj}||||} || dkqdSrv) enumerate_create_x509_extensionrurcryrreri) rororprqrrri extensionx509_extensionrrprprqrs zBackend._create_x509_extensionscCs2t||jj}|j|jj||jrd|Sd|S)Nrwr)r.oid dotted_stringreX509_EXTENSION_create_by_OBJrcrycritical)rorr}objrprprq_create_raw_x509_extensions z"Backend._create_raw_x509_extensioncCst|jtjrt||jj}|||St|jtjr2tdd|jD}t||}|||St|jtj rKt j }t||}|||Sz||j }Wntyatd|j w|||j}|j|j jd}t||jjk|j||jrd|Sd|S)NcSsg|]}|jqSrp)r}).0r\rprprq sz2Backend._create_x509_extension..zExtension not supported: {0}rrwr)r;r}rUnrecognizedExtensionr,r TLSFeaturerdump PrecertPoison asn1cryptocoreNullrrNotImplementedErrorrre OBJ_txt2nidrrrru NID_undefX509V3_EXT_i2dr)rorprr}asn1r ext_structnidrprprqrs8          zBackend._create_x509_extensioncCst|tjs td|j}|||jjk|j ||jj }t ||j }|j ||}||dk||j}|j||}||dk|j|jt||jjddt|d|S)NrrwTrn)r;rRevokedCertificateBuilderrureX509_REVOKED_newrurcryrX509_REVOKED_freer+rX509_REVOKED_set_serialNumberr_revocation_dateX509_REVOKED_set_revocationDaterrr&X509_REVOKED_add_extr<)ror x509_revokedrrrev_daterprprqcreate_x509_revoked_certificates*     z'Backend.create_x509_revoked_certificatecCs||jj|j||Sr_) _load_keyrePEM_read_bio_PrivateKeyr7)rorpasswordrprprqload_pem_private_keys zBackend.load_pem_private_keycCs||}|j|j|jj|jj|jj}||jjkr)|j||jj}||S| |j |j}| |dk|j |j|jj|jj|jj}||jjkre|j||jj }||}t|||S|dSrv)rrePEM_read_bio_PUBKEYr[rcryrrr9r BIO_resetruPEM_read_bio_RSAPublicKeyrrr6_handle_key_loading_errorrormem_biorrrrprprqload_pem_public_keys$       zBackend.load_pem_public_keycCs^||}|j|j|jj|jj|jj}||jjkr)|j||jj}t||S| dSr_) rrePEM_read_bio_DHparamsr[rcryrr1rr)rorrr6rprprqload_pem_parameterss    zBackend.load_pem_parameterscCs:||}|||}|r||S||jj|j||Sr_)r"_evp_pkey_from_der_traditional_keyr7rred2i_PKCS8PrivateKey_bio)rorrr#rrprprqload_der_private_keys   zBackend.load_der_private_keycCsR|j|j|jj}||jjkr#|j||jj}|dur!td|S|dS)N4Password was given but private key is not encrypted.) red2i_PrivateKey_bior[rcryrrrur)ror#rrrprprqr2s z*Backend._evp_pkey_from_der_traditional_keycCs||}|j|j|jj}||jjkr#|j||jj}||S| |j |j}| |dk|j |j|jj}||jjkrY|j||jj }||}t|||S|dSrv)rred2i_PUBKEY_bior[rcryrrr9rrrud2i_RSAPublicKey_biorrr6rrrprprqload_der_public_key@s        zBackend.load_der_public_keycCs||}|j|j|jj}||jjkr#|j||jj}t||S|jj rW| |j |j}| |dk|j |j|jj}||jjkrW|j||jj}t||S|dSrv)rred2i_DHparams_bior[rcryrr1rrkrrruCryptography_d2i_DHxparams_bior)rorrr6rrprprqload_der_parametersWs$        zBackend.load_der_parameterscCb||}|j|j|jj|jj|jj}||jjkr#|td|j||jj }t ||SNzUnable to load certificate) rrePEM_read_bio_X509r[rcryrrrrr9rorrrrprprqload_pem_x509_certificatem   z!Backend.load_pem_x509_certificatecCV||}|j|j|jj}||jjkr|td|j||jj }t ||Sr ) rre d2i_X509_bior[rcryrrrrr9r rprprqload_der_x509_certificatey   z!Backend.load_der_x509_certificatecCrNzUnable to load CRL) rrePEM_read_bio_X509_CRLr[rcryrrrrr:rorrrrprprqload_pem_x509_crlr zBackend.load_pem_x509_crlcCrr) rred2i_X509_CRL_bior[rcryrrrrr:rrprprqload_der_x509_crlrzBackend.load_der_x509_crlcCrNzUnable to load request) rrePEM_read_bio_X509_REQr[rcryrrrryr;rorrrrprprqload_pem_x509_csrr zBackend.load_pem_x509_csrcCrr) rred2i_X509_REQ_bior[rcryrrrryr;rrprprqload_der_x509_csrrzBackend.load_der_x509_csrc Cs.||}|durt|tstd|jd}|dur+|jd|}||_t||_||j |jj |j |j j d|}||jj krn|jdkrj|} || |jdkrYtd|jdks`Jtd |jd ||j||j j}|dur|jdkrtd |dur|jd ks|dusJ||S) NzPassword must be byteszCRYPTOGRAPHY_PASSWORD_DATA *zchar []Cryptography_pem_password_cbrz3Password was not given but private key is encryptedzBPasswords longer than {0} bytes are not supported by this backend.rwr)rr;bytesrurcrrrrr[ryrkrerlerrorrrurrmaxsizerrrcalled) roopenssl_read_func convert_funcrrruserdata password_bufrrrprprqrsL        zBackend._load_keycs}|s td|djjjjs"|djjjjr&td|djjjjs>|djj jj rDt dt j tfdd|DrStd|djjjjj jjfvseJtd)NzCould not deserialize key data.rz Bad decrypt. Incorrect password?z0PEM data is encrypted with an unsupported cipherc3s$|] }|jjjjVqdSr_)rre ERR_LIB_EVP'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)rr"rnrprq s z4Backend._handle_key_loading_error..z!Unsupported public key algorithm.)rrrrer)EVP_R_BAD_DECRYPTERR_LIB_PKCS12!PKCS12_R_PKCS12_CIPHERFINAL_ERROREVP_R_UNKNOWN_PBE_ALGORITHM ERR_LIB_PEMPEM_R_UNSUPPORTED_ENCRYPTIONrr UNSUPPORTED_CIPHERanyrdr)rorrprnrqrsF     z!Backend._handle_key_loading_errorcCsz||}Wn ty|jj}Ynw|j|}||jjkr<|}|||jjkp8|d |jj |jj dS|||jjk|j |dS)NrFT) _elliptic_curve_to_nidrrerEC_GROUP_new_by_curve_namercryrrur ERR_LIB_ECEC_R_UNKNOWN_GROUP EC_GROUP_free)rocurve curve_nidgrouprrprprqelliptic_curve_supporteds&      z Backend.elliptic_curve_supportedcCst|tjsdS||Sr)r;rAECDSAr<)rosignature_algorithmr9rprprq,elliptic_curve_signature_algorithm_supported&s  z4Backend.elliptic_curve_signature_algorithm_supportedcCs||r:||}|j|}|||jjk|j||jj}|j |}||dk| |}t |||St d |jtj)z@ Generate a new private key on the named curve. rwz$Backend object does not support {0}.)r<r4reEC_KEY_new_by_curve_namerurcryrr/EC_KEY_generate_key_ec_cdata_to_evp_pkeyr$rrrr UNSUPPORTED_ELLIPTIC_CURVE)ror9r:r5rrrprprq#generate_elliptic_curve_private_key/s       z+Backend.generate_elliptic_curve_private_keycCs|j}||j}|j|}|||jjk|j||jj }|j| |j |jj }|j ||}||dk|||j|j}||}t|||Srv)rr4r9rer@rurcryrr/r private_value BN_clear_freeEC_KEY_set_private_key)_ec_key_set_public_key_affine_coordinatesr\r[rBr$)rorpublicr:r5rErrrprprq#load_elliptic_curve_private_numbersGs     z+Backend.load_elliptic_curve_private_numberscCsd||j}|j|}|||jjk|j||jj}| ||j |j }| |}t |||Sr_)r4r9rer@rurcryrr/rHr\r[rBr%)rorr:r5rrprprq"load_elliptic_curve_public_numbers]s     z*Backend.load_elliptic_curve_public_numbersc Cs||}|j|}|||jjk|j||jj}||\}}|j |}|||jjk|j||jj }| |}|j||jj }| 9} |j||||jj|jj| } || dk|j| } |j| } |||| | | } || dkWdn1swY|j||} || dk| |} |j| |jj } |j|| } || dk||}t|||Srv)r4rer@rurcryrr/ _ec_key_determine_group_get_func EC_POINT_new EC_POINT_freerrF _tmp_bn_ctx EC_POINT_mul BN_CTX_getEC_KEY_set_public_keyrGrBr$)rorEr9r:r5get_funcr;pointr}bn_ctxrbn_xbn_yprivaterrprprq!derive_elliptic_curve_private_keyjs8           z)Backend.derive_elliptic_curve_private_keycCr)NzUnable to load OCSP request) rred2i_OCSP_REQUEST_bior[rcryrrrOCSP_REQUEST_freer3)rorrrequestrprprqload_der_ocsp_requestrzBackend.load_der_ocsp_requestcCr)NzUnable to load OCSP response) rred2i_OCSP_RESPONSE_bior[rcryrrrOCSP_RESPONSE_freer4)rorrresponserprprqload_der_ocsp_responserzBackend.load_der_ocsp_responsec Cs|j}|||jjk|j||jj}|j\}}}||}|j ||j |j }|||jjk|j ||}|||jjk|j |j t||jjddt||S)NTrn)reOCSP_REQUEST_newrurcryrr[_requestrOCSP_cert_to_id_x509OCSP_request_add0_idrrr*OCSP_REQUEST_add_extr3) rorocsp_reqcertissuerrrcertidonereqrprprqcreate_ocsp_requests&     zBackend.create_ocsp_requestc Cs|j}|||jjk|j||jj}||jj }|j ||jj j |jj j }|||jjk|j||jj}|jjdurGd}nt|jj}|jjdurX|jj}n||jj}|jj} |jjdurp||jj} ||jj} |j|||jjj||| | } || |jjk||}|j\} } |jj}| tjjur||jjO}|jdur|jD]}|j||j } || dkq|j |j!t"||jj#dd|j$|| j |j%||jj|} | dkr|&}||d'|jj(|jj)t*d|S)NrrwTrnrz,responder_cert must be signed by private_key)+reOCSP_BASICRESP_newrurcryrOCSP_BASICRESP_freer _responserCrd_certre_issuerOCSP_CERTID_free_revocation_reasonr_revocation_timerr _this_updateOCSP_basic_add1_status _cert_statusr} _responder_id OCSP_NOCERTSrYOCSPResponderEncodingHASHOCSP_RESPID_KEY_certsOCSP_basic_add1_certrrr)OCSP_BASICRESP_add_extOCSP_basic_signrrr ERR_LIB_X509X509_R_KEY_VALUES_MISMATCHr)rorrrbasicrrkreasonrev_timer this_updaterresponder_certresponder_encodingflagsrirrprprq_create_ocsp_basic_responses              z#Backend._create_ocsp_basic_responsecCsb|tjjur||||}n|jj}|j|j|}| ||jjk|j ||jj }t ||Sr_) rYOCSPResponseStatus SUCCESSFULrrcryreOCSP_response_creater}rurr_r4)roresponse_statusrrrr ocsp_resprprprqcreate_ocsp_response s  zBackend.create_ocsp_responsecCs||o t|tjSr_)r<r;rAECDH)rorr9rprprq+elliptic_curve_exchange_algorithm_supporteds  z3Backend.elliptic_curve_exchange_algorithm_supportedcCrrv)rreEVP_PKEY_set1_EC_KEYru)ror5rrrprprqrBrzBackend._ec_cdata_to_evp_pkeycCsNddd}||j|j}|j|}||jjkr%td|jtj |S)z/ Get the NID for a curve name. prime192v1 prime256v1) secp192r1 secp256r1z%{0} is not a supported elliptic curve) getrre OBJ_sn2nidrrrrr rC)ror9 curve_aliases curve_namer:rprprqr4%s  zBackend._elliptic_curve_to_nidc csd|j}|||jjk|j||jj}|j|z |VW|j|dS|j|wr_) re BN_CTX_newrurcryr BN_CTX_free BN_CTX_start BN_CTX_end)rorUrprprqrO9s  zBackend._tmp_bn_ctxcCs|||jjk|jd}|||jjk|j|}|||jjk|j|}|||jjk|j|}|||jjk||krR|jj rR|jj }n|jj }|sZJ||fS)zu Given an EC_KEY determine the group and what function is required to get point coordinates. scharacteristic-two-field) rurcryrerrEC_KEY_get0_groupEC_GROUP_method_ofEC_METHOD_get_field_typeCryptography_HAS_EC2M$EC_POINT_get_affine_coordinates_GF2m#EC_POINT_get_affine_coordinates_GFp)rorJ nid_two_fieldr;methodrrSrprprqrLDs     z(Backend._ec_key_determine_group_get_funccCst|dks|dkr td|j|||jj}|j|||jj}|j|||}|dkr8|td|S)zg Sets the public key point in the EC_KEY context to the affine x and y values. rz2Invalid EC key. Both x and y must be non-negative.rwzInvalid EC key.)rrcrrrer(EC_KEY_set_public_key_affine_coordinatesr)rorJr\r[rrprprqrH`sz1Backend._ec_key_set_public_key_affine_coordinatescCst|tjs tdt|tjstdt|tjr#d}d}|jj}n t|tjr?|j d}|j }t |}|dkr>t dnt d|j |} |tjjur|tjjur\|j j} |} n\|tjjusdJ| |j jkro|j j} n| |j jkrz|j j} n | |j jksJ|j j} |} n/|tjjur|tjjurt|tjst d || |S|tjjusJ|j j} |} ntd |} | | | ||||jj|jj} || d k|| S) Nz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancers aes-256-cbcizBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezDEncryption is not supported for DER encoded traditional OpenSSL keys/encoding must be an item from the Encoding enumrw) r;r? PrivateFormatruKeySerializationEncryption NoEncryptionrcryBestAvailableEncryptionreEVP_get_cipherbynamerrrr'EncodingPEMPKCS8PEM_write_bio_PKCS8PrivateKeyTraditionalOpenSSLr(PEM_write_bio_RSAPrivateKeyr*PEM_write_bio_DSAPrivateKeyr-PEM_write_bio_ECPrivateKeyDER"_private_key_bytes_traditional_deri2d_PKCS8PrivateKey_bior rur$)roencodingrencryption_algorithmrcdatarpasslenrr3 write_biorr[rrprprq_private_key_bytests              zBackend._private_key_bytescCsp||jjkr |jj}n||jjkr|jj}n |||jjk|jj}|}|||}||dk| |Srv) rer(i2d_RSAPrivateKey_bior-i2d_ECPrivateKey_biorur*i2d_DSAPrivateKey_bior r$)ror3rrr[rrprprqrs      z*Backend._private_key_bytes_traditional_derc Cs t|tjs td|tjjus|tjjur+|tjjus"|tjjur&td||S|tjjurK|tjj ur<|j j }n |tjj usDJ|j j }|}n0|tjjurw|j ||j jks]J|tjj urh|j j}n |tjj uspJ|j j}|}ntd|}|||}||dk||S)Nrz1OpenSSH format must be used with OpenSSH encodingz1format must be an item from the PublicFormat enumrw)r;r?rru PublicFormatOpenSSHr_openssh_public_key_bytesSubjectPublicKeyInforrePEM_write_bio_PUBKEYri2d_PUBKEY_bioPKCS1r'r(PEM_write_bio_RSAPublicKeyi2d_RSAPublicKey_bior rur$) rorrrrrrr[rrprprq_public_key_bytess<              zBackend._public_key_bytescCs*t|tjr |}dttdt|j t|j St|t j rO|}|j }dttdt|jt|jt|jt|jSt|tjsWJ|}ztjdtjdtjdit|j}Wn tyxtdwd |d ttd |t|t|S) Nsssh-rsa sssh-rsasssh-dss sssh-dsssnistp256snistp384snistp521zZOnly SECP256R1, SECP384R1, and SECP521R1 curves are supported by the SSH public key formats ecdsa-sha2- )r;rB RSAPublicKeyrbase64 b64encoder?_ssh_write_string_ssh_write_mpintr~r r@ DSAPublicKeyrZrrrUr[rAEllipticCurvePublicKey SECP256R1 SECP384R1 SECP521R1rr9rr encode_point)rorrrZrrprprqrsX           z!Backend._openssh_public_key_bytescCs|tjjur td|jd}|j||jj||jj|tjj ur5|d|jjkr0|jj }n!|jj }n|tjj urM|d|jjkrH|jj }n |jj}ntd|}|||}||dk||S)Nz!OpenSSH encoding is not supportedrrrrw)r?rrrurcrre DH_get0_pqgryrPEM_write_bio_DHxparamsPEM_write_bio_DHparamsrCryptography_i2d_DHxparams_bioi2d_DHparams_bior rur$)rorrrrrr[rrprprq_parameter_bytes%s.          zBackend._parameter_bytescCs||dkrtd|dvrtd|j}|||jjk|j||jj}|j||||jj}||dkt ||S)Nrz%DH key_size must be at least 512 bits)rzDH generator must be 2 or 5rw) rreDH_newrurcryrr1DH_generate_parameters_exr)ro generatorrdh_param_cdatarrprprqgenerate_dh_parametersCs  zBackend.generate_dh_parameterscCrrv)rreEVP_PKEY_set1_DHru)ror6rrrprprq_dh_cdata_to_evp_pkeyXrzBackend._dh_cdata_to_evp_pkeycCs<t|j|}|j|}||dk||}t|||Srv)r _dh_cdatareDH_generate_keyrurr)rorP dh_key_cdatarrrprprqgenerate_dh_private_key^s    zBackend.generate_dh_private_keycCs||||Sr_)rr)rorrrprprq&generate_dh_private_key_and_parametershs z.Backend.generate_dh_private_key_and_parametersc Cs8|jj}|j}|||jjk|j||jj}| |j }| |j }|j dur3| |j }n|jj}| |jj }| |j}|j||||} || dk|j|||} || dk|jdd} |j|| } || dk| ddkr|j dkr| d|jjAdkstd||} t||| S)Nrwint[]rrz.DH private numbers did not pass safety checks.)rrZrerrurcryrr1rrrUrr[r\ DH_set0_pqg DH_set0_keyrCryptography_DH_checkDH_NOT_SUITABLE_GENERATORrrr) rorrZr6rrUrrVrWrcodesrrprprqload_dh_private_numbersls4        zBackend.load_dh_private_numbersc Cs|j}|||jjk|j||jj}|j}||j }||j }|j dur2||j }n|jj}||j }|j ||||}||dk|j|||jj}||dk||} t||| Srv)rerrurcryrr1rZrrrUrr[rrrr) rorr6rZrrUrrVrrrprprqload_dh_public_numberss       zBackend.load_dh_public_numberscCs|j}|||jjk|j||jj}||j}||j }|j dur/||j }n|jj}|j ||||}||dkt ||Srv) rerrurcryrr1rrrUrrr)rorr6rrUrrrprprqload_dh_parameter_numberss     z!Backend.load_dh_parameter_numberscCs|j}|||jjk|j||jj}||}||}|dur+||}n|jj}|j||||}||dk|j dd}|j ||}||dk|ddkS)Nrwrr) rerrurcryrr1rrrr)rorrUrr6rrrprprqdh_parameters_supporteds     zBackend.dh_parameters_supportedcCs |jjdkSrv)rerkrnrprprqdh_x942_serialization_supportedrz'Backend.dh_x942_serialization_supportedcsxt|}jd}j||}|djjkj|fdd}|dkj|d|ddS)Nzunsigned char **rcsj|dS)Nr)rer)pointerrnrprqrmsz)Backend.x509_name_bytes..) r-rcrre i2d_X509_NAMEruryrr)ror x509_namepprrprnrqx509_name_bytess   zBackend.x509_name_bytescCsT|}|j||jj}t|dk|j||t|}t|dkt||Srv) rreEVP_PKEY_set_type NID_X25519rruEVP_PKEY_set1_tls_encodedpointrr8)rorrrrprprqx25519_load_public_bytess  z Backend.x25519_load_public_bytescCsnd}|||}tj|j|jj}|||jjk|j||jj }||j ||jj kt ||S)Ns0.0+en" ) rrrerr[rcryrurrr'EVP_PKEY_X25519r7)ror pkcs8_prefixr[rrprprqx25519_load_private_bytess z!Backend.x25519_load_private_bytescCs|j|jj|jj}|||jjk|j||jj}|j|}||dk|j d}|j ||}||dk||d|jjk|j|d|jj }t ||S)Nrwz EVP_PKEY **r) reEVP_PKEY_CTX_new_idrrcryrurEVP_PKEY_CTX_freeEVP_PKEY_keygen_initrEVP_PKEY_keygenrr7)ro evp_pkey_ctxr evp_ppkeyrrprprqx25519_generate_keys    zBackend.x25519_generate_keycCs|jjSr_)re#CRYPTOGRAPHY_OPENSSL_110_OR_GREATERrnrprprqx25519_supported szBackend.x25519_supportedc CsX|jd|}|j|t||t||||tj|| }||dk|j|ddSr) rcrreEVP_PBE_scryptrrX _MEM_LIMITrur) rorrrr rrrrrprprq derive_scrypt#szBackend.derive_scryptcCst|}|j||jjkSr_)r_aead_cipher_namererrcry)ror cipher_namerprprqaead_cipher_supported,s zBackend.aead_cipher_supportedr_)v__name__ __module__ __qualname____doc__rrrrur contextlibrrrhrrrrrrrrrrrrgrrrrrrrrrrrrrrr r$r7r9rArGrKrQrRrXr]r_r`rOrbrcrfrgrrrrrrrrrrrrrrrrr rrrrrrrr<r?rDrJrKrYr]rarmrrrrBr4rOrLrHrrrrrrrrrrrrrrrrrr r rrrprprprqr]Qs      9 "    MSK       3-  &  P  Q,& 0    r]c@seZdZddZddZdS)rcCs ||_dSr_)_fmt)rofmtrprprqrr4rzGetCipherByName.__init__cCs&|jj||d}|j|dS)N)rrr)rrlowerrerr)rorrrrrprprq__call__7szGetCipherByName.__call__N)rrrrrrrprprprqr3s rcCs"d|jd}|j|dS)Nz aes-{0}-xtsrr)rrrerr)rrrrrprprqr<sr) __future__rrrrr collectionsrrrasn1crypto.corerr cryptographyrrcryptography.exceptionsrr 'cryptography.hazmat.backends.interfacesr r r r rrrrrrrrr$cryptography.hazmat.backends.opensslr,cryptography.hazmat.backends.openssl.ciphersr)cryptography.hazmat.backends.openssl.cmacr0cryptography.hazmat.backends.openssl.decode_asn1rr'cryptography.hazmat.backends.openssl.dhrrrr (cryptography.hazmat.backends.openssl.dsar!r"r#'cryptography.hazmat.backends.openssl.ecr$r%0cryptography.hazmat.backends.openssl.encode_asn1r&r'r(r)r*r+r,r-r.+cryptography.hazmat.backends.openssl.hashesr0)cryptography.hazmat.backends.openssl.hmacr2)cryptography.hazmat.backends.openssl.ocspr3r4(cryptography.hazmat.backends.openssl.rsar5r6+cryptography.hazmat.backends.openssl.x25519r7r8)cryptography.hazmat.backends.openssl.x509r9r:r;r<$cryptography.hazmat.bindings.opensslr=cryptography.hazmat.primitivesr>r?)cryptography.hazmat.primitives.asymmetricr@rArB1cryptography.hazmat.primitives.asymmetric.paddingrCrDrErF1cryptography.hazmat.primitives.ciphers.algorithmsrGrHrIrJrKrLrMrNrO,cryptography.hazmat.primitives.ciphers.modesrPrQrRrSrTrUrVrW"cryptography.hazmat.primitives.kdfrXcryptography.x509rY namedtuplerZregister_interfaceregister_interface_ifr`rdCryptography_HAS_SCRYPTobjectr]rrrrprprprqs <   ,   ,(   *b