U
    cc7                    @   s  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZmZ d dlmZm Z  d dl!m"Z"m#Z#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5mZ6 d dl7m8Z8 d dl9m:Z:m;Z; d dl<m=Z= d dl>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZF d dlGmHZHmIZImJZJmKZK d dlLmMZMmNZNmOZO d dlPmQZQmRZR d dlSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ d dl`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZi d dljmkZk d dllmmZmmnZn d dlompZpmqZqmrZrmsZsmtZt e ud d!d"gZvG d#d$ d$ZwG d%d& d&ZxG d'd( d(ZyexeTd)d*d+Zzex Z{dS ),    N)contextmanager)utilsx509)UnsupportedAlgorithm_Reasons)aead)_CipherContext_CMACContext)_DHParameters_DHPrivateKey_DHPublicKey_dh_params_dup)_DSAParameters_DSAPrivateKey_DSAPublicKey)_EllipticCurvePrivateKey_EllipticCurvePublicKey)_Ed25519PrivateKey_Ed25519PublicKey)_ED448_KEY_SIZE_Ed448PrivateKey_Ed448PublicKey_HashContext_HMACContext)_POLY1305_KEY_SIZE_Poly1305Context)_RSAPrivateKey_RSAPublicKey)_X25519PrivateKey_X25519PublicKey)_X448PrivateKey_X448PublicKey)r   )binding)hashesserialization)AsymmetricPadding)dhdsaeced25519ed448rsax25519x448)MGF1OAEPPKCS1v15PSS)#CERTIFICATE_ISSUER_PUBLIC_KEY_TYPESPRIVATE_KEY_TYPESPUBLIC_KEY_TYPES)BlockCipherAlgorithmCipherAlgorithm)AESAES128AES256ARC4CamelliaChaCha20SM4	TripleDES_BlowfishInternal_CAST5Internal_IDEAInternal_SEEDInternal)	CBCCFBCFB8CTRECBGCMModeOFBXTS)scrypt)pkcs7ssh)PBESPKCS12CertificatePKCS12KeyAndCertificates_ALLOWED_PKCS12_TYPES_PKCS12_CAS_TYPES
_MemoryBIObioZchar_ptrc                   @   s   e Zd ZdS )_RC2N)__name__
__module____qualname__ r]   r]   P/tmp/pip-unpacked-wheel-4layejjw/cryptography/hazmat/backends/openssl/backend.pyrY      s   rY   c                   @   sf
  e Zd ZdZdZddddddhZefZej	ej
ejejejejejejejejejejfZejejejejfZd	Zd
Zdd	> Zd	Zde> Z dd Z!e"dddZ#dDe$e%j&e%j'e(j)  ddddZ*e$dddZ+ddddZ,ddddZ-e.j/dd Z0ddddZ1e"ddd Z2e"dd!d"Z3e4dd#d$Z5e6ej7e8d%d&d'Z9ej7d(d)d*Z:ej7d(d+d,Z;ej7e$d-d.d/Z<ej7e$d-d0d1Z=e$dd2d3Z>ej7e$d-d4d5Z?ej7ej@d-d6d7ZAeBeCe$d8d9d:ZDd;d< ZEddd=d>ZFeBeCeGd8d?d@ZHeBeCeGd8dAdBZIej7e$d-dCdDZJej7e4e6e4e6e6dEdFdGZKe%j'e(j) ddHdIZLe%j'e(jM ddJdKZNe4ddLdMZOdEe4dNdOdPZPe4e4eQjRdQdRdSZSe4e4e$dQdTdUZTeQjUeQjRdVdWdXZVeQjWeQjXdVdYdZZYd[d\ ZZd]d^ Z[e6d_d`daZ\dbdc Z]e6ddddeZ^e_ddfdgZ`eaddhdiZbej7e$d-djdkZcede$dldmdnZee4efjgdodpdqZhefjgefjidrdsdtZje4efjidodudvZkdwdx ZlefjmefjidVdydzZnefjoefjpdVd{d|ZqefjrefjgdVd}d~Zsdd Zte$dddZuej7e$d-ddZve$dddZwexeyd-ddZze6e%j&e6 e_dddZ{e6eadddZ|e6e}j~dddZe6e%j&e6 e_dddZdd Ze6eadddZe6e}j~dddZeje%jdddZe%jejdddZeje%jdddZe%jejdddZeje%jdddZe%jejdddZejee$dddZeje$dddZdd Zdd Ze%jdddZeje$dddZejeje$dddZejejdddZejejdVddZejejdVddZeje6ejdddĄZe4ejejdŜddǄZejdȜddʄZe4d˜dd̈́Zejeje$dΜddЄZdd҄ Zeje4dddԄZe/ddք Zdd؄ Ze4e4dٜddۄZejejeje6dܜddބZdd Zdd Zejeje6dddZe$dddZe4e4e}j~dddZdd Ze}j~e}jdrddZe4e4e}jdddZe}je}jdVddZe}je}jdVddZe}je}j~dVddZdFe4e4e%j&e4 e$dddZe$dddZe6ejdddZe6ejdddZȐd d ZejdddZe$dddZe6ejdddZe6ejddd	Zejdd
dZe$dddZe$dddZe6ejdddZe6ejdddZejdddZe$dddZe6ejdddZe6ejdddZejdddZe6e6e4e4e4e4e6ddd Ze$dd!d"Ze.j/e4e%je d#d$d%Ze4dd#d&d'Ze.j/d(d) Ze6e%j&e6 e%je%j&e_ e%j&ej e%j'ej f dd*d+Ze6e%j&e6 edd,d-Ze%j&e6 e%j&e e%j&ej e%j&e%j'e  eje6d.d/d0Ze$dd1d2Ze6ed3d4d5Ze$dd6d7Ze6e%j'ej dd8d9Ze6e%j'ej dd:d;Zd<d= Ze%j'ej ejd>d?d@Zejeje%j'ej e6dAdBdCZdS (G  Backendz)
    OpenSSL API binding interfaces.
    Zopenssls   aes-128-ccms   aes-192-ccms   aes-256-ccms   aes-128-gcms   aes-192-gcms   aes-256-gcm   i     c                 C   s   t  | _| jj| _| jj| _d| _|  | _	i | _
|   | j	rX| jjrXtdt n|   | jjg| _| jjr| j| jj d S )NFz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r%   ZBinding_bindingffi_ffilib_lib_rsa_skip_check_key_is_fips_enabled_fips_enabled_cipher_registry_register_default_ciphers"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEwarningswarnUserWarningactivate_osrandom_engineZEVP_PKEY_DH	_dh_typesCryptography_HAS_EVP_PKEY_DHXappendZEVP_PKEY_DHXselfr]   r]   r^   __init__   s     



zBackend.__init__)returnc                 C   s   d |  | jS )Nz'<OpenSSLBackend(version: {}, FIPS: {})>)formatopenssl_version_textri   rt   r]   r]   r^   __repr__   s     zBackend.__repr__N)okerrorsrw   c                 C   s   t j| j||dS )N)r|   )r%   Z_openssl_assertrf   )ru   r{   r|   r]   r]   r^   openssl_assert   s    zBackend.openssl_assertc                 C   sH   | j jr| j | jj}nt| j ddd  }|dkr@| j   t|S )NZ	FIPS_modec                   S   s   dS Nr   r]   r]   r]   r]   r^   <lambda>       z*Backend._is_fips_enabled.<locals>.<lambda>r   )rf   ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrd   NULLgetattrZERR_clear_errorbool)ru   moder]   r]   r^   rh      s    
zBackend._is_fips_enabledc                 C   s$   | j   |  st|  | _d S N)rb   _enable_fipsrh   AssertionErrorri   rt   r]   r]   r^   r      s    
zBackend._enable_fipsc                 C   sf   | j jrb| j  }|| jjkrb| j | | j | jj}| |dk | j |}| |dk d S Nra   )	rf   rl   ZENGINE_get_default_RANDrd   r   ZENGINE_unregister_RANDRAND_set_rand_methodr}   ENGINE_finishru   eresr]   r]   r^   activate_builtin_random   s    
zBackend.activate_builtin_randomc              
   c   s   | j | j j}| || jjk | j |}| |dk z
|V  W 5 | j |}| |dk | j |}| |dk X d S r   )	rf   ZENGINE_by_idZCryptography_osrandom_engine_idr}   rd   r   ZENGINE_initZENGINE_freer   r   r]   r]   r^   _get_osurandom_engine   s    
zBackend._get_osurandom_enginec              	   C   s`   | j jr\|   |   }| j |}| |dk W 5 Q R X | j | jj}| |dk d S r   )	rf   rl   r   r   ZENGINE_set_default_RANDr}   r   rd   r   r   r]   r]   r^   rp     s    
z Backend.activate_osrandom_enginec              	   C   s`   | j dd}|  2}| j|dt||| j jd}| |dk W 5 Q R X | j |	dS )Nchar[]@   s   get_implementationr   ascii)
rd   newr   rf   ZENGINE_ctrl_cmdlenr   r}   stringdecode)ru   bufr   r   r]   r]   r^   osrandom_engine_implementation  s    
     z&Backend.osrandom_engine_implementationc                 C   s   | j | j| jjdS )z
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r   )rd   r   rf   ZOpenSSL_versionOPENSSL_VERSIONr   rt   r]   r]   r^   ry   #  s
    zBackend.openssl_version_textc                 C   s
   | j  S r   )rf   ZOpenSSL_version_numrt   r]   r]   r^   openssl_version_number.  s    zBackend.openssl_version_number)key	algorithmrw   c                 C   s   t | ||S r   r   )ru   r   r   r]   r]   r^   create_hmac_ctx1  s    zBackend.create_hmac_ctx)r   c                 C   sL   |j dks|j dkr0d|j |jd d}n|j d}| j|}|S )Nblake2bblake2sz{}{}   r   )namerx   digest_sizeencoderf   ZEVP_get_digestbyname)ru   r   Zalgevp_mdr]   r]   r^   _evp_md_from_algorithm6  s     zBackend._evp_md_from_algorithmc                 C   s    |  |}| || jjk |S r   )r   r}   rd   r   ru   r   r   r]   r]   r^   _evp_md_non_null_from_algorithmA  s    
z'Backend._evp_md_non_null_from_algorithm)r   rw   c                 C   s,   | j rt|| jsdS | |}|| jjkS NF)ri   
isinstance_fips_hashesr   rd   r   r   r]   r]   r^   hash_supportedF  s    
zBackend.hash_supportedc                 C   s    | j rt|tjrdS | |S r   ri   r   r&   SHA1r   ru   r   r]   r]   r^   signature_hash_supportedM  s    z Backend.signature_hash_supportedc                 C   s   | j r
dS | jjdkS d S NFra   )ri   rf   ZCryptography_HAS_SCRYPTrt   r]   r]   r^   scrypt_supportedV  s    zBackend.scrypt_supportedc                 C   s    | j rt|tjrdS | |S )NTr   r   r]   r]   r^   hmac_supported\  s    zBackend.hmac_supportedc                 C   s
   t | |S r   r   r   r]   r]   r^   create_hash_ctxc  s    zBackend.create_hash_ctx)cipherr   rw   c                 C   s`   | j rt|| jsdS z| jt|t|f }W n tk
rF   Y dS X || ||}| jj|kS r   )ri   r   _fips_ciphersrj   typeKeyErrorrd   r   )ru   r   r   adapter
evp_cipherr]   r]   r^   cipher_supportedh  s    zBackend.cipher_supportedc                 C   s0   ||f| j krtd|||| j ||f< d S )Nz"Duplicate registration for: {} {}.)rj   
ValueErrorrx   )ru   
cipher_clsmode_clsr   r]   r]   r^   register_cipher_adapterv  s     zBackend.register_cipher_adapterc                 C   s  t ttfD ].}ttttttt	fD ]}| 
||td q q
tttttfD ]}| 
t|td qHttttfD ]}| 
t|td ql| 
tttd ttttfD ]}| 
t|td qttttfD ]}| 
t|td qtttgttttgD ]\}}| 
||td q| 
ttd td | 
ttd td | 
ttd td	 | 
t tt tttttfD ]}| 
t|td
 qpd S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20zsm4-{mode.name})r:   r;   r<   rF   rI   rJ   rM   rG   rH   rK   r   GetCipherByNamer>   rA   rB   rE   	itertoolsproductrC   rD   r=   r   rY   r?   rN   _get_xts_cipherr@   )ru   r   r   r]   r]   r^   rk     sz            
    z!Backend._register_default_ciphersc                 C   s   t | ||t jS r   )r   Z_ENCRYPTru   r   r   r]   r]   r^   create_symmetric_encryption_ctx  s    z'Backend.create_symmetric_encryption_ctxc                 C   s   t | ||t jS r   )r   Z_DECRYPTr   r]   r]   r^   create_symmetric_decryption_ctx  s    z'Backend.create_symmetric_decryption_ctxc                 C   s
   |  |S r   )r   r   r]   r]   r^   pbkdf2_hmac_supported  s    zBackend.pbkdf2_hmac_supported)r   lengthsalt
iterationskey_materialrw   c           
   
   C   sh   | j d|}| |}| j |}| j|t||t|||||}	| |	dk | j |d d  S )Nunsigned char[]ra   )	rd   r   r   from_bufferrf   ZPKCS5_PBKDF2_HMACr   r}   buffer)
ru   r   r   r   r   r   r   r   key_material_ptrr   r]   r]   r^   derive_pbkdf2_hmac  s    

zBackend.derive_pbkdf2_hmacc                 C   s   t | jS r   )r%   _consume_errorsrf   rt   r]   r]   r^   r     s    zBackend._consume_errorsc                 C   s   t | jS r   )r%   _consume_errors_with_textrf   rt   r]   r]   r^   r     s    z!Backend._consume_errors_with_textc                 C   sz   || j jkst| | j|  | j|}| j d|}| j||}| |dk t	
| j |d | d}|S )Nr   r   big)rd   r   r   r}   rf   ZBN_is_negativeZBN_num_bytesr   Z	BN_bn2binint
from_bytesr   )ru   bnZbn_num_bytesZbin_ptrZbin_lenvalr]   r]   r^   
_bn_to_int  s    zBackend._bn_to_int)numc                 C   sn   |dks|| j jkst|dkr(| j j}|t| d d d}| j|t||}| 	|| j jk |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @ra   r   )
rd   r   r   to_bytesr   
bit_lengthrf   Z	BN_bin2bnr   r}   )ru   r   r   binaryZbn_ptrr]   r]   r^   
_int_to_bn  s    zBackend._int_to_bn)public_exponentkey_sizerw   c                 C   s   t || | j }| || jjk | j|| jj}| 	|}| j|| jj
}| j|||| jj}| |dk | |}t| ||| jS r   )r.   Z_verify_rsa_parametersrf   RSA_newr}   rd   r   gcRSA_freer   BN_freeZRSA_generate_key_ex_rsa_cdata_to_evp_pkeyr   rg   )ru   r   r   	rsa_cdatar   r   evp_pkeyr]   r]   r^   generate_rsa_private_key  s(    

   
   z Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )N   ra   r   i   r]   )ru   r   r   r]   r]   r^   !generate_rsa_parameters_supported  s
    
z)Backend.generate_rsa_parameters_supported)numbersrw   c              
   C   s6  t |j|j|j|j|j|j|jj	|jj
 | j }| || jjk | j|| jj}| |j}| |j}| |j}| |j}| |j}| |j}| |jj	}	| |jj
}
| j|||}| |dk | j||
|	|}| |dk | j||||}| |dk | |}t| ||| jS r   )r.   Z_check_private_key_componentspqddmp1dmq1iqmppublic_numbersr   nrf   r   r}   rd   r   r   r   r   ZRSA_set0_factorsRSA_set0_keyZRSA_set0_crt_paramsr   r   rg   )ru   r   r   r   r   r   r   r   r   r   r   r   r   r]   r]   r^   load_rsa_private_numbers  sD    


   z Backend.load_rsa_private_numbersc                 C   s   t |j|j | j }| || jjk | j	|| jj
}| |j}| |j}| j|||| jj}| |dk | |}t| ||S r   )r.   Z_check_public_key_componentsr   r   rf   r   r}   rd   r   r   r   r   r   r   r    )ru   r   r   r   r   r   r   r]   r]   r^   load_rsa_public_numbers@  s    

zBackend.load_rsa_public_numbersc                 C   s2   | j  }| || jjk | j|| j j}|S r   )rf   ZEVP_PKEY_newr}   rd   r   r   EVP_PKEY_freeru   r   r]   r]   r^   _create_evp_pkey_gcO  s    
zBackend._create_evp_pkey_gcc                 C   s(   |   }| j||}| |dk |S r   )r   rf   ZEVP_PKEY_set1_RSAr}   )ru   r   r   r   r]   r]   r^   r   U  s    zBackend._rsa_cdata_to_evp_pkey)datac                 C   sH   | j |}| j|t|}| || j jk t| j || jj	|S )z
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rd   r   rf   ZBIO_new_mem_bufr   r}   r   rW   r   BIO_free)ru   r   data_ptrrX   r]   r]   r^   _bytes_to_bio[  s    zBackend._bytes_to_bioc                 C   sP   | j  }| || jjk | j |}| || jjk | j|| j j}|S )z.
        Creates an empty memory BIO.
        )rf   Z	BIO_s_memr}   rd   r   ZBIO_newr   r   )ru   Z
bio_methodrX   r]   r]   r^   _create_mem_bio_gch  s    
zBackend._create_mem_bio_gcc                 C   s\   | j d}| j||}| |dk | |d | j jk | j |d |dd }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rd   r   rf   ZBIO_get_mem_datar}   r   r   )ru   rX   r   Zbuf_lenbio_datar]   r]   r^   _read_mem_bios  s    zBackend._read_mem_bioc           	      C   sD  | j |}|| j jkrX| j |}| || jjk | j|| j j}t	| ||| j
S || j jkr| j js| j js| j js| j |}| || jjk | j|| j j}|  }| j ||}| |dk | j| |ddS || j jkr.| j |}| || jjk | j|| j j}t| ||S || j jkrx| j |}| || jjk | j|| j j}t| ||S || jkr| j |}| || jjk | j|| j j}t| ||S |t| j ddkrt | |S |t| j ddkrt!| |S |t| j ddkrt"| |S |t| j ddkr8t#| |S t$ddS )	zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ra   N)passwordEVP_PKEY_ED25519EVP_PKEY_X448EVP_PKEY_X25519EVP_PKEY_ED448Unsupported key type.)%rf   EVP_PKEY_idEVP_PKEY_RSAEVP_PKEY_get1_RSAr}   rd   r   r   r   r   rg   EVP_PKEY_RSA_PSSCRYPTOGRAPHY_IS_LIBRESSLCRYPTOGRAPHY_IS_BORINGSSL#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Er   i2d_RSAPrivateKey_bioload_der_private_keyr   EVP_PKEY_DSAEVP_PKEY_get1_DSADSA_freer   EVP_PKEY_ECEVP_PKEY_get1_EC_KEYEC_KEY_freer   rq   EVP_PKEY_get1_DHDH_freer   r   r   r#   r!   r   r   )	ru   r   key_typer   rX   r   	dsa_cdataec_cdatadh_cdatar]   r]   r^   _evp_pkey_to_private_key~  sj       

 



z Backend._evp_pkey_to_private_keyc           
      C   sJ  | j |}|| j jkrT| j |}| || jjk | j|| j j}t	| ||S || j j
kr| j js| j js| j js| j |}| || jjk | j|| j j}|  }| j ||}| |dk | | |S || j jkr&| j |}| || jjk | j|| j j}t| ||S || j jkr~| j |}|| jjkr`|  }td|| j|| j j}t| ||S || jkr| j |}	| |	| jjk | j|	| j j}	t| |	|S |t | j ddkrt!| |S |t | j ddkrt"| |S |t | j ddkr t#| |S |t | j ddkr>t$| |S t%ddS )	zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        ra   zUnable to load EC keyr   Nr  r  r  r  )&rf   r  r  r  r}   rd   r   r   r   r    r  r	  r
  r  r   i2d_RSAPublicKey_bioload_der_public_keyr   r  r  r  r   r  r  r   r   r  r   rq   r  r  r   r   r   r$   r"   r   r   )
ru   r   r  r   rX   r   r  r  r|   r  r]   r]   r^   _evp_pkey_to_public_key  s^    





zBackend._evp_pkey_to_public_keyc                 C   s   t |tjtjtjtjtjfS r   )r   r&   r   SHA224SHA256SHA384SHA512r   r]   r]   r^   _oaep_hash_supported  s    zBackend._oaep_hash_supported)paddingrw   c                 C   s   t |trdS t |trNt |jtrN| jr>t |jjtjr>dS | 	|jjS n4t |t
r~t |jtr~| |jjo|| |jS dS d S )NTF)r   r3   r4   Z_mgfr1   ri   
_algorithmr&   r   r   r2   r"  )ru   r#  r]   r]   r^   rsa_padding_supported  s     
 
zBackend.rsa_padding_supported)r   rw   c              	   C   s~   |dkrt d| j }| || jjk | j|| jj}| j||| jjd| jj| jj| jj}| |dk t	| |S )N)i   r`   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   ra   )
r   rf   DSA_newr}   rd   r   r   r  ZDSA_generate_parameters_exr   )ru   r   ctxr   r]   r]   r^   generate_dsa_parameters  s$    

zBackend.generate_dsa_parameters)
parametersrw   c                 C   sT   | j |j}| || jjk | j|| j j}| j | | 	|}t
| ||S r   )rf   ZDSAparams_dupZ
_dsa_cdatar}   rd   r   r   r  ZDSA_generate_key_dsa_cdata_to_evp_pkeyr   )ru   r)  r'  r   r]   r]   r^   generate_dsa_private_key/  s    
z Backend.generate_dsa_private_keyc                 C   s   |  |}| |S r   )r(  r+  )ru   r   r)  r]   r]   r^   'generate_dsa_private_key_and_parameters<  s    
z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j ||||}| |dk | j |||}| |dk d S r   )rf   DSA_set0_pqgr}   ZDSA_set0_key)ru   r  r   r   gpub_keypriv_keyr   r]   r]   r^   _dsa_cdata_set_valuesB  s    zBackend._dsa_cdata_set_valuesc           
      C   s   t | |jj}| j }| || jjk | j	|| jj
}| |j}| |j}| |j}| |jj}| |j}| |||||| | |}	t| ||	S r   )r*   Z_check_dsa_private_numbersr   parameter_numbersrf   r&  r}   rd   r   r   r  r   r   r   r.  yxr1  r*  r   )
ru   r   r2  r  r   r   r.  r/  r0  r   r]   r]   r^   load_dsa_private_numbersH  s    


z Backend.load_dsa_private_numbersc           	      C   s   t |j | j }| || jjk | j|| jj	}| 
|jj}| 
|jj}| 
|jj}| 
|j}| jj}| |||||| | |}t| ||S r   )r*   _check_dsa_parametersr2  rf   r&  r}   rd   r   r   r  r   r   r   r.  r3  r1  r*  r   )	ru   r   r  r   r   r.  r/  r0  r   r]   r]   r^   load_dsa_public_numbers]  s    

zBackend.load_dsa_public_numbersc                 C   s   t | | j }| || jjk | j|| jj}| 	|j
}| 	|j}| 	|j}| j||||}| |dk t| |S r   )r*   r6  rf   r&  r}   rd   r   r   r  r   r   r   r.  r-  r   )ru   r   r  r   r   r.  r   r]   r]   r^   load_dsa_parameter_numbersp  s    

z"Backend.load_dsa_parameter_numbersc                 C   s(   |   }| j||}| |dk |S r   )r   rf   ZEVP_PKEY_set1_DSAr}   )ru   r  r   r   r]   r]   r^   r*    s    zBackend._dsa_cdata_to_evp_pkeyc                 C   s   | j  S r   )ri   rt   r]   r]   r^   dsa_supported  s    zBackend.dsa_supportedc                 C   s   |   sdS | |S r   )r9  r   r   r]   r]   r^   dsa_hash_supported  s    zBackend.dsa_hash_supportedc                 C   s   |  |td|j S )N    )r   rF   
block_sizer   r]   r]   r^   cmac_algorithm_supported  s     z Backend.cmac_algorithm_supportedc                 C   s
   t | |S r   r	   r   r]   r]   r^   create_cmac_ctx  s    zBackend.create_cmac_ctx)r   r   rw   c                 C   s   |  | jj| j||S r   )	_load_keyrf   ZPEM_read_bio_PrivateKeyr  )ru   r   r   r]   r]   r^   load_pem_private_key  s    zBackend.load_pem_private_key)r   rw   c                 C   s   |  |}| jd}| j|j| jj| j| jjd|}|| jjkrd| j	|| jj
}| |S |   | j|j}| |dk | j|j| jj| j| jjd|}|| jjkr| j	|| jj}| |}t| ||S |   d S )NCRYPTOGRAPHY_PASSWORD_DATA *Cryptography_pem_password_cbra   )r   rd   r   rf   ZPEM_read_bio_PUBKEYrX   r   	addressof_original_libr   r   r  r   	BIO_resetr}   ZPEM_read_bio_RSAPublicKeyr   r   r    _handle_key_loading_error)ru   r   mem_biouserdatar   r   r   r]   r]   r^   load_pem_public_key  s>    
 
 
zBackend.load_pem_public_keyc                 C   s^   |  |}| j|j| jj| jj| jj}|| jjkrR| j|| jj}t| |S | 	  d S r   )
r   rf   ZPEM_read_bio_DHparamsrX   rd   r   r   r  r   rF  )ru   r   rG  r  r]   r]   r^   load_pem_parameters  s    
   
zBackend.load_pem_parametersc                 C   s>   |  |}| ||}|r$| |S | | jj| j||S d S r   )r   "_evp_pkey_from_der_traditional_keyr  r?  rf   Zd2i_PKCS8PrivateKey_bio)ru   r   r   r   r   r]   r]   r^   r    s    

zBackend.load_der_private_keyc                 C   s^   | j |j| jj}|| jjkrN|   | j|| j j}|d k	rJtd|S |   d S d S )N4Password was given but private key is not encrypted.)	rf   d2i_PrivateKey_biorX   rd   r   r   r   r   	TypeError)ru   r   r   r   r]   r]   r^   rK    s    z*Backend._evp_pkey_from_der_traditional_keyc                 C   s   |  |}| j|j| jj}|| jjkrF| j|| jj}| |S | 	  | j
|j}| |dk | j|j| jj}|| jjkr| j|| jj}| |}t| ||S |   d S r   )r   rf   Zd2i_PUBKEY_biorX   rd   r   r   r   r  r   rE  r}   Zd2i_RSAPublicKey_bior   r   r    rF  )ru   r   rG  r   r   r   r]   r]   r^   r    s"    

 
zBackend.load_der_public_keyc                 C   s   |  |}| j|j| jj}|| jjkrF| j|| jj}t| |S | jj	r| 
  | j|j}| |dk | j|j| jj}|| jjkr| j|| jj}t| |S |   d S r   )r   rf   Zd2i_DHparams_biorX   rd   r   r   r  r   rr   r   rE  r}   ZCryptography_d2i_DHxparams_biorF  )ru   r   rG  r  r   r]   r]   r^   load_der_parameters  s"    

 
zBackend.load_der_parameters)certrw   c                 C   sT   | tjj}| |}| j|j| jj	}| 
|| jj	k | j|| jj}|S r   )public_bytesr'   EncodingDERr   rf   Zd2i_X509_biorX   rd   r   r}   r   	X509_free)ru   rP  r   rG  r   r]   r]   r^   
_cert2ossl)  s    
zBackend._cert2ossl)r   rw   c                 C   s4   |   }| j||}| |dk t| |S r   )r   rf   Zi2d_X509_bior}   	rust_x509Zload_der_x509_certificater   )ru   r   rX   r   r]   r]   r^   
_ossl2cert1  s    zBackend._ossl2cert)csrrw   c                 C   sT   | tjj}| |}| j|j| jj	}| 
|| jj	k | j|| jj}|S r   )rQ  r'   rR  rS  r   rf   Zd2i_X509_REQ_biorX   rd   r   r}   r   ZX509_REQ_free)ru   rX  r   rG  x509_reqr]   r]   r^   	_csr2ossl7  s    
zBackend._csr2ossl)rY  rw   c                 C   s4   |   }| j||}| |dk t| |S r   )r   rf   Zi2d_X509_REQ_bior}   rV  Zload_der_x509_csrr   )ru   rY  rX   r   r]   r]   r^   	_ossl2csr?  s    zBackend._ossl2csr)crlrw   c                 C   sT   | tjj}| |}| j|j| jj	}| 
|| jj	k | j|| jj}|S r   )rQ  r'   rR  rS  r   rf   Zd2i_X509_CRL_biorX   rd   r   r}   r   ZX509_CRL_free)ru   r\  r   rG  x509_crlr]   r]   r^   	_crl2osslG  s    
zBackend._crl2ossl)r]  rw   c                 C   s4   |   }| j||}| |dk t| |S r   )r   rf   Zi2d_X509_CRL_bior}   rV  Zload_der_x509_crlr   )ru   r]  rX   r   r]   r]   r^   	_ossl2crlO  s    zBackend._ossl2crl)r\  
public_keyrw   c                 C   sJ   t |tttfstd| |}| j||j}|dkrF| 	  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.ra   FT)
r   r   r    r   rN  r^  rf   ZX509_CRL_verify	_evp_pkeyr   )ru   r\  r`  r]  r   r]   r]   r^   _crl_is_signature_validW  s     
zBackend._crl_is_signature_validc                 C   s`   |  |}| j|}| || jjk | j|| jj}| j||}|dkr\| 	  dS dS )Nra   FT)
rZ  rf   ZX509_REQ_get_pubkeyr}   rd   r   r   r   ZX509_REQ_verifyr   )ru   rX  rY  Zpkeyr   r]   r]   r^   _csr_is_signature_validq  s    
zBackend._csr_is_signature_validc                 C   s"   | j |j|jdkrtdd S )Nra   zKeys do not correspond)rf   ZEVP_PKEY_cmpra  r   )ru   key1key2r]   r]   r^   _check_keys_correspond  s    zBackend._check_keys_correspondc           	      C   s&  |  |}| jd}|d k	rFtd| | j|}||_t||_||j	| jj
| j| jjd|}|| jj
kr|jdkr|   |jdkrtdq|jdksttd|jd	 n|   |   | j|| jj}|d k	r|jdkrtd
|d k	r|jd	ks|d kst||S )NrA  r   rB  r   z3Password was not given but private key is encryptedzAPasswords longer than {} bytes are not supported by this backend.ra   rL  )r   rd   r   r   _check_bytesliker   r   r   r   rX   r   rC  rf   rD  errorr   rN  r   r   rx   maxsizerF  r   r   called)	ru   Zopenssl_read_funcZconvert_funcr   r   rG  rH  Zpassword_ptrr   r]   r]   r^   r?    sV    

 	

zBackend._load_keyc                    s      }|stdn|d  jj jjsf|d  jj jjsf jjrp|d  jj	 jj
rptdn4t fdd|D rtdnt|}td|d S )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3   s"   | ]}|  jj jjV  qd S r   )_lib_reason_matchrf   ERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM).0rj  rt   r]   r^   	<genexpr>  s
   z4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.zCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r   r   rm  rf   rn  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZERR_LIB_PROVZPROV_R_BAD_DECRYPTanyr%   Z_errors_with_text)ru   r|   Zerrors_with_textr]   rt   r^   rF    s@     	



z!Backend._handle_key_loading_error)curverw   c                 C   sv   z|  |}W n tk
r*   | jj}Y nX | j|}|| jjkrP|   dS | || jjk | j	| dS d S )NFT)
_elliptic_curve_to_nidr   rf   	NID_undefZEC_GROUP_new_by_curve_namerd   r   r   r}   ZEC_GROUP_free)ru   rr  	curve_nidgroupr]   r]   r^   elliptic_curve_supported  s    z Backend.elliptic_curve_supported)signature_algorithmrr  rw   c                 C   s   t |tjsdS | |S r   )r   r+   ZECDSArw  )ru   rx  rr  r]   r]   r^   ,elliptic_curve_signature_algorithm_supported  s    z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   s\   |  |rD| |}| j|}| |dk | |}t| ||S td|j	t
jdS )z@
        Generate a new private key on the named curve.
        ra   z#Backend object does not support {}.N)rw  _ec_key_new_by_curverf   ZEC_KEY_generate_keyr}   _ec_cdata_to_evp_pkeyr   r   rx   r   r   UNSUPPORTED_ELLIPTIC_CURVE)ru   rr  r  r   r   r]   r]   r^   #generate_elliptic_curve_private_key  s    



z+Backend.generate_elliptic_curve_private_keyc                 C   sz   |j }| |j}| j| |j| jj}| j	||}|dkrR| 
  td| ||j|j | |}t| ||S )Nra   Invalid EC key.)r   rz  rr  rd   r   r   private_valuerf   BN_clear_freeEC_KEY_set_private_keyr   r   )_ec_key_set_public_key_affine_coordinatesr4  r3  r{  r   )ru   r   publicr  r  r   r   r]   r]   r^   #load_elliptic_curve_private_numbers  s"    
   
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |  |j}| ||j|j | |}t| ||S r   )rz  rr  r  r4  r3  r{  r   )ru   r   r  r   r]   r]   r^   "load_elliptic_curve_public_numbers0  s      
z*Backend.load_elliptic_curve_public_numbers)rr  point_bytesrw   c           	   	   C   s   |  |}| j|}| || jjk | j|}| || jjk | j|| jj}| 	 6}| j
|||t||}|dkr|   tdW 5 Q R X | j||}| |dk | |}t| ||S )Nra   z(Invalid public bytes for the given curve)rz  rf   EC_KEY_get0_groupr}   rd   r   EC_POINT_newr   EC_POINT_free_tmp_bn_ctxZEC_POINT_oct2pointr   r   r   EC_KEY_set_public_keyr{  r   )	ru   rr  r  r  rv  pointbn_ctxr   r   r]   r]   r^    load_elliptic_curve_public_bytes;  s*    

    
z(Backend.load_elliptic_curve_public_bytes)r  rr  rw   c              	   C   sN  |  |}| |\}}| j|}| || jjk | j|| jj}| 	|}| j|| jj
}|  r}| j|||| jj| jj|}	| |	dk | j|}
| j|}||||
||}	|	dkr|   tdW 5 Q R X | j||}	| |	dk | 	|}| j|| jj
}| j||}	| |	dk | |}t| ||S )Nra   z'Unable to derive key from private_value)rz   _ec_key_determine_group_get_funcrf   r  r}   rd   r   r   r  r   r  r  ZEC_POINT_mulZ
BN_CTX_getr   r   r  r  r{  r   )ru   r  rr  r  get_funcrv  r  valuer  r   Zbn_xZbn_yprivater   r]   r]   r^   !derive_elliptic_curve_private_keyQ  s>    


     

z)Backend.derive_elliptic_curve_private_key)rr  c                 C   s   |  |}| |S r   )rs  _ec_key_new_by_curve_nid)ru   rr  ru  r]   r]   r^   rz  x  s    
zBackend._ec_key_new_by_curve)ru  c                 C   s0   | j |}| || jjk | j|| j jS r   )rf   ZEC_KEY_new_by_curve_namer}   rd   r   r   r  )ru   ru  r  r]   r]   r^   r  |  s    z Backend._ec_key_new_by_curve_nid)r   rr  rw   c                 C   s,   | j rt|| jsdS | |o*t|tjS r   )ri   r   _fips_ecdh_curvesrw  r+   ECDH)ru   r   rr  r]   r]   r^   +elliptic_curve_exchange_algorithm_supported  s      z3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   s(   |   }| j||}| |dk |S r   )r   rf   ZEVP_PKEY_set1_EC_KEYr}   )ru   r  r   r   r]   r]   r^   r{    s    zBackend._ec_cdata_to_evp_pkeyc                 C   sN   ddd}| |j|j}| j| }|| jjkrJtd|jtj	|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z${} is not a supported elliptic curve)
getr   rf   
OBJ_sn2nidr   rt  r   rx   r   r|  )ru   rr  Zcurve_aliasesZ
curve_nameru  r]   r]   r^   rs    s    

zBackend._elliptic_curve_to_nidc              	   c   sX   | j  }| || jjk | j|| j j}| j | z
|V  W 5 | j | X d S r   )	rf   Z
BN_CTX_newr}   rd   r   r   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)ru   r  r]   r]   r^   r    s    

zBackend._tmp_bn_ctxc                 C   s   |  || jjk | jd}|  || jjk | j|}|  || jjk | j|}|  || jjk | j|}|  || jjk ||kr| jj	r| jj
}n| jj}|st||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r}   rd   r   rf   r  rt  r  ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFpr   )ru   r'  Znid_two_fieldrv  methodnidr  r]   r]   r^   r    s    
z(Backend._ec_key_determine_group_get_func)r4  r3  c                 C   st   |dk s|dk rt d| j| || jj}| j| || jj}| j|||}|dkrp|   t ddS )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.ra   r~  N)r   rd   r   r   rf   r   Z(EC_KEY_set_public_key_affine_coordinatesr   )ru   r'  r4  r3  r   r]   r]   r^   r    s    z1Backend._ec_key_set_public_key_affine_coordinates)encodingrx   encryption_algorithmrw   c           
      C   s`  t |tjstdt |tjs(tdt |tjs<tdt |tjrNd}nbt |tjrv|j}t	|dkrt
dn:t |tjr|j|  krtjjkrn n|j}nt
d|tjjkr|tjjkr| jj}n|tjjkr| jj}nt
d| |||S |tjjkr"| jr*t |tjs*t
d	| j|}	|tjjkr|	| jjkr\| jj}n8|	| jjkrt| jj}n |	| jjkr| jj}nt
d
| |||S |tjjkr|rt
d|	| jjkr| jj}n8|	| jjkr| jj}n |	| jjkr| jj }nt
d
| !||S t
d|tjjkrT|tjjkrLt"#|||S t
dt
dd S )N/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancer   i  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingformat is invalid with this key)$r   r'   rR  rN  PrivateFormatKeySerializationEncryptionNoEncryptionBestAvailableEncryptionr   r   r   _KeySerializationEncryption_formatOpenSSHZPKCS8PEMrf   ZPEM_write_bio_PKCS8PrivateKeyrS  Zi2d_PKCS8PrivateKey_bio_private_key_bytes_via_bioZTraditionalOpenSSLri   r  r  ZPEM_write_bio_RSAPrivateKeyr  ZPEM_write_bio_DSAPrivateKeyr  ZPEM_write_bio_ECPrivateKeyr  Zi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bio_bio_func_outputrQ   Z_serialize_ssh_private_key)
ru   r  rx   r  r   r   cdatar   	write_bior  r]   r]   r^   _private_key_bytes  s    
   


  
 


  


  zBackend._private_key_bytesc              	   C   s<   |s| j j}n| jd}| ||||t|| j j| j jS )Ns   aes-256-cbc)rd   r   rf   EVP_get_cipherbynamer  r   )ru   r  r   r   r   r]   r]   r^   r  W  s    
z"Backend._private_key_bytes_via_bioc                 G   s.   |   }||f| }| |dk | |S r   )r   r}   r   )ru   r  argsrX   r   r]   r]   r^   r  h  s    zBackend._bio_func_output)r  rx   rw   c                 C   s  t |tjstdt |tjs(td|tjjkrt|tjjkrJ| jj}n|tjj	kr`| jj
}ntd| ||S |tjjkr| j|}|| jjkrtd|tjjkr| jj}n|tjj	kr| jj}ntd| ||S |tjjkr|tjjkrt|S tdtdd S )Nr  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingr  )r   r'   rR  rN  PublicFormatZSubjectPublicKeyInfor  rf   ZPEM_write_bio_PUBKEYrS  Zi2d_PUBKEY_bior   r  ZPKCS1r  r  ZPEM_write_bio_RSAPublicKeyr  r  rQ   Zserialize_ssh_public_key)ru   r  rx   r   r   r  r  r  r]   r]   r^   _public_key_bytesn  s@    




zBackend._public_key_bytesc                 C   s
   | j j S r   rf   r
  rt   r]   r]   r^   dh_supported  s    zBackend.dh_supported)	generatorr   rw   c                 C   s   |t jk rtdt j|dkr*td| j }| || jjk | j	|| jj
}| j|||| jj}| |dk t| |S )Nz$DH key_size must be at least {} bits)      zDH generator must be 2 or 5ra   )r)   Z_MIN_MODULUS_SIZEr   rx   rf   DH_newr}   rd   r   r   r  ZDH_generate_parameters_exr   )ru   r  r   Zdh_param_cdatar   r]   r]   r^   generate_dh_parameters  s&    

   zBackend.generate_dh_parametersc                 C   s(   |   }| j||}| |dk |S r   )r   rf   ZEVP_PKEY_set1_DHr}   )ru   r  r   r   r]   r]   r^   _dh_cdata_to_evp_pkey  s    zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| }| j|}| |dk | |}t| ||S r   )r   Z	_dh_cdatarf   ZDH_generate_keyr}   r  r   )ru   r)  Zdh_key_cdatar   r   r]   r]   r^   generate_dh_private_key  s     
zBackend.generate_dh_private_keyc                 C   s   |  | ||S r   )r  r  )ru   r  r   r]   r]   r^   &generate_dh_private_key_and_parameters  s    
z.Backend.generate_dh_private_key_and_parametersc                 C   s>  |j j}| j }| || jjk | j|| jj}| 	|j
}| 	|j}|jd k	rf| 	|j}n| jj}| 	|j j}| 	|j}| j||||}	| |	dk | j|||}	| |	dk | jdd}
| j||
}	| |	dk |
d dkr(|jdkr |
d | jjA dks(td| |}t| ||S )Nra   int[]r   r  z.DH private numbers did not pass safety checks.)r   r2  rf   r  r}   rd   r   r   r  r   r   r.  r   r3  r4  DH_set0_pqgDH_set0_keyr   Cryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr   r  r   )ru   r   r2  r  r   r.  r   r/  r0  r   codesr   r]   r]   r^   load_dh_private_numbers  s4    



zBackend.load_dh_private_numbersc           
      C   s   | j  }| || jjk | j|| j j}|j}| |j	}| |j
}|jd k	rd| |j}n| jj}| |j}| j ||||}| |dk | j ||| jj}| |dk | |}	t| ||	S r   )rf   r  r}   rd   r   r   r  r2  r   r   r.  r   r3  r  r  r  r   )
ru   r   r  r2  r   r.  r   r/  r   r   r]   r]   r^   load_dh_public_numbers  s     


zBackend.load_dh_public_numbersc                 C   s   | j  }| || jjk | j|| j j}| |j}| |j	}|j
d k	r^| |j
}n| jj}| j ||||}| |dk t| |S r   )rf   r  r}   rd   r   r   r  r   r   r.  r   r  r   )ru   r   r  r   r.  r   r   r]   r]   r^   load_dh_parameter_numbers(  s    

z!Backend.load_dh_parameter_numbers)r   r.  r   rw   c                 C   s   | j  }| || jjk | j|| j j}| |}| |}|d k	rV| |}n| jj}| j ||||}| |dk | j	dd}| j 
||}| |dk |d dkS )Nra   r  r   )rf   r  r}   rd   r   r   r  r   r  r   r  )ru   r   r.  r   r  r   r  r]   r]   r^   dh_parameters_supported<  s    


zBackend.dh_parameters_supportedc                 C   s   | j jdkS r   )rf   rr   rt   r]   r]   r^   dh_x942_serialization_supportedT  s    z'Backend.dh_x942_serialization_supportedc                 C   sh   t |dkrtd|  }| j|| jj}| |dk | j||t |}| |dk t| |S )N    z%An X25519 public key is 32 bytes longra   )	r   r   r   rf   ZEVP_PKEY_set_type
NID_X25519r}   ZEVP_PKEY_set1_tls_encodedpointr"   )ru   r   r   r   r]   r]   r^   x25519_load_public_bytesW  s      z Backend.x25519_load_public_bytesc              	   C   s   t |dkrtdd}| d<}||dd< ||dd < | |}| j|j| jj}W 5 Q R X | 	|| jjk | j
|| jj}| 	| j|| jjk t| |S )Nr  z&An X25519 private key is 32 bytes longs   0. 0+en" 0   r      )r   r   _zeroed_bytearrayr   rf   rM  rX   rd   r   r}   r   r   r  r  r!   )ru   r   Zpkcs8_prefixbarX   r   r]   r]   r^   x25519_load_private_bytesf  s    
z!Backend.x25519_load_private_bytesc                 C   s   | j || jj}| || jjk | j|| j j}| j |}| |dk | jd}| j 	||}| |dk | |d | jjk | j|d | j j
}|S )Nra   EVP_PKEY **r   )rf   ZEVP_PKEY_CTX_new_idrd   r   r}   r   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr   ZEVP_PKEY_keygenr   )ru   r  Zevp_pkey_ctxr   Z	evp_ppkeyr   r]   r]   r^   _evp_pkey_keygen_gc  s    zBackend._evp_pkey_keygen_gcc                 C   s   |  | jj}t| |S r   )r  rf   r  r!   r   r]   r]   r^   x25519_generate_key  s    zBackend.x25519_generate_keyc                 C   s   | j r
dS | jj S r   )ri   rf   r	  rt   r]   r]   r^   x25519_supported  s    zBackend.x25519_supportedc                 C   s`   t |dkrtd| j| jj| jj|t |}| || jjk | j|| jj	}t
| |S )N8   z#An X448 public key is 56 bytes long)r   r   rf   EVP_PKEY_new_raw_public_keyNID_X448rd   r   r}   r   r   r$   ru   r   r   r]   r]   r^   x448_load_public_bytes  s       zBackend.x448_load_public_bytesc                 C   sl   t |dkrtd| j|}| j| jj| jj|t |}| || jjk | j	|| jj
}t| |S )Nr  z$An X448 private key is 56 bytes long)r   r   rd   r   rf   EVP_PKEY_new_raw_private_keyr  r   r}   r   r   r#   ru   r   r   r   r]   r]   r^   x448_load_private_bytes  s       zBackend.x448_load_private_bytesc                 C   s   |  | jj}t| |S r   )r  rf   r  r#   r   r]   r]   r^   x448_generate_key  s    zBackend.x448_generate_keyc                 C   s   | j r
dS | jj o| jj S r   )ri   rf   Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r
  rt   r]   r]   r^   x448_supported  s
    
zBackend.x448_supportedc                 C   s   | j r
dS | jj S r   )ri   rf   #CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Brt   r]   r]   r^   ed25519_supported  s    zBackend.ed25519_supportedc                 C   sn   t d| t|tjkr"td| j| jj| j	j
|t|}| || j	j
k | j	|| jj}t| |S )Nr   z&An Ed25519 public key is 32 bytes long)r   _check_bytesr   r,   _ED25519_KEY_SIZEr   rf   r  NID_ED25519rd   r   r}   r   r   r   r  r]   r]   r^   ed25519_load_public_bytes  s       z!Backend.ed25519_load_public_bytesc                 C   sz   t |tjkrtdtd| | j|}| j	| jj
| jj|t |}| || jjk | j|| jj}t| |S )Nz'An Ed25519 private key is 32 bytes longr   )r   r,   r  r   r   ri  rd   r   rf   r  r  r   r}   r   r   r   r  r]   r]   r^   ed25519_load_private_bytes  s       z"Backend.ed25519_load_private_bytesc                 C   s   |  | jj}t| |S r   )r  rf   r  r   r   r]   r]   r^   ed25519_generate_key  s    zBackend.ed25519_generate_keyc                 C   s   | j r
dS | jj o| jj S r   )ri   rf   r  r
  rt   r]   r]   r^   ed448_supported  s
    
zBackend.ed448_supportedc                 C   sl   t d| t|tkr td| j| jj| jj	|t|}| 
|| jj	k | j|| jj}t| |S )Nr   z$An Ed448 public key is 57 bytes long)r   r  r   r   r   rf   r  	NID_ED448rd   r   r}   r   r   r   r  r]   r]   r^   ed448_load_public_bytes  s       zBackend.ed448_load_public_bytesc                 C   sx   t d| t|tkr td| j|}| j| jj	| jj
|t|}| || jj
k | j|| jj}t| |S )Nr   z%An Ed448 private key is 57 bytes long)r   ri  r   r   r   rd   r   rf   r  r  r   r}   r   r   r   r  r]   r]   r^   ed448_load_private_bytes  s       z Backend.ed448_load_private_bytesc                 C   s   |  | jj}t| |S r   )r  rf   r  r   r   r]   r]   r^   ed448_generate_key  s    zBackend.ed448_generate_key)r   r   r   r   rr   rw   c                 C   s   | j d|}| j |}| j|t||t||||tj||
}	|	dkrr|  }
d| | d }t	d
||
| j |d d  S )Nr   ra      i   zJNot enough memory to derive key. These parameters require {} MB of memory.)rd   r   r   rf   ZEVP_PBE_scryptr   rO   Z
_MEM_LIMITr   MemoryErrorrx   r   )ru   r   r   r   r   r  r   r   r   r   r|   Z
min_memoryr]   r]   r^   derive_scrypt  s0    	zBackend.derive_scryptc                 C   sL   t |}| jr|| jkrdS |dr4| jjdkS | j|| jj	kS d S )NFs   -sivra   )
r   Z_aead_cipher_nameri   
_fips_aeadendswithrf   #CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr  rd   r   )ru   r   cipher_namer]   r]   r^   aead_cipher_supported6  s    

zBackend.aead_cipher_supported)r   rw   c              
   c   s&   t |}z
|V  W 5 | || X dS )z
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)	bytearray
_zero_data)ru   r   r  r]   r]   r^   r  D  s    
zBackend._zeroed_bytearrayc                 C   s   t |D ]}d||< qd S r~   )range)ru   r   r   ir]   r]   r^   r  Q  s    zBackend._zero_datac                 c   sf   |dkr| j jV  nNt|}| j d|d }| j ||| z
|V  W 5 | | j d|| X dS )a  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr   ra   z	uint8_t *)rd   r   r   r   memmover  cast)ru   r   Zdata_lenr   r]   r]   r^   _zeroed_null_terminated_bufX  s    
z#Backend._zeroed_null_terminated_bufc                 C   s2   |  ||}|j|jr|jjnd dd |jD fS )Nc                 S   s   g | ]
}|j qS r]   )certificatero  rP  r]   r]   r^   
<listcomp>z  s     zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)load_pkcs12r   rP  r  Zadditional_certs)ru   r   r   Zpkcs12r]   r]   r^   %load_key_and_certificates_from_pkcs12o  s
    z-Backend.load_key_and_certificates_from_pkcs12c              	   C   sv  |d k	rt d| | |}| j|j| jj}|| jjkrN|   t	d| j
|| jj}| jd}| jd}| jd}| |}| j|||||}	W 5 Q R X | jjr|   |	dkr|   t	dd }
d }g }|d | jjkr| j
|d | jj}| |}|d | jjkr| j
|d | jj}| |}d }| j|| jj}|| jjkrv| j|}t||}
|d | jjkrj| j
|d | jj}| j|d }| jjs| jjrt|}ntt|}|D ]}| j||}| || jjk | j
|| jj}| |}d }| j|| jj}|| jjkrV| j|}|t|| qt ||
|S )Nr   z!Could not deserialize PKCS12 datar  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data)!r   ri  r   rf   Zd2i_PKCS12_biorX   rd   r   r   r   r   PKCS12_freer   r  ZPKCS12_parseZ#CRYPTOGRAPHY_LIBRESSL_LESS_THAN_340r   r  rT  rW  ZX509_alias_get0r   rS   sk_X509_freesk_X509_numr  r
  r  reversedsk_X509_valuer}   rs   rT   )ru   r   r   rX   p12Zevp_pkey_ptrZx509_ptrZsk_x509_ptrpassword_bufr   rP  r   Zadditional_certificatesr   r   Zcert_objr   Z
maybe_namesk_x509r   indicesr  Z	addl_certZ	addl_namer]   r]   r^   r  }  sx    
    




zBackend.load_pkcs12)r   r   rP  casr  rw   c                 C   sX  d }|d k	rt d| t|tjr@d}d}d}	d}
| jj}nDt|tjr| jj	rf| jj
}| jj
}n| jj}| jj}d}	d}
| jj}|j}nt|tjr||jtjjkr|d}d}d}	d}
|j}|j}|tjkr| jj}| jj}n>|tjkr| jj	std| jj
}| jj
}n|d ks"t|jd k	r`| jjs@td| |j}| || jjk n| jj}|jd k	r|j}	ntd|d kst|dkr| jj}n| j }| j|| jj }g }|D ]}t|t!r"|j"}| #|j$}| %|$}| j&||d}| |dk W 5 Q R X n
| #|}|'| | j(||}t)|dk q| %|}| %|V}|r~| #|n| jj}|d k	r|j*}n| jj}| j+||||||||	|
d
}W 5 Q R X | jjr|| jjkr| j,||d| jjd|
| W 5 Q R X | || jjk | j|| jj-}| . }| j/||}| |dk | 0|S )	Nr   rg  r   i N  ra   z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption type)1r   r  r   r'   r  rd   r   r  rf   r  ZNID_aes_256_cbcZ&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr   r  r  r  ZPKCS12Z_key_cert_algorithmrR   ZPBESv1SHA1And3KeyTripleDESCBCZPBESv2SHA256AndAES256CBCr   r   Z
_hmac_hashZCryptography_HAS_PKCS12_SET_MACr   r}   Z_kdf_roundsr   r   sk_X509_new_nullr   r  rS   Zfriendly_namerU  r  r  ZX509_alias_set1rs   sk_X509_pushbackendra  ZPKCS12_createZPKCS12_set_macr  r   Zi2d_PKCS12_bior   )ru   r   r   rP  r  r  r   Znid_certZnid_keyZpkcs12_iterZmac_iterZmac_algZ
keycertalgr  Zossl_cascaZca_aliasZossl_caZca_name_bufr   r  Zname_buf	ossl_certr   r  rX   r]   r]   r^   (serialize_key_and_certificates_to_pkcs12  s     
 	






  




z0Backend.serialize_key_and_certificates_to_pkcs12c                 C   s   | j r
dS | jjdkS r   )ri   rf   ZCryptography_HAS_POLY1305rt   r]   r]   r^   poly1305_supportedg	  s    zBackend.poly1305_supported)r   rw   c                 C   s*   t d| t|tkr tdt| |S )Nr   zA poly1305 key is 32 bytes long)r   ri  r   r   r   r   )ru   r   r]   r]   r^   create_poly1305_ctxl	  s    zBackend.create_poly1305_ctxc                 C   s
   | j j S r   r  rt   r]   r]   r^   pkcs7_supporteds	  s    zBackend.pkcs7_supportedc                 C   sn   t d| | |}| j|j| jj| jj| jj}|| jjkrR|   t	d| j
|| jj}| |S Nr   zUnable to parse PKCS7 data)r   r  r   rf   ZPEM_read_bio_PKCS7rX   rd   r   r   r   r   
PKCS7_free_load_pkcs7_certificatesru   r   rX   p7r]   r]   r^   load_pem_pkcs7_certificatesv	  s    
   z#Backend.load_pem_pkcs7_certificatesc                 C   sb   t d| | |}| j|j| jj}|| jjkrF|   t	d| j
|| jj}| |S r  )r   r  r   rf   Zd2i_PKCS7_biorX   rd   r   r   r   r   r  r  r  r]   r]   r^   load_der_pkcs7_certificates	  s    
z#Backend.load_der_pkcs7_certificatesc           
      C   s   | j |j}| || j jk || j jkr>td|tj	|j
jj}| j |}g }t|D ]d}| j ||}| || jjk | j |}| |dk | j|| j j}| |}	||	 q`|S )NzNOnly basic signed structures are currently supported. NID for this data was {}ra   )rf   ZOBJ_obj2nidr   r}   rt  ZNID_pkcs7_signedr   rx   r   ZUNSUPPORTED_SERIALIZATIONr   signrP  r  r  r  rd   r   ZX509_up_refr   rT  rW  rs   )
ru   r  r  r  r   certsr  r   r   rP  r]   r]   r^   r  	  s*    

z Backend._load_pkcs7_certificates)r  r  c           
      C   s"  t |}|rtdd |D s&td|tjjtjjfkrBtd| j }| j	
|| jj}g }|D ]4}| |}|| | j||}| |dk qf| j| j	j| j	j|| j	j| jj}|  }	|tjjkr| j|	|| j	jd}n|tjjkst| j|	|}| |dk | |	S )Nc                 s   s   | ]}t |tjV  qd S r   )r   r   Certificater  r]   r]   r^   rp  	  s    z7Backend.pkcs7_serialize_certificates.<locals>.<genexpr>z.certs must be a list of certs with length >= 1z/encoding must DER or PEM from the Encoding enumra   r   )listallrN  r'   rR  r  rS  rf   r  rd   r   r  rU  rs   r  r}   
PKCS7_signr   PKCS7_PARTIALr   PEM_write_bio_PKCS7_streamr   i2d_PKCS7_bior   )
ru   r  r  Zcerts_sk
ossl_certsrP  r  r   r  bio_outr]   r]   r^   pkcs7_serialize_certificates	  sJ    


   z$Backend.pkcs7_serialize_certificates)builderr  optionsrw   c                 C   s  |j d k	st| |j }| jj}d}t|jdkr>| jj}n\| j	 }| j
|| jj}g }|jD ]4}	| |	}
||
 | j||
}| |dk qdtjj|kr|| jjO }|| jjO }| j| jj| jj|| jj|}| || jjk | j
|| jj}d}tjj|kr"|| jjO }ntjj|kr<|| jjO }tjj|krV|| jjO }|jD ]H\}}}| |}
| |}| j||
|j||}| || jjk q\|D ]<}|tjj kr|| jj!O }n|tjj"kr|| jj#O }q| $ }|t%j&j'kr| j(|||j)|}n|t%j&j*krX| j+||j)|}| |dk | j,|||j)|}nR|t%j&j-ksjt| j+||j)|}| |dk | jj.r| /  | j0||}| |dk | 1|S )Nr   ra   )2_datar   r   rf   r  r   Z_additional_certsrd   r   r  r   r  rU  rs   r  r}   rP   PKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDr  r  ZNoCapabilitiesZPKCS7_NOSMIMECAPZNoAttributesZPKCS7_NOATTRZNoCertsZPKCS7_NOCERTSZ_signersr   ZPKCS7_sign_add_signerra  TextZ
PKCS7_TEXTBinaryZPKCS7_BINARYr   r'   rR  ZSMIMEZSMIME_write_PKCS7rX   r  ZPKCS7_finalr  rS  r  r   r  r   )ru   r#  r  r$  rX   Z
init_flagsZfinal_flagsr  r   rP  r  r   r  Zsigner_flagsr  Zprivate_keyZhash_algorithmZmdZp7signerinfooptionr!  r]   r]   r^   
pkcs7_sign	  s    






      
zBackend.pkcs7_sign)N)N)N)rZ   r[   r\   __doc__r   r  r:   r   r&   r  r  r   r!  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r   r+   Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1r  Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrv   strrz   r   typingOptionalListr%   Z_OpenSSLErrorr}   rh   r   r   
contextlibr   r   rp   r   ry   r   r   bytesZHashAlgorithmr   r   r   r   r   r   r   r   ZHashContextr   r9   rL   r   r   rk   r   r   r   r   r   r   Z_OpenSSLErrorWithTextr   r   r   r.   ZRSAPrivateKeyr   r   ZRSAPrivateNumbersr   ZRSAPublicNumbersZRSAPublicKeyr   r   r   r   r   r   r6   r  r7   r  r"  r(   r%  r*   ZDSAParametersr(  ZDSAPrivateKeyr+  r,  r1  ZDSAPrivateNumbersr5  ZDSAPublicNumbersZDSAPublicKeyr7  ZDSAParameterNumbersr8  r*  r9  r:  r=  r8   r
   r>  r@  rI  r)   ZDHParametersrJ  r  rK  r  rO  r   r  AnyrU  rW  ZCertificateSigningRequestrZ  r[  ZCertificateRevocationListr^  r_  r5   rb  rc  rf  r?  NoReturnrF  ZEllipticCurverw  ZEllipticCurveSignatureAlgorithmry  ZEllipticCurvePrivateKeyr}  ZEllipticCurvePrivateNumbersr  ZEllipticCurvePublicNumbersZEllipticCurvePublicKeyr  r  r  rz  r  r  r  r{  rs  r  r  r  r'   rR  r  r  r  r  r  r  r  r  r  r  ZDHPrivateKeyr  r  ZDHPrivateNumbersr  ZDHPublicNumbersZDHPublicKeyr  ZDHParameterNumbersr  r  r  r/   ZX25519PublicKeyr  ZX25519PrivateKeyr  r  r  r  r0   ZX448PublicKeyr  ZX448PrivateKeyr  r  r  r  r,   ZEd25519PublicKeyr  ZEd25519PrivateKeyr  r  r  r-   ZEd448PublicKeyr  ZEd448PrivateKeyr  r  r  r  Iteratorr  r  r  r  Tupler  rT   r  rU   rV   r  r  r   r  r  r  r  r  r"  rP   ZPKCS7SignatureBuilderr&  r*  r]   r]   r]   r^   r_      s|  

	 		5  
  
%@: 
* 		
5/  ' 

z7  1  $# 

 O
 


1
r_   c                   @   s,   e Zd ZedddZeeedddZdS )r   )fmtc                 C   s
   || _ d S r   )_fmt)ru   r6  r]   r]   r^   rv   ?
  s    zGetCipherByName.__init__)r	  r   r   c                 C   sd   | j j||d }|j|d}||jjkrX|jjrX|j	|jj|d|jj}|
  |S )N)r   r   r   )r7  rx   lowerrf   r  r   rd   r   ZCryptography_HAS_300_EVP_CIPHERZEVP_CIPHER_fetchr   )ru   r	  r   r   r  r   r]   r]   r^   __call__B
  s    
zGetCipherByName.__call__N)	rZ   r[   r\   r,  rv   r_   r9   rL   r9  r]   r]   r]   r^   r   >
  s   r   )r	  r   c                 C   s"   d |jd }| j|dS )Nz
aes-{}-xtsr  r   )rx   r   rf   r  r   )r	  r   r   r  r]   r]   r^   r   W
  s    r   )|collectionsr0  r   r-  rm   r   Zcryptographyr   r   Zcryptography.exceptionsr   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr
   Z'cryptography.hazmat.backends.openssl.dhr   r   r   r   Z(cryptography.hazmat.backends.openssl.dsar   r   r   Z'cryptography.hazmat.backends.openssl.ecr   r   Z,cryptography.hazmat.backends.openssl.ed25519r   r   Z*cryptography.hazmat.backends.openssl.ed448r   r   r   Z+cryptography.hazmat.backends.openssl.hashesr   Z)cryptography.hazmat.backends.openssl.hmacr   Z-cryptography.hazmat.backends.openssl.poly1305r   r   Z(cryptography.hazmat.backends.openssl.rsar   r    Z+cryptography.hazmat.backends.openssl.x25519r!   r"   Z)cryptography.hazmat.backends.openssl.x448r#   r$   Z"cryptography.hazmat.bindings._rustrV  Z$cryptography.hazmat.bindings.opensslr%   Zcryptography.hazmat.primitivesr&   r'   Z*cryptography.hazmat.primitives._asymmetricr(   Z)cryptography.hazmat.primitives.asymmetricr)   r*   r+   r,   r-   r.   r/   r0   Z1cryptography.hazmat.primitives.asymmetric.paddingr1   r2   r3   r4   Z/cryptography.hazmat.primitives.asymmetric.typesr5   r6   r7   Z&cryptography.hazmat.primitives.ciphersr8   r9   Z1cryptography.hazmat.primitives.ciphers.algorithmsr:   r;   r<   r=   r>   r?   r@   rA   rB   rC   rD   rE   Z,cryptography.hazmat.primitives.ciphers.modesrF   rG   rH   rI   rJ   rK   rL   rM   rN   Z"cryptography.hazmat.primitives.kdfrO   Z,cryptography.hazmat.primitives.serializationrP   rQ   Z3cryptography.hazmat.primitives.serialization.pkcs12rR   rS   rT   rU   rV   
namedtuplerW   rY   r_   r   r   r	  r]   r]   r]   r^   <module>   sv   (
8,	                   J