o
    ÿÑÐbg£ ã                   @   sÚ  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZmZmZ d dlmZmZmZ d dl m!Z!m"Z" d dl#m$Z$m%Z% d dl&m'Z'm(Z(m)Z) d dl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3 d dl4m5Z5 d dl6m7Z7 d dl8m9Z9m:Z: d dl;m<Z<m=Z= d dl>m?Z?m@Z@ d dlAmBZBmCZC d dlDmEZE d dlFmGZGmZH d dlImJZJ d dlKmLZLmMZM d dlNmOZOmPZPmQZQmRZRmSZSmTZT d dlUmVZVmWZWmXZXmYZY d dlZm[Z[ d dl\m]Z]m^Z^m_Z_m`Z`maZambZbmcZcmdZdmeZemfZf d dlgmhZhmiZimjZjmkZkmlZlmmZmmnZnmoZo d dlpmqZq d d lrmsZsmtZt d d!lumvZv d d"lwmxZx d d#lymzZz e  {d$d%d&g¡Z|G d'd(„ d(e}ƒZ~G d)d*„ d*eƒZG d+d,„ d,e}ƒZd-d.„ Z€eƒ ZdS )/é    N)Úcontextmanager)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)ÚBackend)Úaead)Ú_CipherContext©Ú_CMACContext)Ú_CRL_ENTRY_REASON_ENUM_TO_CODE)Ú_DHParametersÚ_DHPrivateKeyÚ_DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey)	Ú$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERSÚ_CRL_EXTENSION_ENCODE_HANDLERSÚ_EXTENSION_ENCODE_HANDLERSÚ)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERSÚ'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERSÚ_encode_asn1_int_gcÚ_encode_asn1_str_gcÚ_encode_name_gcÚ_txt2obj_gc©Ú_HashContext©Ú_HMACContext)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)Ú_RawRevokedCertificate)Úasn1r   )Úbinding)ÚhashesÚserialization)ÚdhÚdsaÚecÚed25519Úed448Úrsa)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)ÚPRIVATE_KEY_TYPES)
ÚAESÚARC4ÚBlowfishÚCAST5ÚCamelliaÚChaCha20ÚIDEAÚSEEDÚSM4Ú	TripleDES)ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚOFBÚXTS)Úscrypt)Úpkcs7Ússh)Úocsp)ÚPUBLIC_KEY_TYPES)ÚNameÚ
_MemoryBIOÚbioZchar_ptrc                   @   s   e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú__qualname__© r^   r^   úk/var/www/secure340b-portal/env/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/backend.pyrZ   „   s    rZ   c                   @   sŒ  e Zd ZdZdZh d£ZeefZe	j
e	je	je	je	je	je	je	je	je	je	je	jfZejejejejfZdZdZdd> ZdZ de > Z!dd„ Z"d	d
„ Z#d8dd„Z$dd„ Z%dd„ Z&dd„ Z'e(j)dd„ ƒZ*dd„ Z+dd„ Z,dd„ Z-dd„ Z.dd„ Z/d d!„ Z0d"d#„ Z1d$d%„ Z2d&d'„ Z3d(d)„ Z4d*d+„ Z5d,d-„ Z6d.d/„ Z7d0d1„ Z8d2d3„ Z9d4d5„ Z:d6d7„ Z;d8d9„ Z<d:d;„ Z=d<d=„ Z>d>d?„ Z?d@dA„ Z@d8dBdC„ZAdDdE„ ZBdFdG„ ZCdHdI„ ZDdJdK„ ZEdLdM„ ZFdNdO„ ZGdPdQ„ ZHdRdS„ ZIdTdU„ ZJdVdW„ ZKdXdY„ ZLdZd[„ ZMd\d]„ ZNd^d_„ ZOd`da„ ZPdbdc„ ZQddde„ ZRdfdg„ ZSdhdi„ ZTdjdk„ ZUdldm„ ZVdndo„ ZWdpdq„ ZXdrds„ ZYdtdu„ ZZdvdw„ Z[dxe\j]dye^dze_j`e	ja d{e\jbfd|d}„Zcdxe\jddye^dze_j`e	ja d{e\jefd~d„Zfd€d„ Zgd‚dƒ„ Zhd„d…„ Zidxe\jjdye^dze_j`e	ja d{e\jkfd†d‡„Zldˆd‰„ ZmdŠd‹„ ZndŒd„ Zodxe\jpd{e\jqfdŽd„Zrdd‘„ Zsd’d“„ Ztd”d•„ Zud–d—„ Zvd˜d™„ Zwdšd›„ Zxdœd„ Zydže\jed{e_jzfdŸd „Z{d¡e_jzd{e\jefd¢d£„Z|d¤e\jbd{e_jzfd¥d¦„Z}d§e_jzd{e\jbfd¨d©„Z~dªe\jkd{e_jzfd«d¬„Zd­e_jzd{e\jkfd®d¯„Z€dªe\jkd°ed{e‚fd±d²„Zƒd¤e\jbd{e‚fd³d´„Z„dµd¶„ Z…d·d¸„ Z†d¹dº„ Z‡d»d¼„ Zˆd½d¾„ Z‰d¿dÀ„ ZŠdÁdÂ„ Z‹dÃdÄ„ ZŒdÅdÆ„ ZdÇdÈ„ ZŽdÉdÊ„ ZdËdÌ„ ZdÍdÎ„ Z‘dÏdÐ„ Z’dÑdÒ„ Z“dÓdÔ„ Z”dÕdÖ„ Z•e)d×dØ„ ƒZ–dÙdÚ„ Z—dÛdÜ„ Z˜dÝdÞ„ Z™dßdà„ Zšdádâ„ Z›dãdä„ Zœdådæ„ Zdçdè„ Zždédê„ ZŸdëdì„ Z dídî„ Z¡dïdð„ Z¢dñdò„ Z£dódô„ Z¤d8dõdö„Z¥d÷dø„ Z¦dùe§d{e¨fdúdû„Z©düdý„ Zªdþdÿ„ Z«d d„ Z¬dd„ Z­dd„ Z®dd„ Z¯dd	„ Z°d
d„ Z±dd„ Z²dd„ Z³dd„ Z´dd„ Zµdd„ Z¶dd„ Z·dd„ Z¸dd„ Z¹dd„ Zºdd„ Z»d d!„ Z¼e(j)d"d#„ ƒZ½d$d%„ Z¾e(j)d&d'„ ƒZ¿d(d)„ ZÀd*d+„ ZÁd,d-„ ZÂd.d/„ ZÃd0d1„ ZÄd2d3„ ZÅd4d5„ ZÆd6d7„ ZÇdS (9  r   z)
    OpenSSL API binding interfaces.
    Zopenssl>   ó   aes-128-ccmó   aes-128-gcmó   aes-192-ccmó   aes-192-gcmó   aes-256-ccmó   aes-256-gcmé   i  é   c                 C   s”   t  ¡ | _| jj| _| jj| _d| _|  ¡ | _	i | _
|  ¡  |  ¡  | j	r0| jjr0t dt¡ n|  ¡  | jjg| _| jjrH| j | jj¡ d S d S )NFz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r2   ZBindingÚ_bindingÚffiÚ_ffiÚlibÚ_libÚ_rsa_skip_check_keyÚ_is_fips_enabledÚ_fips_enabledÚ_cipher_registryÚ_register_default_ciphersÚ_register_x509_encodersÚ"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEÚwarningsÚwarnÚUserWarningÚactivate_osrandom_engineZEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendZEVP_PKEY_DHX©Úselfr^   r^   r_   Ú__init__¸   s$   



þÿzBackend.__init__c                 C   s   d  |  ¡ | j¡S )Nz'<OpenSSLBackend(version: {}, FIPS: {})>)ÚformatÚopenssl_version_textro   r{   r^   r^   r_   Ú__repr__Í   ó   
ÿzBackend.__repr__Nc                 C   s   t j| j||dS )N)Úerrors)r2   Z_openssl_assertrl   )r|   Úokr‚   r^   r^   r_   Úopenssl_assertÒ   s   zBackend.openssl_assertc                 C   sH   | j jr| j  | jj¡}n
t| j ddd„ ƒƒ }|dkr | j  ¡  t|ƒS )NZ	FIPS_modec                   S   ó   dS ©Nr   r^   r^   r^   r^   r_   Ú<lambda>Û   s    z*Backend._is_fips_enabled.<locals>.<lambda>r   )rl   ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrj   ÚNULLÚgetattrZERR_clear_errorÚbool)r|   Úmoder^   r^   r_   rn   Õ   s   ÿ
zBackend._is_fips_enabledc                 C   s$   | j  ¡  |  ¡ sJ ‚|  ¡ | _d S ©N)rh   Ú_enable_fipsrn   ro   r{   r^   r^   r_   r   â   s   
zBackend._enable_fipsc                 C   sn   | j jr3| j  ¡ }|| jjkr5| j  |¡ | j  | jj¡}|  |dk¡ | j  |¡}|  |dk¡ d S d S d S ©Nrg   )	rl   rs   ZENGINE_get_default_RANDrj   rˆ   ZENGINE_unregister_RANDÚRAND_set_rand_methodr„   ÚENGINE_finish©r|   ÚeÚresr^   r^   r_   Úactivate_builtin_randomé   s   
özBackend.activate_builtin_randomc              
   c   s¶    | j  | j j¡}|  || jjk¡ | j  |¡}|  |dk¡ z |V  W | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ d S | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ w rŽ   )	rl   ZENGINE_by_idZCryptography_osrandom_engine_idr„   rj   rˆ   ZENGINE_initZENGINE_freer   r‘   r^   r^   r_   Ú_get_osurandom_engineö   s   €üzBackend._get_osurandom_enginec                 C   sx   | j jr:|  ¡  |  ¡ }| j  |¡}|  |dk¡ W d   ƒ n1 s$w   Y  | j  | jj¡}|  |dk¡ d S d S rŽ   )	rl   rs   r”   r•   ZENGINE_set_default_RANDr„   r   rj   rˆ   r‘   r^   r^   r_   rw   
  s   
ý÷z Backend.activate_osrandom_enginec              	   C   st   | j  dd¡}|  ¡ }| j |dt|ƒ|| j jd¡}|  |dk¡ W d   ƒ n1 s,w   Y  | j  |¡ 	d¡S )Núchar[]é@   s   get_implementationr   Úascii)
rj   Únewr•   rl   ZENGINE_ctrl_cmdÚlenrˆ   r„   ÚstringÚdecode)r|   Úbufr’   r“   r^   r^   r_   Úosrandom_engine_implementation  s   
ÿüz&Backend.osrandom_engine_implementationc                 C   s   | j  | j | jj¡¡ d¡S )zÀ
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r˜   )rj   r›   rl   ZOpenSSL_versionÚOPENSSL_VERSIONrœ   r{   r^   r^   r_   r     s
   ÿþzBackend.openssl_version_textc                 C   s
   | j  ¡ S rŒ   )rl   ZOpenSSL_version_numr{   r^   r^   r_   Úopenssl_version_number*  ó   
zBackend.openssl_version_numberc                 C   s   t | ||ƒS rŒ   r&   )r|   ÚkeyÚ	algorithmr^   r^   r_   Úcreate_hmac_ctx-  ó   zBackend.create_hmac_ctxc                 C   sL   |j dks
|j dkrd |j |jd ¡ d¡}n|j  d¡}| j |¡}|S )NÚblake2bÚblake2sz{}{}é   r˜   )Únamer~   Údigest_sizeÚencoderl   ZEVP_get_digestbyname)r|   r£   ÚalgÚevp_mdr^   r^   r_   Ú_evp_md_from_algorithm0  s   ÿþzBackend._evp_md_from_algorithmc                 C   s    |   |¡}|  || jjk¡ |S rŒ   )r®   r„   rj   rˆ   ©r|   r£   r­   r^   r^   r_   Ú_evp_md_non_null_from_algorithm;  s   
z'Backend._evp_md_non_null_from_algorithmc                 C   s,   | j rt|| jƒsdS |  |¡}|| jjkS ©NF)ro   Ú
isinstanceÚ_fips_hashesr®   rj   rˆ   r¯   r^   r^   r_   Úhash_supported@  s   
zBackend.hash_supportedc                 C   ó   | j rdS | jjdkS ©NFrg   )ro   rl   ZCryptography_HAS_SCRYPTr{   r^   r^   r_   Úscrypt_supportedG  s   zBackend.scrypt_supportedc                 C   s    | j rt|tjƒrdS |  |¡S ©NT)ro   r²   r3   ÚSHA1r´   ©r|   r£   r^   r^   r_   Úhmac_supportedM  s   
zBackend.hmac_supportedc                 C   ó
   t | |ƒS rŒ   r$   rº   r^   r^   r_   Úcreate_hash_ctxT  r¡   zBackend.create_hash_ctxc                 C   sv   | j rt|| jƒrt|tƒrt|ttfƒsdS z| jt|ƒt|ƒf }W n
 ty.   Y dS w || ||ƒ}| j	j
|kS r±   )ro   r²   Ú_fips_ciphersrI   rJ   rN   rp   ÚtypeÚKeyErrorrj   rˆ   )r|   Úcipherr‹   ÚadapterÚ
evp_cipherr^   r^   r_   Úcipher_supportedW  s   ÿþÿzBackend.cipher_supportedc                 C   s0   ||f| j v rtd ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)rp   Ú
ValueErrorr~   )r|   Ú
cipher_clsÚmode_clsrÂ   r^   r^   r_   Úregister_cipher_adapterh  s   ÿÿzBackend.register_cipher_adapterc                 C   s|  t ttttttfD ]}|  t|t	dƒ¡ q	t ttttfD ]}|  t
|t	dƒ¡ qt tttfD ]}|  t|t	dƒ¡ q.|  ttt	dƒ¡ t tttfD ]}|  t|t	dƒ¡ qIt tttfD ]}|  t|t	dƒ¡ q[t ttgt tttg¡D ]\}}|  ||t	dƒ¡ qs|  ttd ƒt	dƒ¡ |  ttd ƒt	dƒ¡ |  ttd ƒt	d	ƒ¡ |  ttt¡ tt tttfD ]}|  t|t	d
ƒ¡ q°d S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20zsm4-{mode.name})rJ   rM   rN   rP   rK   rL   rO   rÈ   r@   ÚGetCipherByNamerD   rI   rB   rG   Ú	itertoolsÚproductrC   rF   rA   r¿   rZ   rE   rQ   Ú_get_xts_cipherrH   )r|   rÇ   rÆ   r^   r^   r_   rq   q  s^   ýý
ÿ
ÿ
ÿ
ÿ
þýÿ
ÿÿz!Backend._register_default_ciphersc                 C   s6   t  ¡ | _t ¡ | _t ¡ | _t ¡ | _t	 ¡ | _
d S rŒ   )r   ÚcopyÚ_extension_encode_handlersr   Ú_crl_extension_encode_handlersr   Ú$_crl_entry_extension_encode_handlersr   Ú'_ocsp_request_extension_encode_handlersr   Ú)_ocsp_basicresp_extension_encode_handlersr{   r^   r^   r_   rr   ¢  s   
ÿÿÿÿzBackend._register_x509_encodersc                 C   ó   t | ||t jƒS rŒ   )r	   Z_ENCRYPT©r|   rÁ   r‹   r^   r^   r_   Úcreate_symmetric_encryption_ctx±  ó   z'Backend.create_symmetric_encryption_ctxc                 C   rÓ   rŒ   )r	   Z_DECRYPTrÔ   r^   r^   r_   Úcreate_symmetric_decryption_ctx´  rÖ   z'Backend.create_symmetric_decryption_ctxc                 C   ó
   |   |¡S rŒ   )r»   rº   r^   r^   r_   Úpbkdf2_hmac_supported·  r¡   zBackend.pbkdf2_hmac_supportedc           
   
   C   sh   | j  d|¡}|  |¡}| j  |¡}| j |t|ƒ|t|ƒ||||¡}	|  |	dk¡ | j  |¡d d … S )Núunsigned char[]rg   )	rj   r™   r°   Úfrom_bufferrl   ZPKCS5_PBKDF2_HMACrš   r„   Úbuffer)
r|   r£   ÚlengthÚsaltZ
iterationsÚkey_materialr   r­   Úkey_material_ptrr“   r^   r^   r_   Úderive_pbkdf2_hmacº  s   
ø
zBackend.derive_pbkdf2_hmacc                 C   ó   t  | j¡S rŒ   )r2   Ú_consume_errorsrl   r{   r^   r^   r_   rã   Í  r¥   zBackend._consume_errorsc                 C   râ   rŒ   )r2   Ú_consume_errors_with_textrl   r{   r^   r^   r_   rä   Ð  r¥   z!Backend._consume_errors_with_textc                 C   sz   || j jksJ ‚|  | j |¡ ¡ | j |¡}| j  d|¡}| j ||¡}|  |dk¡ t 	| j  
|¡d |… d¡}|S )NrÚ   r   Úbig)rj   rˆ   r„   rl   ZBN_is_negativeZBN_num_bytesr™   Z	BN_bn2binÚintÚ
from_bytesrÜ   )r|   ÚbnZbn_num_bytesZbin_ptrZbin_lenÚvalr^   r^   r_   Ú
_bn_to_intÓ  s   zBackend._bn_to_intc                 C   sn   |du s|| j jksJ ‚|du r| j j}| t| ¡ d d ƒd¡}| j |t|ƒ|¡}|  || j jk¡ |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @rg   rå   )	rj   rˆ   Úto_bytesræ   Ú
bit_lengthrl   Z	BN_bin2bnrš   r„   )r|   Únumrè   ÚbinaryZbn_ptrr^   r^   r_   Ú
_int_to_bnß  s   zBackend._int_to_bnc                 C   s”   t  ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||| jƒS rŽ   )r:   Z_verify_rsa_parametersrl   ÚRSA_newr„   rj   rˆ   ÚgcÚRSA_freerï   ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyr*   rm   )r|   Úpublic_exponentÚkey_sizeÚ	rsa_cdatarè   r“   Úevp_pkeyr^   r^   r_   Úgenerate_rsa_private_keyð  s   

ÿ

ÿz Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )Né   rg   r   i   r^   )r|   rõ   rö   r^   r^   r_   Ú!generate_rsa_parameters_supported  s
   
ÿýz)Backend.generate_rsa_parameters_supportedc              
   C   s6  t  |j|j|j|j|j|j|jj	|jj
¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |jj	¡}	|  |jj
¡}
| j |||¡}|  |dk¡ | j ||
|	|¡}|  |dk¡ | j ||||¡}|  |dk¡ |  |¡}t| ||| jƒS rŽ   )r:   Z_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersr’   Únrl   rð   r„   rj   rˆ   rñ   rò   rï   ZRSA_set0_factorsÚRSA_set0_keyZRSA_set0_crt_paramsrô   r*   rm   )r|   Únumbersr÷   rü   rý   rþ   rÿ   r   r  r’   r  r“   rø   r^   r^   r_   Úload_rsa_private_numbers  s>   ø



ÿz Backend.load_rsa_private_numbersc                 C   s   t  |j|j¡ | j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS rŽ   )r:   Z_check_public_key_componentsr’   r  rl   rð   r„   rj   rˆ   rñ   rò   rï   r  rô   r+   )r|   r  r÷   r’   r  r“   rø   r^   r^   r_   Úload_rsa_public_numbers-  s   

zBackend.load_rsa_public_numbersc                 C   s2   | j  ¡ }|  || jjk¡ | j || j j¡}|S rŒ   )rl   ZEVP_PKEY_newr„   rj   rˆ   rñ   ÚEVP_PKEY_free©r|   rø   r^   r^   r_   Ú_create_evp_pkey_gc:  s   
zBackend._create_evp_pkey_gcc                 C   ó(   |   ¡ }| j ||¡}|  |dk¡ |S rŽ   )r
  rl   ZEVP_PKEY_set1_RSAr„   )r|   r÷   rø   r“   r^   r^   r_   rô   @  ó   zBackend._rsa_cdata_to_evp_pkeyc                 C   sH   | j  |¡}| j |t|ƒ¡}|  || j jk¡ t| j  || jj	¡|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rj   rÛ   rl   ZBIO_new_mem_bufrš   r„   rˆ   rX   rñ   ÚBIO_free)r|   ÚdataÚdata_ptrrY   r^   r^   r_   Ú_bytes_to_bioF  s   zBackend._bytes_to_bioc                 C   sP   | j  ¡ }|  || jjk¡ | j  |¡}|  || jjk¡ | j || j j¡}|S )z.
        Creates an empty memory BIO.
        )rl   Z	BIO_s_memr„   rj   rˆ   ZBIO_newrñ   r  )r|   Z
bio_methodrY   r^   r^   r_   Ú_create_mem_bio_gcS  s   
zBackend._create_mem_bio_gcc                 C   s\   | j  d¡}| j ||¡}|  |dk¡ |  |d | j jk¡ | j  |d |¡dd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rj   r™   rl   ZBIO_get_mem_datar„   rˆ   rÜ   )r|   rY   r   Úbuf_lenÚbio_datar^   r^   r_   Ú_read_mem_bio^  s   zBackend._read_mem_bioc                 C   s¦  | j  |¡}|| j jkr,| j  |¡}|  || jjk¡ | j || j j¡}t	| ||| j
ƒS || j jkrP| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrt| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jv r—| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkr¥t| |ƒS |t| j ddƒkr³t| |ƒS |t| j ddƒkrÁt| |ƒS |t| j ddƒkrÏt| |ƒS tdƒ‚)zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ÚEVP_PKEY_ED25519NÚEVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.)rl   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAr„   rj   rˆ   rñ   rò   r*   rm   ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer   rx   ÚEVP_PKEY_get1_DHÚDH_freer   r‰   r   r.   r,   r   r   ©r|   rø   Úkey_typer÷   Ú	dsa_cdataÚec_cdataÚdh_cdatar^   r^   r_   Ú_evp_pkey_to_private_keyi  s@   
ÿ




z Backend._evp_pkey_to_private_keyc                 C   s¢  | j  |¡}|| j jkr*| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krN| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrr| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jv r•| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkr£t| |ƒS |t| j ddƒkr±t| |ƒS |t| j ddƒkr¿t| |ƒS |t| j ddƒkrÍt| |ƒS tdƒ‚)zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        r  Nr  r  r  r  )rl   r  r  r  r„   rj   rˆ   rñ   rò   r+   r  r  r  r   r   r!  r"  r   rx   r#  r$  r   r‰   r   r/   r-   r   r   r%  r^   r^   r_   Ú_evp_pkey_to_public_key–  s<   




zBackend._evp_pkey_to_public_keyc                 C   s2   | j jrt|tjtjtjtjtjfƒS t|tjƒS rŒ   )	rl   ZCryptography_HAS_RSA_OAEP_MDr²   r3   r¹   ÚSHA224ÚSHA256ÚSHA384ÚSHA512rº   r^   r^   r_   Ú_oaep_hash_supportedÁ  s   ûþzBackend._oaep_hash_supportedc                 C   s¤   t |tƒrdS t |tƒr&t |jtƒr&| jrt |jjtjƒrdS |  	|jj¡S t |t
ƒrPt |jtƒrP|  |jj¡oO|  |j¡oO|jd u pOt|jƒdkpO| jjdkS dS )NTr   rg   F)r²   r=   r>   Z_mgfr;   ro   Ú
_algorithmr3   r¹   r´   r<   r0  Z_labelrš   rl   ZCryptography_HAS_RSA_OAEP_LABEL)r|   Úpaddingr^   r^   r_   Úrsa_padding_supportedÐ  s    

ÿ
ÿ
û	zBackend.rsa_padding_supportedc              	   C   s~   |dvrt dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}|  |dk¡ t	| |ƒS )N)i   rf   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   rg   )
rÅ   rl   ÚDSA_newr„   rj   rˆ   rñ   r  ZDSA_generate_parameters_exr   )r|   rö   Úctxr“   r^   r^   r_   Úgenerate_dsa_parametersç  s$   ÿ
ù

zBackend.generate_dsa_parametersc                 C   sT   | j  |j¡}|  || jjk¡ | j || j j¡}| j  |¡ |  	|¡}t
| ||ƒS rŒ   )rl   ZDSAparams_dupZ
_dsa_cdatar„   rj   rˆ   rñ   r  ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr   )r|   Ú
parametersr5  rø   r^   r^   r_   Úgenerate_dsa_private_keyÿ  s   
z Backend.generate_dsa_private_keyc                 C   ó   |   |¡}|  |¡S rŒ   )r6  r9  )r|   rö   r8  r^   r^   r_   Ú'generate_dsa_private_key_and_parameters  ó   

z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j  ||||¡}|  |dk¡ | j  |||¡}|  |dk¡ d S rŽ   )rl   ÚDSA_set0_pqgr„   ZDSA_set0_key)r|   r'  rü   rý   ÚgÚpub_keyÚpriv_keyr“   r^   r^   r_   Ú_dsa_cdata_set_values  s   zBackend._dsa_cdata_set_valuesc           
      C   s¨   t  |¡ |jj}| j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}|  |j¡}|  |jj¡}|  |j¡}|  ||||||¡ |  |¡}	t| ||	ƒS rŒ   )r6   Z_check_dsa_private_numbersr  Úparameter_numbersrl   r4  r„   rj   rˆ   rñ   r  rï   rü   rý   r>  ÚyÚxrA  r7  r   )
r|   r  rB  r'  rü   rý   r>  r?  r@  rø   r^   r^   r_   Úload_dsa_private_numbers  s   


z Backend.load_dsa_private_numbersc           	      C   s¢   t  |j¡ | j ¡ }|  || jjk¡ | j || jj	¡}|  
|jj¡}|  
|jj¡}|  
|jj¡}|  
|j¡}| jj}|  ||||||¡ |  |¡}t| ||ƒS rŒ   )r6   Ú_check_dsa_parametersrB  rl   r4  r„   rj   rˆ   rñ   r  rï   rü   rý   r>  rC  rA  r7  r   )	r|   r  r'  rü   rý   r>  r?  r@  rø   r^   r^   r_   Úload_dsa_public_numbers%  s   

zBackend.load_dsa_public_numbersc                 C   s†   t  |¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|  	|j¡}| j ||||¡}|  |dk¡ t| |ƒS rŽ   )r6   rF  rl   r4  r„   rj   rˆ   rñ   r  rï   rü   rý   r>  r=  r   )r|   r  r'  rü   rý   r>  r“   r^   r^   r_   Úload_dsa_parameter_numbers6  s   


z"Backend.load_dsa_parameter_numbersc                 C   r  rŽ   )r
  rl   ZEVP_PKEY_set1_DSAr„   )r|   r'  rø   r“   r^   r^   r_   r7  D  r  zBackend._dsa_cdata_to_evp_pkeyc                 C   rØ   rŒ   )r´   rº   r^   r^   r_   Údsa_hash_supportedJ  r¡   zBackend.dsa_hash_supportedc                 C   r…   r¸   r^   )r|   rü   rý   r>  r^   r^   r_   Údsa_parameters_supportedM  s   z Backend.dsa_parameters_supportedc                 C   s   |   |td|j ƒ¡S )Nó    )rÄ   rJ   Ú
block_sizerº   r^   r^   r_   Úcmac_algorithm_supportedP  s   ÿz Backend.cmac_algorithm_supportedc                 C   r¼   rŒ   r
   rº   r^   r^   r_   Úcreate_cmac_ctxU  r¡   zBackend.create_cmac_ctxc                 C   s€   t |tjtjfƒr|d urtdƒ‚d S t |tjtj	t
jfƒs"tdƒ‚t |tjƒs,tdƒ‚t |tjƒr<t |tjƒs>tdƒ‚d S d S )Nz8algorithm must be None when signing via ed25519 or ed448z;Key must be an rsa, dsa, ec, ed25519, or ed448 private key.z.Algorithm must be a registered hash algorithm.z2MD5 hash algorithm is only supported with RSA keys)r²   r8   ÚEd25519PrivateKeyr9   ÚEd448PrivateKeyrÅ   r:   ZRSAPrivateKeyr6   ZDSAPrivateKeyr7   ZEllipticCurvePrivateKeyÚ	TypeErrorr3   ÚHashAlgorithmÚMD5©r|   Úprivate_keyr£   r^   r^   r_   Ú_x509_check_signature_paramsX  s0   ÿÿÿþÿÿÿýz$Backend._x509_check_signature_paramsÚbuilderrU  r£   Úreturnc              	      s°  t |tjƒs
tdƒ‚ˆ  ||¡ ˆ  ||¡}ˆ j ¡ }ˆ  |ˆ j	j
k¡ ˆ j	 |ˆ jj¡}ˆ j |tjjj¡}ˆ  |dk¡ ˆ j |tˆ |jƒ¡}ˆ  |dk¡ | ¡ }ˆ j ||j¡}ˆ  |dk¡ ˆ j ¡ }ˆ  |ˆ j	j
k¡ ˆ j	 |‡ fdd„¡}ˆ j|jˆ j|ˆ jjdd ˆ j ||¡}ˆ  |dk¡ |jD ]!\}	}
tˆ |	jƒ}ˆ j  ||tj!j"j#j|
t$|
ƒ¡}ˆ  |dk¡ q›ˆ j %||j|¡}|dkrÓˆ  &¡ }t'd|ƒ‚ˆ  (|¡S )	NúBuilder type mismatch.rg   c                    s   ˆ j  | ˆ j ˆ j jd¡¡S )NÚX509_EXTENSION_free)rl   Zsk_X509_EXTENSION_pop_freerj   Ú	addressofÚ_original_lib)rD  r{   r^   r_   r‡   ˜  s    ÿþz)Backend.create_x509_csr.<locals>.<lambda>F©Ú
extensionsÚhandlersÚx509_objÚadd_funcrñ   r   úSigning failed))r²   r   Ú CertificateSigningRequestBuilderrQ  rV  Ú_evp_md_x509_null_if_eddsarl   ZX509_REQ_newr„   rj   rˆ   rñ   ÚX509_REQ_freeZX509_REQ_set_versionÚVersionÚv1ÚvalueZX509_REQ_set_subject_namer"   Ú_subject_nameÚ
public_keyZX509_REQ_set_pubkeyÚ	_evp_pkeyZsk_X509_EXTENSION_new_nullÚ_create_x509_extensionsÚ_extensionsrÎ   Zsk_X509_EXTENSION_insertZX509_REQ_add_extensionsÚ_attributesr#   Údotted_stringZX509_REQ_add1_attr_by_OBJr©   Z	_ASN1TypeZ
UTF8Stringrš   ZX509_REQ_signrä   rÅ   Ú	_ossl2csr)r|   rW  rU  r£   r­   Úx509_reqr“   rj  Zsk_extensionZattr_oidZattr_valÚobjr‚   r^   r{   r_   Úcreate_x509_csrp  sd   
ÿÿ

þû
ûÿ

zBackend.create_x509_csrc           	      C   sˆ  t |tjƒs
tdƒ‚|jd u rtdƒ‚|  ||¡ |  ||¡}| j ¡ }| j	 
|| jj¡}| j ||jj¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ | j ||jj¡}|  |dk¡ t| |jƒ}| j ||¡}|  |dk¡ |  | j |¡|j¡ |  | j |¡|j¡ | j|j| j|| jj dd | j !|t| |j"ƒ¡}|  |dk¡ | j #||j|¡}|dkr¿|  $¡ }t%d|ƒ‚|  &|¡S )NrY  zBuilder has no public key.rg   Tr]  r   rb  )'r²   r   ÚCertificateBuilderrQ  Z_public_keyrV  rd  rl   ZX509_newrj   rñ   Ú	X509_freeZX509_set_versionÚ_versionrh  r„   ZX509_set_subject_namer"   ri  ZX509_set_pubkeyrk  r    Ú_serial_numberZX509_set_serialNumberÚ_set_asn1_timeZX509_getm_notBeforeZ_not_valid_beforeZX509_getm_notAfterZ_not_valid_afterrl  rm  rÎ   ZX509_add_extZX509_set_issuer_nameÚ_issuer_nameZ	X509_signrä   rÅ   Ú
_ossl2cert)	r|   rW  rU  r£   r­   Z	x509_certr“   Úserial_numberr‚   r^   r^   r_   Úcreate_x509_certificateÁ  s`   

ÿþÿÿû	ÿý

zBackend.create_x509_certificatec                 C   s$   t |tjtjfƒr| jjS |  |¡S rŒ   )r²   r8   rO  r9   rP  rj   rˆ   r°   rT  r^   r^   r_   rd    s
   ÿ
z"Backend._evp_md_x509_null_if_eddsac                 C   sL   |j dkr| d¡ d¡}n| d¡ d¡}| j ||¡}|  |dk¡ d S )Ni  z%Y%m%d%H%M%SZr˜   z%y%m%d%H%M%SZrg   )ÚyearÚstrftimer«   rl   ZASN1_TIME_set_stringr„   )r|   Ú	asn1_timeÚtimeZasn1_strr“   r^   r^   r_   rx    s
   
zBackend._set_asn1_timec                 C   s>   | j  ¡ }|  || jjk¡ | j || j j¡}|  ||¡ |S rŒ   )rl   ZASN1_TIME_newr„   rj   rˆ   rñ   ZASN1_TIME_freerx  )r|   r€  r  r^   r^   r_   Ú_create_asn1_time_gc   s
   
zBackend._create_asn1_time_gcc                 C   sÚ  t |tjƒs
tdƒ‚|  ||¡ |  ||¡}| j ¡ }| j 	|| jj
¡}| j |d¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ | j|j| j|| jjdd |jD ]T}	| j ¡ }
|  |
| jjk¡ t| |	jƒ}| j |
|¡}|  |dk¡ |  |	j¡}| j  |
|¡}|  |dk¡ | j|	j!| j"|
| jj#dd | j $||
¡}|  |dk¡ q}| j %||j&|¡}|dkrè|  '¡ }t(d|ƒ‚|  )|¡S )NrY  rg   Tr]  r   rb  )*r²   r   Ú CertificateRevocationListBuilderrQ  rV  rd  rl   ZX509_CRL_newrj   rñ   ÚX509_CRL_freeZX509_CRL_set_versionr„   ZX509_CRL_set_issuer_namer"   ry  r  Ú_last_updateZX509_CRL_set1_lastUpdateÚ_next_updateZX509_CRL_set1_nextUpdaterl  rm  rÏ   ZX509_CRL_add_extZ_revoked_certificatesZX509_REVOKED_newrˆ   r    r{  ZX509_REVOKED_set_serialNumberÚrevocation_dateZX509_REVOKED_set_revocationDater^  rÐ   ZX509_REVOKED_add_extZX509_CRL_add0_revokedZX509_CRL_signrk  rä   rÅ   Ú	_ossl2crl)r|   rW  rU  r£   r­   Úx509_crlr“   Zlast_updateÚnext_updateZrevoked_certZx509_revokedr{  Zrev_dater‚   r^   r^   r_   Úcreate_x509_crl'  sp   
ÿû
	
ÿÿÿûÿ

zBackend.create_x509_crlc           
      C   sd   t |ƒD ]+\}}|  ||¡}|  || jjk¡ |r"| j || jj¡}||||ƒ}	|  |	dk¡ qd S rŽ   )Ú	enumerateÚ_create_x509_extensionr„   rj   rˆ   rñ   rl   rZ  )
r|   r^  r_  r`  ra  rñ   ÚiÚ	extensionZx509_extensionr“   r^   r^   r_   rl  y  s   ÿ÷zBackend._create_x509_extensionsc                 C   s2   t | |jjƒ}| j | jj||jrd|¡S d|¡S )Nrg   r   )r#   Úoidro  rl   ZX509_EXTENSION_create_by_OBJrj   rˆ   Úcritical)r|   rŽ  rh  rr  r^   r^   r_   Ú_create_raw_x509_extension‡  s   ÿÿz"Backend._create_raw_x509_extensionc                 C   s,  t |jtjƒrt| |jjƒ}|  ||¡S t |jtjƒr*t| t |j¡ƒ}|  ||¡S t |jtj	ƒr@t| t 
|j¡ƒ}|  ||¡S t |jtjƒrVt| t |j¡ƒ}|  ||¡S z||j }W n tyl   td |j¡ƒ‚w || |jƒ}| j |jj d¡¡}|  || jjk¡ | j ||jr’d|¡S d|¡S )NzExtension not supported: {}r˜   rg   r   )r²   rh  r   ZUnrecognizedExtensionr!   r‘  Z
TLSFeaturer1   Zencode_tls_featureZPrecertPoisonZencode_precert_poisonZ)PrecertificateSignedCertificateTimestampsÚ	rust_x509Z3encode_precertificate_signed_certificate_timestampsr  rÀ   ÚNotImplementedErrorr~   rl   ZOBJ_txt2nidro  r«   r„   Ú	NID_undefZX509V3_EXT_i2dr  )r|   r_  rŽ  rh  r«   Z
ext_structÚnidr^   r^   r_   rŒ    sP   ÿÿÿÿþ
ÿÿÿÿÿzBackend._create_x509_extensionc                 C   sL   t |tjƒs
tdƒ‚|j}|j}|d usJ ‚|d usJ ‚t||t |j¡ƒS )NrY  )	r²   r   ÚRevokedCertificateBuilderrQ  rw  Z_revocation_dater0   Z
Extensionsrm  )r|   rW  r{  r†  r^   r^   r_   Úcreate_x509_revoked_certificate¶  s   
ýz'Backend.create_x509_revoked_certificatec                 C   s   |   | jj| j||¡S rŒ   )Ú	_load_keyrl   ZPEM_read_bio_PrivateKeyr*  )r|   r  Úpasswordr^   r^   r_   Úload_pem_private_keyÅ  s   üzBackend.load_pem_private_keyc                 C   sÖ   |   |¡}| j |j| jj| jj| jj¡}|| jjkr)| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj| jj| jj¡}|| jjkre| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rŽ   )r  rl   ZPEM_read_bio_PUBKEYrY   rj   rˆ   rñ   r  r+  rã   Ú	BIO_resetr„   ZPEM_read_bio_RSAPublicKeyrò   rô   r+   Ú_handle_key_loading_error©r|   r  Úmem_biorø   r“   r÷   r^   r^   r_   Úload_pem_public_keyÍ  s$   
ÿ
ÿ
zBackend.load_pem_public_keyc                 C   s^   |   |¡}| j |j| jj| jj| jj¡}|| jjkr)| j || jj¡}t| |ƒS |  	¡  d S rŒ   )
r  rl   ZPEM_read_bio_DHparamsrY   rj   rˆ   rñ   r$  r   rœ  )r|   r  rž  r)  r^   r^   r_   Úload_pem_parametersæ  s   
ÿ
zBackend.load_pem_parametersc                 C   s:   |   |¡}|  ||¡}|r|  |¡S |  | jj| j||¡S rŒ   )r  Ú"_evp_pkey_from_der_traditional_keyr*  r˜  rl   Zd2i_PKCS8PrivateKey_bio)r|   r  r™  r  r¢   r^   r^   r_   Úload_der_private_keyò  s   

üzBackend.load_der_private_keyc                 C   sZ   | j  |j| jj¡}|| jjkr'|  ¡  | j || j j¡}|d ur%tdƒ‚|S |  ¡  d S )Nú4Password was given but private key is not encrypted.)	rl   Úd2i_PrivateKey_biorY   rj   rˆ   rã   rñ   r  rQ  )r|   r  r™  r¢   r^   r^   r_   r¡    s   ÿz*Backend._evp_pkey_from_der_traditional_keyc                 C   s¾   |   |¡}| j |j| jj¡}|| jjkr#| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj¡}|| jjkrY| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rŽ   )r  rl   Zd2i_PUBKEY_biorY   rj   rˆ   rñ   r  r+  rã   r›  r„   Zd2i_RSAPublicKey_biorò   rô   r+   rœ  r  r^   r^   r_   Úload_der_public_key  s    


ÿ
zBackend.load_der_public_keyc                 C   sº   |   |¡}| j |j| jj¡}|| jjkr#| j || jj¡}t| |ƒS | jj	rW|  
¡  | j |j¡}|  |dk¡ | j |j| jj¡}|| jjkrW| j || jj¡}t| |ƒS |  ¡  d S rŽ   )r  rl   Zd2i_DHparams_biorY   rj   rˆ   rñ   r$  r   ry   rã   r›  r„   ZCryptography_d2i_DHxparams_biorœ  )r|   r  rž  r)  r“   r^   r^   r_   Úload_der_parameters/  s    


ÿ
zBackend.load_der_parametersÚcertc                 C   óT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S rŒ   )Úpublic_bytesr4   ÚEncodingÚDERr  rl   Zd2i_X509_biorY   rj   rˆ   r„   rñ   ru  )r|   r§  r  rž  r   r^   r^   r_   Ú
_cert2osslC  ó   
zBackend._cert2osslr   c                 C   ó4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S rŽ   )r  rl   Zi2d_X509_bior„   r’  Zload_der_x509_certificater  )r|   r   rY   r“   r^   r^   r_   rz  K  s   zBackend._ossl2certÚcsrc                 C   r¨  rŒ   )r©  r4   rª  r«  r  rl   Zd2i_X509_REQ_biorY   rj   rˆ   r„   rñ   re  )r|   r¯  r  rž  rq  r^   r^   r_   Ú	_csr2osslQ  r­  zBackend._csr2osslrq  c                 C   r®  rŽ   )r  rl   Zi2d_X509_REQ_bior„   r’  Zload_der_x509_csrr  )r|   rq  rY   r“   r^   r^   r_   rp  Y  ó   zBackend._ossl2csrÚcrlc                 C   r¨  rŒ   )r©  r4   rª  r«  r  rl   Zd2i_X509_CRL_biorY   rj   rˆ   r„   rñ   rƒ  )r|   r²  r  rž  rˆ  r^   r^   r_   Ú	_crl2ossla  r­  zBackend._crl2osslrˆ  c                 C   r®  rŽ   )r  rl   Zi2d_X509_CRL_bior„   r’  Zload_der_x509_crlr  )r|   rˆ  rY   r“   r^   r^   r_   r‡  i  r±  zBackend._ossl2crlrj  c                 C   sJ   t |tttfƒstdƒ‚|  |¡}| j ||j¡}|dkr#|  	¡  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.rg   FT)
r²   r   r+   r   rQ  r³  rl   ZX509_CRL_verifyrk  rã   )r|   r²  rj  rˆ  r“   r^   r^   r_   Ú_crl_is_signature_validq  s    ýþÿ
zBackend._crl_is_signature_validc                 C   s`   |   |¡}| j |¡}|  || jjk¡ | j || jj¡}| j ||¡}|dkr.|  	¡  dS dS )Nrg   FT)
r°  rl   ZX509_REQ_get_pubkeyr„   rj   rˆ   rñ   r  ZX509_REQ_verifyrã   )r|   r¯  rq  Úpkeyr“   r^   r^   r_   Ú_csr_is_signature_valid‰  s   
zBackend._csr_is_signature_validc           	      C   s  |   |¡}| j d¡}|d ur#t d|¡ | j |¡}||_t|ƒ|_||j	| jj
| j | jjd¡|ƒ}|| jj
kra|jdkr]|  ¡  |jdkrLtdƒ‚|jdksSJ ‚td |jd	 ¡ƒ‚|  ¡  |  ¡  | j || jj¡}|d ur{|jdkr{td
ƒ‚|d ur„|jd	ksŠ|d u sŠJ ‚||ƒS )NzCRYPTOGRAPHY_PASSWORD_DATA *r™  ZCryptography_pem_password_cbr   éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.rg   r£  )r  rj   r™   r   Ú_check_byteslikerÛ   r™  rš   rÝ   rY   rˆ   r[  rl   r\  Úerrorrã   rQ  rÅ   r~   Úmaxsizerœ  rñ   r  Úcalled)	r|   Zopenssl_read_funcZconvert_funcr  r™  rž  ZuserdataZpassword_ptrrø   r^   r^   r_   r˜  ˜  sR   

ÿú	

ÿþÿÿÿþzBackend._load_keyc                    sž   ˆ   ¡ }|s
tdƒ‚|d  ˆ jjˆ jj¡s2|d  ˆ jjˆ jj¡s2ˆ jjr6|d  ˆ jj	ˆ jj
¡r6tdƒ‚t‡ fdd„|D ƒƒrEtdƒ‚t |¡}td|ƒ‚)Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3   s$    | ]}|  ˆ jjˆ jj¡V  qd S rŒ   )Ú_lib_reason_matchrl   ÚERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)Ú.0rº  r{   r^   r_   Ú	<genexpr>é  s   € üþ
ÿz4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.)rã   rÅ   r½  rl   r¾  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZERR_LIB_PROVZPROV_R_BAD_DECRYPTÚanyr2   Z_errors_with_text)r|   r‚   r^   r{   r_   rœ  Í  s>   ÿÿÿþü	÷
þöû
üz!Backend._handle_key_loading_errorc                 C   sp   z|   |¡}W n ty   | jj}Y nw | j |¡}|| jjkr'|  ¡  dS |  || jjk¡ | j 	|¡ dS )NFT)
Ú_elliptic_curve_to_nidr   rl   r”  ZEC_GROUP_new_by_curve_namerj   rˆ   rã   r„   ZEC_GROUP_free)r|   ÚcurveÚ	curve_nidÚgroupr^   r^   r_   Úelliptic_curve_supportedû  s   ÿz Backend.elliptic_curve_supportedc                 C   s   t |tjƒsdS |  |¡S r±   )r²   r7   ZECDSArÆ  )r|   Zsignature_algorithmrÃ  r^   r^   r_   Ú,elliptic_curve_signature_algorithm_supported  s   
z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   sX   |   |¡r"|  |¡}| j |¡}|  |dk¡ |  |¡}t| ||ƒS td |j	¡t
jƒ‚)z@
        Generate a new private key on the named curve.
        rg   z#Backend object does not support {}.)rÆ  Ú_ec_key_new_by_curverl   ZEC_KEY_generate_keyr„   Ú_ec_cdata_to_evp_pkeyr   r   r~   r©   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)r|   rÃ  r(  r“   rø   r^   r^   r_   Ú#generate_elliptic_curve_private_key  s   



þz+Backend.generate_elliptic_curve_private_keyc                 C   sp   |j }|  |j¡}| j |  |j¡| jj¡}| j 	||¡}|  
|dk¡ |  ||j|j¡}|  |¡}t| ||ƒS rŽ   )r  rÈ  rÃ  rj   rñ   rï   Úprivate_valuerl   ÚBN_clear_freeÚEC_KEY_set_private_keyr„   Ú)_ec_key_set_public_key_affine_coordinatesrD  rC  rÉ  r   )r|   r  Úpublicr(  rÌ  r“   rø   r^   r^   r_   Ú#load_elliptic_curve_private_numbers(  s   ÿ
ÿ
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |   |j¡}|  ||j|j¡}|  |¡}t| ||ƒS rŒ   )rÈ  rÃ  rÏ  rD  rC  rÉ  r   )r|   r  r(  rø   r^   r^   r_   Ú"load_elliptic_curve_public_numbers;  s   
ÿ
z*Backend.load_elliptic_curve_public_numbersc           	      C   sâ   |   |¡}| j |¡}|  || jjk¡ | j |¡}|  || jjk¡ | j || jj¡}|  	¡  }| j 
|||t|ƒ|¡}|dkrI|  ¡  tdƒ‚W d   ƒ n1 sSw   Y  | j ||¡}|  |dk¡ |  |¡}t| ||ƒS )Nrg   z(Invalid public bytes for the given curve)rÈ  rl   ÚEC_KEY_get0_groupr„   rj   rˆ   ÚEC_POINT_newrñ   ÚEC_POINT_freeÚ_tmp_bn_ctxZEC_POINT_oct2pointrš   rã   rÅ   ÚEC_KEY_set_public_keyrÉ  r   )	r|   rÃ  Zpoint_bytesr(  rÅ  ÚpointÚbn_ctxr“   rø   r^   r^   r_   Ú load_elliptic_curve_public_bytesD  s&   

ÿþü
z(Backend.load_elliptic_curve_public_bytesc              	   C   sX  |   |¡}|  |¡\}}| j |¡}|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}|  ¡ 9}| j |||| jj| jj|¡}	|  |	dk¡ | j |¡}
| j |¡}||||
||ƒ}	|  |	dk¡ W d   ƒ n1 srw   Y  | j ||¡}	|  |	dk¡ |  	|¡}| j || jj
¡}| j ||¡}	|  |	dk¡ |  |¡}t| ||ƒS rŽ   )rÈ  Ú _ec_key_determine_group_get_funcrl   rÔ  r„   rj   rˆ   rñ   rÕ  rï   rÍ  rÖ  ZEC_POINT_mulZ
BN_CTX_getr×  rÎ  rÉ  r   )r|   rÌ  rÃ  r(  Úget_funcrÅ  rØ  rh  rÙ  r“   Zbn_xZbn_yÚprivaterø   r^   r^   r_   Ú!derive_elliptic_curve_private_keyX  s2   


ÿö

z)Backend.derive_elliptic_curve_private_keyc                 C   r:  rŒ   )rÂ  Ú_ec_key_new_by_curve_nid)r|   rÃ  rÄ  r^   r^   r_   rÈ  {  r<  zBackend._ec_key_new_by_curvec                 C   s0   | j  |¡}|  || jjk¡ | j || j j¡S rŒ   )rl   ZEC_KEY_new_by_curve_namer„   rj   rˆ   rñ   r"  )r|   rÄ  r(  r^   r^   r_   rß    s   z Backend._ec_key_new_by_curve_nidc                 C   sê   | j  ¡ }|  || jjk¡ | j || j j¡}|j\}}}|  |¡}|  	|¡}|  	|¡}| j  
|||¡}	|  |	| jjk¡ | j  ||	¡}
|  |
| jjk¡ | j|j| j|| j jdd |  ¡ }| j  ||¡}|  |dk¡ t |  |¡¡S )NTr]  r   )rl   ZOCSP_REQUEST_newr„   rj   rˆ   rñ   ZOCSP_REQUEST_freeÚ_requestr°   r¬  ÚOCSP_cert_to_idZOCSP_request_add0_idrl  rm  rÑ   ZOCSP_REQUEST_add_extr  Zi2d_OCSP_REQUEST_biorU   Zload_der_ocsp_requestr  )r|   rW  Zocsp_reqr§  Zissuerr£   r­   Ú	ossl_certÚossl_issuerÚcertidZonereqrY   r“   r^   r^   r_   Úcreate_ocsp_request„  s,   



ûzBackend.create_ocsp_requestc              	   C   s  |   ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j	j
¡}|  |j	j¡}|  |j	j¡}| j |||¡}|  || jjk¡ | j || jj¡}|j	jd u rUd}	nt|j	j }	|j	jd u rf| jj}
n|  |j	j¡}
| jj}|j	jd ur~|  |j	j¡}|  |j	j¡}| j |||j	jj|	|
||¡}|  || jjk¡ |  ||¡}|j\}}| jj}|tjju r¸|| jjO }g }|j d urÝ|j D ]}|  |¡}| !|¡ | j "||¡}|  |dk¡ qÂ| j#|j$| j%|| jj&dd |  |¡}| j '|||j(|| jj|¡}|dkr|  )¡ }t*d|ƒ‚|S )Nr·  rg   Tr]  zAError while signing. responder_cert must be signed by private_key)+rV  rl   ZOCSP_BASICRESP_newr„   rj   rˆ   rñ   ZOCSP_BASICRESP_freer°   Ú	_responser1  r¬  Z_certZ_issuerrá  ZOCSP_CERTID_freeZ_revocation_reasonr   Z_revocation_timer  r…  Z_this_updateZOCSP_basic_add1_statusZ_cert_statusrh  rd  Z_responder_idZOCSP_NOCERTSrU   ZOCSPResponderEncodingÚHASHZOCSP_RESPID_KEYZ_certsrz   ZOCSP_basic_add1_certrl  rm  rÒ   ZOCSP_BASICRESP_add_extZOCSP_basic_signrk  rä   rÅ   )r|   rW  rU  r£   Úbasicr­   râ  rã  rä  ÚreasonZrev_timer‰  Zthis_updater“   Zresponder_certZresponder_encodingÚflagsÚ
ossl_certsr§  r‚   r^   r^   r_   Ú_create_ocsp_basic_response  sš   
ÿýÿ
ÿÿù	




û
ú
ýz#Backend._create_ocsp_basic_responsec           
      C   s   |t jju r|  |||¡}n| jj}| j |j|¡}|  	|| jjk¡ | j 
|| jj¡}|  ¡ }| j ||¡}|  	|dk¡ |  |¡}	t  |	¡S r†   )rU   ZOCSPResponseStatusZ
SUCCESSFULrì  rj   rˆ   rl   ZOCSP_response_createrh  r„   rñ   ZOCSP_RESPONSE_freer  Zi2d_OCSP_RESPONSE_bior  Zload_der_ocsp_response)
r|   Zresponse_statusrW  rU  r£   rè  Z	ocsp_resprY   r“   r  r^   r^   r_   Úcreate_ocsp_responseù  s   ÿÿ

zBackend.create_ocsp_responsec                 C   s,   | j rt|| jƒsdS |  |¡ot|tjƒS r±   )ro   r²   Ú_fips_ecdh_curvesrÆ  r7   ZECDH)r|   r£   rÃ  r^   r^   r_   Ú+elliptic_curve_exchange_algorithm_supported  s   ÿÿz3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   r  rŽ   )r
  rl   ZEVP_PKEY_set1_EC_KEYr„   )r|   r(  rø   r“   r^   r^   r_   rÉ    r  zBackend._ec_cdata_to_evp_pkeyc                 C   sN   dddœ}|  |j|j¡}| j | ¡ ¡}|| jjkr%td |j¡tj	ƒ‚|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z${} is not a supported elliptic curve)
Úgetr©   rl   Ú
OBJ_sn2nidr«   r”  r   r~   r   rÊ  )r|   rÃ  Zcurve_aliasesZ
curve_namerÄ  r^   r^   r_   rÂ    s   

þzBackend._elliptic_curve_to_nidc              	   c   sd    | j  ¡ }|  || jjk¡ | j || j j¡}| j  |¡ z|V  W | j  |¡ d S | j  |¡ w rŒ   )	rl   Z
BN_CTX_newr„   rj   rˆ   rñ   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)r|   rÙ  r^   r^   r_   rÖ  0  s   €
zBackend._tmp_bn_ctxc                 C   s¼   |   || jjk¡ | j d¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ ||krR| jj	rR| jj
}n| jj}|sZJ ‚||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r„   rj   rˆ   rl   rñ  r”  rÓ  ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFp)r|   r5  Znid_two_fieldrÅ  Úmethodr•  rÜ  r^   r^   r_   rÛ  ;  s   
z(Backend._ec_key_determine_group_get_funcc                 C   st   |dk s|dk rt dƒ‚| j |  |¡| jj¡}| j |  |¡| jj¡}| j |||¡}|dkr8|  ¡  t dƒ‚|S )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.rg   zInvalid EC key.)rÅ   rj   rñ   rï   rl   ró   Z(EC_KEY_set_public_key_affine_coordinatesrã   )r|   r5  rD  rC  r“   r^   r^   r_   rÏ  W  s   ÿz1Backend._ec_key_set_public_key_affine_coordinatesc           
      C   s  t |tjƒs
tdƒ‚t |tjƒstdƒ‚t |tjƒstdƒ‚t |tjƒr'd}nt |tjƒr;|j}t	|ƒdkr:t
dƒ‚nt
dƒ‚|tjju rf|tjju rP| jj}n|tjju r[| jj}nt
dƒ‚|  |||¡S |tjju rì| jryt |tjƒsyt
d	ƒ‚| j |¡}	|tjju r±|	| jjkr| jj}n|	| jjkr›| jj}n|	| jjkr¦| jj}nt
d
ƒ‚|  |||¡S |tjju rè|r½t
dƒ‚|	| jjkrÈ| jj}n|	| jjkrÓ| jj}n|	| jjkrÞ| jj}nt
d
ƒ‚|  ||¡S t
dƒ‚|tjju r|tjju rÿt  !||¡S t
dƒ‚t
dƒ‚)Nú/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instanceó    iÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingúformat is invalid with this key)"r²   r4   rª  rQ  ZPrivateFormatZKeySerializationEncryptionÚNoEncryptionÚBestAvailableEncryptionr™  rš   rÅ   ZPKCS8ÚPEMrl   ZPEM_write_bio_PKCS8PrivateKeyr«  Zi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioZTraditionalOpenSSLro   r  r  ZPEM_write_bio_RSAPrivateKeyr  ZPEM_write_bio_DSAPrivateKeyr   ZPEM_write_bio_ECPrivateKeyZi2d_RSAPrivateKey_bioZi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bioÚ_bio_func_outputÚOpenSSHrT   Zserialize_ssh_private_key)
r|   Úencodingr~   Úencryption_algorithmr¢   rø   Úcdatar™  Ú	write_bior&  r^   r^   r_   Ú_private_key_bytesk  sš   ÿÿÿÿÿÿ

ÿÿÿ


ÿÿÿ


ÿÿzBackend._private_key_bytesc              	   C   s<   |s| j j}n| j d¡}|  ||||t|ƒ| j j| j j¡S )Ns   aes-256-cbc)rj   rˆ   rl   ÚEVP_get_cipherbynamerú  rš   )r|   rÿ  rø   r™  rÃ   r^   r^   r_   rù  Ô  s   
ùz"Backend._private_key_bytes_via_bioc                 G   s0   |   ¡ }||g|¢R Ž }|  |dk¡ |  |¡S rŽ   )r  r„   r  )r|   rÿ  ÚargsrY   r“   r^   r^   r_   rú  å  s   
zBackend._bio_func_outputc                 C   s  t |tjƒs
tdƒ‚t |tjƒstdƒ‚|tjju r:|tjju r%| jj}n|tjj	u r0| jj
}ntdƒ‚|  ||¡S |tjju rp| j |¡}|| jjkrPtdƒ‚|tjju r[| jj}n|tjj	u rf| jj}ntdƒ‚|  ||¡S |tjju r…|tjju rt |¡S tdƒ‚tdƒ‚)Nró  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingrõ  )r²   r4   rª  rQ  ZPublicFormatZSubjectPublicKeyInforø  rl   ZPEM_write_bio_PUBKEYr«  Zi2d_PUBKEY_biorÅ   rú  ZPKCS1r  r  ZPEM_write_bio_RSAPublicKeyZi2d_RSAPublicKey_biorû  rT   Zserialize_ssh_public_key)r|   rü  r~   r¢   rø   rþ  rÿ  r&  r^   r^   r_   Ú_public_key_bytesë  s@   ÿ

ÿ


ÿzBackend._public_key_bytesc                 C   sÌ   |t jju r
tdƒ‚| j d¡}| j || jj|| jj¡ |t jj	u r5|d | jjkr0| jj
}n!| jj}n|t jju rM|d | jjkrH| jj}n	| jj}ntdƒ‚|  ¡ }|||ƒ}|  |dk¡ |  |¡S )Nz!OpenSSH encoding is not supportedz	BIGNUM **r   ró  rg   )r4   rª  rû  rQ  rj   r™   rl   ZDH_get0_pqgrˆ   rø  ZPEM_write_bio_DHxparamsZPEM_write_bio_DHparamsr«  ZCryptography_i2d_DHxparams_bioZi2d_DHparams_bior  r„   r  )r|   rü  r~   rþ  rý   rÿ  rY   r“   r^   r^   r_   Ú_parameter_bytes  s"   





zBackend._parameter_bytesc                 C   s†   |t jk rtd t j¡ƒ‚|dvrtdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}| j |||| jj¡}|  |dk¡ t| |ƒS )Nz$DH key_size must be at least {} bits)é   é   zDH generator must be 2 or 5rg   )r5   Z_MIN_MODULUS_SIZErÅ   r~   rl   ÚDH_newr„   rj   rˆ   rñ   r$  ZDH_generate_parameters_exr   )r|   Ú	generatorrö   Zdh_param_cdatar“   r^   r^   r_   Úgenerate_dh_parameters4  s    
ÿÿ
ÿ
zBackend.generate_dh_parametersc                 C   r  rŽ   )r
  rl   ZEVP_PKEY_set1_DHr„   )r|   r)  rø   r“   r^   r^   r_   Ú_dh_cdata_to_evp_pkeyJ  r  zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| ƒ}| j |¡}|  |dk¡ |  |¡}t| ||ƒS rŽ   )r   Z	_dh_cdatarl   ZDH_generate_keyr„   r
  r   )r|   r8  Zdh_key_cdatar“   rø   r^   r^   r_   Úgenerate_dh_private_keyP  s
   
zBackend.generate_dh_private_keyc                 C   s   |   |  ||¡¡S rŒ   )r  r	  )r|   r  rö   r^   r^   r_   Ú&generate_dh_private_key_and_parametersZ  r   z.Backend.generate_dh_private_key_and_parametersc                 C   s8  |j j}| j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|jd ur3|  	|j¡}n| jj}|  	|j j¡}|  	|j¡}| j ||||¡}	|  |	dk¡ | j |||¡}	|  |	dk¡ | j dd¡}
| j ||
¡}	|  |	dk¡ |
d dkr‘|jdkr|
d | jjA dks‘tdƒ‚|  |¡}t| ||ƒS )Nrg   úint[]r   r  z.DH private numbers did not pass safety checks.)r  rB  rl   r  r„   rj   rˆ   rñ   r$  rï   rü   r>  rý   rC  rD  ÚDH_set0_pqgÚDH_set0_keyr™   ÚCryptography_DH_checkZDH_NOT_SUITABLE_GENERATORrÅ   r
  r   )r|   r  rB  r)  rü   r>  rý   r?  r@  r“   Úcodesrø   r^   r^   r_   Úload_dh_private_numbers_  s4   


ÿþ
zBackend.load_dh_private_numbersc           
      C   sÐ   | j  ¡ }|  || jjk¡ | j || j j¡}|j}|  |j	¡}|  |j
¡}|jd ur2|  |j¡}n| jj}|  |j¡}| j  ||||¡}|  |dk¡ | j  ||| jj¡}|  |dk¡ |  |¡}	t| ||	ƒS rŽ   )rl   r  r„   rj   rˆ   rñ   r$  rB  rï   rü   r>  rý   rC  r  r  r
  r   )
r|   r  r)  rB  rü   r>  rý   r?  r“   rø   r^   r^   r_   Úload_dh_public_numbers  s    


zBackend.load_dh_public_numbersc                 C   s   | j  ¡ }|  || jjk¡ | j || j j¡}|  |j¡}|  |j	¡}|j
d ur/|  |j
¡}n| jj}| j  ||||¡}|  |dk¡ t| |ƒS rŽ   )rl   r  r„   rj   rˆ   rñ   r$  rï   rü   r>  rý   r  r   )r|   r  r)  rü   r>  rý   r“   r^   r^   r_   Úload_dh_parameter_numbers¨  s   


z!Backend.load_dh_parameter_numbersc                 C   s´   | j  ¡ }|  || jjk¡ | j || j j¡}|  |¡}|  |¡}|d ur+|  |¡}n| jj}| j  ||||¡}|  |dk¡ | j 	dd¡}| j  
||¡}|  |dk¡ |d dkS )Nrg   r  r   )rl   r  r„   rj   rˆ   rñ   r$  rï   r  r™   r  )r|   rü   r>  rý   r)  r“   r  r^   r^   r_   Údh_parameters_supportedº  s   


zBackend.dh_parameters_supportedc                 C   s   | j jdkS rŽ   )rl   ry   r{   r^   r^   r_   Údh_x942_serialization_supportedÐ  r¥   z'Backend.dh_x942_serialization_supportedr©   c                    sx   t ˆ |ƒ}ˆ j d¡}ˆ j ||¡}ˆ  |d ˆ jjk¡ ˆ j |‡ fdd„¡}ˆ  |dk¡ ˆ j |d |¡d d … S )Nzunsigned char **r   c                    s   ˆ j  | d ¡S r†   )rl   ZOPENSSL_free)Úpointerr{   r^   r_   r‡   Ù  s    z)Backend.x509_name_bytes.<locals>.<lambda>)	r"   rj   r™   rl   Zi2d_X509_NAMEr„   rˆ   rñ   rÜ   )r|   r©   Z	x509_nameÚppr“   r^   r{   r_   Úx509_name_bytesÓ  s   
ÿzBackend.x509_name_bytesc                 C   sh   t |ƒdkr
tdƒ‚|  ¡ }| j || jj¡}|  |dk¡ | j ||t |ƒ¡}|  |dk¡ t| |ƒS )Né    z%An X25519 public key is 32 bytes longrg   )	rš   rÅ   r
  rl   ZEVP_PKEY_set_typeÚ
NID_X25519r„   ZEVP_PKEY_set1_tls_encodedpointr-   )r|   r  rø   r“   r^   r^   r_   Úx25519_load_public_bytesÞ  s   
ÿ
z Backend.x25519_load_public_bytesc                 C   sÀ   t |ƒdkr
tdƒ‚d}|  d¡#}||dd…< ||dd …< |  |¡}| j |j| jj¡}W d   ƒ n1 s7w   Y  |  	|| jjk¡ | j 
|| jj¡}|  	| j |¡| jjk¡ t| |ƒS )Nr  z&An X25519 private key is 32 bytes longs   0. 0+en" é0   r   é   )rš   rÅ   Ú_zeroed_bytearrayr  rl   r¤  rY   rj   rˆ   r„   rñ   r  r  r  r,   )r|   r  Zpkcs8_prefixÚbarY   rø   r^   r^   r_   Úx25519_load_private_bytesí  s   
üÿ
z!Backend.x25519_load_private_bytesc                 C   s¨   | j  || jj¡}|  || jjk¡ | j || j j¡}| j  |¡}|  |dk¡ | j d¡}| j  	||¡}|  |dk¡ |  |d | jjk¡ | j |d | j j
¡}|S )Nrg   úEVP_PKEY **r   )rl   ZEVP_PKEY_CTX_new_idrj   rˆ   r„   rñ   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr™   ZEVP_PKEY_keygenr  )r|   r•  Zevp_pkey_ctxr“   Z	evp_ppkeyrø   r^   r^   r_   Ú_evp_pkey_keygen_gc	  s   zBackend._evp_pkey_keygen_gcc                 C   ó   |   | jj¡}t| |ƒS rŒ   )r#  rl   r  r,   r	  r^   r^   r_   Úx25519_generate_key	  ó   
zBackend.x25519_generate_keyc                 C   ó   | j rdS | jj S r±   )ro   rl   ÚCRYPTOGRAPHY_IS_LIBRESSLr{   r^   r^   r_   Úx25519_supported 	  ó   
zBackend.x25519_supportedc                 C   s`   t |ƒdkr
tdƒ‚| j | jj| jj|t |ƒ¡}|  || jjk¡ | j || jj	¡}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)rš   rÅ   rl   ÚEVP_PKEY_new_raw_public_keyÚNID_X448rj   rˆ   r„   rñ   r  r/   ©r|   r  rø   r^   r^   r_   Úx448_load_public_bytes%	  s   ÿ
zBackend.x448_load_public_bytesc                 C   sl   t |ƒdkr
tdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}|  || jjk¡ | j 	|| jj
¡}t| |ƒS )Nr+  z$An X448 private key is 56 bytes long)rš   rÅ   rj   rÛ   rl   ÚEVP_PKEY_new_raw_private_keyr-  rˆ   r„   rñ   r  r.   ©r|   r  r  rø   r^   r^   r_   Úx448_load_private_bytes0	  s   ÿ
zBackend.x448_load_private_bytesc                 C   r$  rŒ   )r#  rl   r-  r.   r	  r^   r^   r_   Úx448_generate_key<	  r&  zBackend.x448_generate_keyc                 C   r'  r±   )ro   rl   Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r{   r^   r^   r_   Úx448_supported@	  r*  zBackend.x448_supportedc                 C   r'  r±   ©ro   rl   Z#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Br{   r^   r^   r_   Úed25519_supportedE	  r*  zBackend.ed25519_supportedc                 C   sn   t  d|¡ t|ƒtjkrtdƒ‚| j | jj| j	j
|t|ƒ¡}|  || j	j
k¡ | j	 || jj¡}t| |ƒS )Nr  z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesrš   r8   Ú_ED25519_KEY_SIZErÅ   rl   r,  ÚNID_ED25519rj   rˆ   r„   rñ   r  r   r.  r^   r^   r_   Úed25519_load_public_bytesJ	  s   ÿ
z!Backend.ed25519_load_public_bytesc                 C   sz   t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j 	| jj
| jj|t |ƒ¡}|  || jjk¡ | j || jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longr  )rš   r8   r8  rÅ   r   r¹  rj   rÛ   rl   r0  r9  rˆ   r„   rñ   r  r   r1  r^   r^   r_   Úed25519_load_private_bytesX	  s   ÿ
z"Backend.ed25519_load_private_bytesc                 C   r$  rŒ   )r#  rl   r9  r   r	  r^   r^   r_   Úed25519_generate_keyf	  r&  zBackend.ed25519_generate_keyc                 C   r'  r±   r5  r{   r^   r^   r_   Úed448_supportedj	  r*  zBackend.ed448_supportedc                 C   sl   t  d|¡ t|ƒtkrtdƒ‚| j | jj| jj	|t|ƒ¡}|  
|| jj	k¡ | j || jj¡}t| |ƒS )Nr  z$An Ed448 public key is 57 bytes long)r   r7  rš   r   rÅ   rl   r,  Ú	NID_ED448rj   rˆ   r„   rñ   r  r   r.  r^   r^   r_   Úed448_load_public_byteso	  s   ÿ
zBackend.ed448_load_public_bytesc                 C   sx   t  d|¡ t|ƒtkrtdƒ‚| j |¡}| j | jj	| jj
|t|ƒ¡}|  || jj
k¡ | j || jj¡}t| |ƒS )Nr  z%An Ed448 private key is 57 bytes long)r   r¹  rš   r   rÅ   rj   rÛ   rl   r0  r>  rˆ   r„   rñ   r  r   r1  r^   r^   r_   Úed448_load_private_bytes|	  s   ÿ
z Backend.ed448_load_private_bytesc                 C   r$  rŒ   )r#  rl   r>  r   r	  r^   r^   r_   Úed448_generate_keyŠ	  r&  zBackend.ed448_generate_keyc                 C   s†   | j  d|¡}| j  |¡}| j |t|ƒ|t|ƒ|||tj||¡
}	|	dkr9|  ¡ }
d| | d }t	d 
|¡|
ƒ‚| j  |¡d d … S )NrÚ   rg   é€   i   zJNot enough memory to derive key. These parameters require {} MB of memory.)rj   r™   rÛ   rl   ZEVP_PBE_scryptrš   rR   Z
_MEM_LIMITrä   ÚMemoryErrorr~   rÜ   )r|   rß   rÞ   rÝ   r  Úrrü   r   rà   r“   r‚   Z
min_memoryr^   r^   r_   Úderive_scryptŽ	  s.   öýzBackend.derive_scryptc                 C   s2   t  |¡}| jr|| jvrdS | j |¡| jjkS r±   )r   Z_aead_cipher_namero   Ú
_fips_aeadrl   r  rj   rˆ   )r|   rÁ   Úcipher_namer^   r^   r_   Úaead_cipher_supported©	  s   
zBackend.aead_cipher_supportedc              
   c   s2    t |ƒ}z|V  W |  ||¡ dS |  ||¡ w )zÁ
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)Ú	bytearrayÚ
_zero_data)r|   rÝ   r   r^   r^   r_   r  ¯	  s
   €zBackend._zeroed_bytearrayc                 C   s   t |ƒD ]}d||< qd S r†   )Úrange)r|   r  rÝ   r  r^   r^   r_   rJ  ¼	  s   
ÿzBackend._zero_datac                 c   s~    |du r| j jV  dS t|ƒ}| j  d|d ¡}| j  |||¡ z|V  W |  | j  d|¡|¡ dS |  | j  d|¡|¡ w )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr–   rg   z	uint8_t *)rj   rˆ   rš   r™   ÚmemmoverJ  Úcast)r|   r  Údata_lenr   r^   r^   r_   Ú_zeroed_null_terminated_bufÃ	  s   €2z#Backend._zeroed_null_terminated_bufc                 C   s  |d ur
t  d|¡ |  |¡}| j |j| jj¡}|| jjkr'|  ¡  t	dƒ‚| j 
|| jj¡}| j d¡}| j d¡}| j d¡}|  |¡}| j |||||¡}	W d   ƒ n1 s\w   Y  | jjri|  ¡  |	dkru|  ¡  t	dƒ‚d }
d }g }|d | jjkr“| j 
|d | jj¡}|  |¡}|d | jjkr«| j 
|d | jj¡}|  |¡}
|d | jjkrý| j 
|d | jj¡}| j |d ¡}| jjrÏt|ƒ}ntt|ƒƒ}|D ]%}| j ||¡}|  || jjk¡ | j 
|| jj¡}|  |¡}| |¡ q×||
|fS )Nr™  z!Could not deserialize PKCS12 datar"  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data)r   r¹  r  rl   Zd2i_PKCS12_biorY   rj   rˆ   rã   rÅ   rñ   ÚPKCS12_freer™   rO  ZPKCS12_parser(  r  r*  ru  rz  Úsk_X509_freeÚsk_X509_numÚ#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERrK  ÚreversedÚsk_X509_valuer„   rz   )r|   r  r™  rY   Úp12Zevp_pkey_ptrZx509_ptrZsk_x509_ptrÚpassword_bufr“   r§  r¢   Zadditional_certificatesrø   r   Úsk_x509rí   Úindicesr  Z	addl_certr^   r^   r_   Ú%load_key_and_certificates_from_pkcs12Ú	  sV   

ÿÿ




z-Backend.load_key_and_certificates_from_pkcs12c                 C   sÎ  d }|d urt  d|¡ t|tjƒrd}d}d}	d}
nt|tjƒr1| jj}| jj}d}	d}
|j}nt	dƒ‚|d u s?t
|ƒdkrD| jj}n-| j ¡ }| j || jj¡}g }|D ]}|  |¡}| |¡ | j ||¡}t |dk¡ qV|  |¡@}|  |¡+}|r„|  |¡n| jj}|r|jn| jj}| j ||||||||	|
d¡
}W d   ƒ n1 sªw   Y  W d   ƒ n1 s¹w   Y  |  || jjk¡ | j || jj¡}|  ¡ }| j ||¡}|  |dk¡ |  |¡S )Nr©   r·  r   i N  rg   zUnsupported key encryption type)r   r7  r²   r4   rö  r÷  rl   Z&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr™  rÅ   rš   rj   rˆ   Úsk_X509_new_nullrñ   rQ  r¬  rz   Úsk_X509_pushÚbackendr„   rO  rk  ZPKCS12_createrP  r  Zi2d_PKCS12_bior  )r|   r©   r¢   r§  Zcasrý  r™  Znid_certZnid_keyZpkcs12_iterZmac_iterrX  Zossl_casÚcaZossl_car“   rW  Zname_bufrâ  rø   rV  rY   r^   r^   r_   Ú(serialize_key_and_certificates_to_pkcs12
  sh   ÿ



öý€ÿ
z0Backend.serialize_key_and_certificates_to_pkcs12c                 C   rµ   r¶   )ro   rl   ZCryptography_HAS_POLY1305r{   r^   r^   r_   Úpoly1305_supported\
  s   zBackend.poly1305_supportedc                 C   s*   t  d|¡ t|ƒtkrtdƒ‚t| |ƒS )Nr¢   zA poly1305 key is 32 bytes long)r   r¹  rš   r(   rÅ   r)   )r|   r¢   r^   r^   r_   Úcreate_poly1305_ctxa
  s   
zBackend.create_poly1305_ctxc                 C   sn   t  d|¡ |  |¡}| j |j| jj| jj| jj¡}|| jjkr)|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S ©Nr  zUnable to parse PKCS7 data)r   r7  r  rl   ZPEM_read_bio_PKCS7rY   rj   rˆ   rã   rÅ   rñ   Ú
PKCS7_freeÚ_load_pkcs7_certificates©r|   r  rY   Úp7r^   r^   r_   Úload_pem_pkcs7_certificatesh
  s   
ÿ
z#Backend.load_pem_pkcs7_certificatesc                 C   sb   t  d|¡ |  |¡}| j |j| jj¡}|| jjkr#|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S rb  )r   r7  r  rl   Zd2i_PKCS7_biorY   rj   rˆ   rã   rÅ   rñ   rc  rd  re  r^   r^   r_   Úload_der_pkcs7_certificatesu
  s   

z#Backend.load_der_pkcs7_certificatesc           
      C   sÊ   | j  |j¡}|  || j jk¡ || j jkrtd |¡tj	ƒ‚|j
jj}| j  |¡}g }t|ƒD ]2}| j  ||¡}|  || jjk¡ | j  |¡}|  |dk¡ | j || j j¡}|  |¡}	| |	¡ q0|S )NzNOnly basic signed structures are currently supported. NID for this data was {}rg   )rl   ZOBJ_obj2nidr¿   r„   r”  ZNID_pkcs7_signedr   r~   r   ZUNSUPPORTED_SERIALIZATIONrþ   Úsignr§  rR  rK  rU  rj   rˆ   ZX509_up_refrñ   ru  rz  rz   )
r|   rf  r•  rX  rí   Úcertsr  r   r“   r§  r^   r^   r_   rd  €
  s(   ý

z Backend._load_pkcs7_certificatesc                 C   s¤  |   |j¡}| jj}d}t|jƒdkr| jj}n.| j ¡ }| j 	|| jj
¡}g }|jD ]}	|  |	¡}
| |
¡ | j ||
¡}|  |dk¡ q+tjj|v rX|| jjO }|| jjO }| j | jj| jj|| jj|¡}|  || jjk¡ | j 	|| jj¡}d}tjj|v r‰|| jjO }ntjj|v r•|| jjO }tjj|v r¡|| jjO }|jD ]#\}}}|  |¡}
|  |¡}| j ||
|j||¡}|  || jjk¡ q¤|D ]}|tjju rÙ|| jj O }qÊ|tjj!u rå|| jj"O }qÊ|  #¡ }|t$j%j&u rû| j '|||j(|¡}nK|t$j%j)u r| j *||j(|¡}|  |dk¡ | j +|||j(|¡}n)|t$j%j,u s&J ‚| j *||j(|¡}|  |dk¡ | jj-r?|  .¡  | j /||¡}|  |dk¡ |  0|¡S )Nr   rg   )1r  Ú_datarl   ZPKCS7_PARTIALrš   Z_additional_certsrj   rˆ   r[  rñ   rQ  r¬  rz   r\  r„   rS   ZPKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDZ
PKCS7_signrc  ZNoCapabilitiesZPKCS7_NOSMIMECAPZNoAttributesZPKCS7_NOATTRZNoCertsZPKCS7_NOCERTSZ_signersr°   ZPKCS7_sign_add_signerrk  ÚTextZ
PKCS7_TEXTÚBinaryZPKCS7_BINARYr  r4   rª  ZSMIMEZSMIME_write_PKCS7rY   rø  ZPKCS7_finalZPEM_write_bio_PKCS7_streamr«  rS  rã   Zi2d_PKCS7_bior  )r|   rW  rü  ÚoptionsrY   Z
init_flagsZfinal_flagsrj  rë  r§  râ  r“   rf  Zsigner_flagsZcertificaterU  Zhash_algorithmÚmdZp7signerinfoÚoptionZbio_outr^   r^   r_   Ú
pkcs7_signš
  s€   




û

ÿ€
ÿ
ÿ

zBackend.pkcs7_signrŒ   )Èr[   r\   r]   Ú__doc__r©   rF  r@   rI   r¾   r3   r,  r-  r.  r/  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r³   r7   Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1rî  Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusr}   r€   r„   rn   r   r”   Ú
contextlibr   r•   rw   rž   r   r    r¤   r®   r°   r´   r·   r»   r½   rÄ   rÈ   rq   rr   rÕ   r×   rÙ   rá   rã   rä   rê   rï   rù   rû   r  r  r
  rô   r  r  r  r*  r+  r0  r3  r6  r9  r;  rA  rE  rG  rH  r7  rI  rJ  rM  rN  rV  r   rc  r?   ÚtypingÚOptionalrR  ZCertificateSigningRequestrs  rt  ÚCertificater|  rd  rx  r  r‚  ZCertificateRevocationListrŠ  rl  r‘  rŒ  r–  ZRevokedCertificater—  rš  rŸ  r   r¢  r¡  r¥  r¦  ÚAnyr¬  rz  r°  rp  r³  r‡  rV   rŠ   r´  r¶  r˜  rœ  rÆ  rÇ  rË  rÑ  rÒ  rÚ  rÞ  rÈ  rß  rå  rì  rí  rï  rÉ  rÂ  rÖ  rÛ  rÏ  r   rù  rú  r  r  r	  r
  r  r  r  r  r  r  r  rW   Úbytesr  r  r!  r#  r%  r)  r/  r2  r3  r4  r6  r:  r;  r<  r=  r?  r@  rA  rE  rH  r  rJ  rO  rZ  r_  r`  ra  rg  rh  rd  rq  r^   r^   r^   r_   r   ˆ   sÀ   ôü
		1"-+	þý
ü
ûQþý
ü
ûN	þý
ü
ûR)ÿ
þÿ
þÿ
þÿÿ
þÿ
þ5.		#\


i0
.">Dr   c                   @   s   e Zd Zdd„ Zdd„ ZdS )rÉ   c                 C   s
   || _ d S rŒ   )Ú_fmt)r|   Úfmtr^   r^   r_   r}   ô
  r¡   zGetCipherByName.__init__c                 C   s&   | j j||d ¡ }|j | d¡¡S )N)rÁ   r‹   r˜   )ry  r~   Úlowerrl   r  r«   )r|   r]  rÁ   r‹   rG  r^   r^   r_   Ú__call__÷
  s   zGetCipherByName.__call__N)r[   r\   r]   r}   r|  r^   r^   r^   r_   rÉ   ó
  s    rÉ   c                 C   s"   d  |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsr  r˜   )r~   rö   rl   r  r«   )r]  rÁ   r‹   rG  r^   r^   r_   rÌ   ü
  s   rÌ   )‚Úcollectionsrs  rÊ   rt  rt   r   Zcryptographyr   r   Zcryptography.exceptionsr   r   Z'cryptography.hazmat.backends.interfacesr   ZBackendInterfaceZ$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr	   Z)cryptography.hazmat.backends.openssl.cmacr   Z0cryptography.hazmat.backends.openssl.decode_asn1r   Z'cryptography.hazmat.backends.openssl.dhr   r   r   r   Z(cryptography.hazmat.backends.openssl.dsar   r   r   Z'cryptography.hazmat.backends.openssl.ecr   r   Z,cryptography.hazmat.backends.openssl.ed25519r   r   Z*cryptography.hazmat.backends.openssl.ed448r   r   r   Z0cryptography.hazmat.backends.openssl.encode_asn1r   r   r   r   r   r    r!   r"   r#   Z+cryptography.hazmat.backends.openssl.hashesr%   Z)cryptography.hazmat.backends.openssl.hmacr'   Z-cryptography.hazmat.backends.openssl.poly1305r(   r)   Z(cryptography.hazmat.backends.openssl.rsar*   r+   Z+cryptography.hazmat.backends.openssl.x25519r,   r-   Z)cryptography.hazmat.backends.openssl.x448r.   r/   Z)cryptography.hazmat.backends.openssl.x509r0   Z"cryptography.hazmat.bindings._rustr1   r’  Z$cryptography.hazmat.bindings.opensslr2   Zcryptography.hazmat.primitivesr3   r4   Z)cryptography.hazmat.primitives.asymmetricr5   r6   r7   r8   r9   r:   Z1cryptography.hazmat.primitives.asymmetric.paddingr;   r<   r=   r>   Z/cryptography.hazmat.primitives.asymmetric.typesr?   Z1cryptography.hazmat.primitives.ciphers.algorithmsr@   rA   rB   rC   rD   rE   rF   rG   rH   rI   Z,cryptography.hazmat.primitives.ciphers.modesrJ   rK   rL   rM   rN   rO   rP   rQ   Z"cryptography.hazmat.primitives.kdfrR   Z,cryptography.hazmat.primitives.serializationrS   rT   Zcryptography.x509rU   Zcryptography.x509.baserV   Zcryptography.x509.namerW   Ú
namedtuplerX   ÚobjectrZ   rÉ   rÌ   r]  r^   r^   r^   r_   Ú<module>   s‚   , 0(
                    	
