U
    §òcc*‹ ã                   @   s¸  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZmZ d dlmZm Z  d dl!m"Z"m#Z#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5mZ6 d dl7m8Z8 d dl9m:Z:m;Z; d dl<m=Z= d dl>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZF d dlGmHZHmIZImJZJmKZK d dlLmMZMmNZNmOZO d dlPmQZQmRZR d dlSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ d dl`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZi d dljmkZk d dllmmZmmnZn d dlompZpmqZqmrZrmsZsmtZt e  ud d!d"g¡ZvG d#d$„ d$ƒZwG d%d&„ d&ƒZxG d'd(„ d(ƒZyexeTd)œd*d+„Zzexƒ Z{dS ),é    N)Úcontextmanager)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)Úaead)Ú_CipherContext©Ú_CMACContext)Ú_DHParametersÚ_DHPrivateKeyÚ_DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey©Ú_HashContext©Ú_HMACContext)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)r   )Úbinding)ÚhashesÚserialization)ÚAsymmetricPadding)ÚdhÚdsaÚecÚed25519Úed448ÚrsaÚx25519Úx448)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)Ú#CERTIFICATE_ISSUER_PUBLIC_KEY_TYPESÚPRIVATE_KEY_TYPESÚPUBLIC_KEY_TYPES)ÚBlockCipherAlgorithmÚCipherAlgorithm)ÚAESÚAES128ÚAES256ÚARC4ÚCamelliaÚChaCha20ÚSM4Ú	TripleDESÚ_BlowfishInternalÚ_CAST5InternalÚ_IDEAInternalÚ_SEEDInternal)	ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚModeÚOFBÚXTS)Úscrypt)Úpkcs7Ússh)ÚPBESÚPKCS12CertificateÚPKCS12KeyAndCertificatesÚ_ALLOWED_PKCS12_TYPESÚ_PKCS12_CAS_TYPESÚ
_MemoryBIOÚbioZchar_ptrc                   @   s   e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú__qualname__© r]   r]   úf/var/www/html/project/venv/lib/python3.8/site-packages/cryptography/hazmat/backends/openssl/backend.pyrY   ƒ   s   rY   c                   @   sf
  e Zd ZdZdZddddddhZefZej	ej
ejejejejejejejejejejfZejejejejfZd	Zd
Zdd	> Zd	Zde> Z dd„ Z!e"dœdd„Z#dDe$e%j&e%j'e(j)  ddœdd„Z*e$dœdd„Z+ddœdd„Z,ddœdd„Z-e.j/dd„ ƒZ0ddœdd„Z1e"dœdd „Z2e"dœd!d"„Z3e4dœd#d$„Z5e6ej7e8d%œd&d'„Z9ej7d(œd)d*„Z:ej7d(œd+d,„Z;ej7e$d-œd.d/„Z<ej7e$d-œd0d1„Z=e$dœd2d3„Z>ej7e$d-œd4d5„Z?ej7ej@d-œd6d7„ZAeBeCe$d8œd9d:„ZDd;d<„ ZEddœd=d>„ZFeBeCeGd8œd?d@„ZHeBeCeGd8œdAdB„ZIej7e$d-œdCdD„ZJej7e4e6e4e6e6dEœdFdG„ZKe%j'e(j) dœdHdI„ZLe%j'e(jM dœdJdK„ZNe4dœdLdM„ZOdEe4dNœdOdP„ZPe4e4eQjRdQœdRdS„ZSe4e4e$dQœdTdU„ZTeQjUeQjRdVœdWdX„ZVeQjWeQjXdVœdYdZ„ZYd[d\„ ZZd]d^„ Z[e6d_œd`da„Z\dbdc„ Z]e6dœddde„Z^e_dœdfdg„Z`eadœdhdi„Zbej7e$d-œdjdk„Zcede$dlœdmdn„Zee4efjgdoœdpdq„Zhefjgefjidrœdsdt„Zje4efjidoœdudv„Zkdwdx„ ZlefjmefjidVœdydz„ZnefjoefjpdVœd{d|„ZqefjrefjgdVœd}d~„Zsdd€„ Zte$dœdd‚„Zuej7e$d-œdƒd„„Zve$dœd…d†„Zwexeyd-œd‡dˆ„Zze6e%j&e6 e_d‰œdŠd‹„Z{e6eadŒœddŽ„Z|e6e}j~dŒœdd„Ze6e%j&e6 e_d‰œd‘d’„Z€d“d”„ Ze6eadŒœd•d–„Z‚e6e}j~dŒœd—d˜„Zƒe„j…e%j†d™œdšd›„Z‡e%j†e„j…dœœddž„Zˆe„j‰e%j†dŸœd d¡„ZŠe%j†e„j‰d¢œd£d¤„Z‹e„jŒe%j†d¥œd¦d§„Ze%j†e„jŒd¨œd©dª„ZŽe„jŒee$d«œd¬d­„Ze„j‰e$dŸœd®d¯„Z‘d°d±„ Z’d²d³„ Z“e%j”dœd´dµ„Z•ej–e$d¶œd·d¸„Z—ej˜ej–e$d¹œdºd»„Z™ej–ejšd¶œd¼d½„Z›ejœejšdVœd¾d¿„ZejžejŸdVœdÀdÁ„Z ej–e6ejŸdÂœdÃdÄ„Z¡e4ej–ejšdÅœdÆdÇ„Z¢ej–dÈœdÉdÊ„Z£e4dËœdÌdÍ„Z¤ej¥ej–e$dÎœdÏdÐ„Z¦dÑdÒ„ Z§ej–e4d¶œdÓdÔ„Z¨e/dÕdÖ„ ƒZ©d×dØ„ Zªe4e4dÙœdÚdÛ„Z«e¬j­e¬j®e¬j¯e6dÜœdÝdÞ„Z°dßdà„ Z±dádâ„ Z²e¬j­e¬j³e6dãœdädå„Z´e$dœdædç„Zµe4e4e}j~dèœdédê„Z¶dëdì„ Z·e}j~e}j¸drœdídî„Z¹e4e4e}j¸dèœdïdð„Zºe}j»e}j¸dVœdñdò„Z¼e}j½e}j¾dVœdódô„Z¿e}jÀe}j~dVœdõdö„ZÁdFe4e4e%j&e4 e$d÷œdødù„ZÂe$dœdúdû„ZÃe6eÄjÅdŒœdüdý„ZÆe6eÄjÇdŒœdþdÿ„ZÈd d„ ZÉeÄjÇdœdd„ZÊe$dœdd„ZËe6eÌjÍdŒœdd„ZÎe6eÌjÏdŒœdd	„ZÐeÌjÏdœd
d„ZÑe$dœdd„ZÒe$dœdd„ZÓe6eÔjÕdŒœdd„ZÖe6eÔj×dŒœdd„ZØeÔj×dœdd„ZÙe$dœdd„ZÚe6eÛjÜdŒœdd„ZÝe6eÛjÞdŒœdd„ZßeÛjÞdœdd„Zàe6e6e4e4e4e4e6dœdd „Záe$dœd!d"„Zâe.j/e4e%jãeä d#œd$d%„ƒZåe4dd#œd&d'„Zæe.j/d(d)„ ƒZçe6e%j&e6 e%jèe%j&e_ e%j&e„j… e%j'e„j… f d‰œd*d+„Zée6e%j&e6 eêd‰œd,d-„Zëe%j&e6 e%j&eì e%j&e„j… e%j&e%j'eí  e¬j¯e6d.œd/d0„Zîe$dœd1d2„Zïe6eðd3œd4d5„Zñe$dœd6d7„Zòe6e%j'e„j… dŒœd8d9„Zóe6e%j'e„j… dŒœd:d;„Zôd<d=„ Zõe%j'e„j… e¬j­d>œd?d@„Zöe÷jøe¬j­e%j'e÷jù e6dAœdBdC„ZúdS (G  ÚBackendz)
    OpenSSL API binding interfaces.
    Zopenssls   aes-128-ccms   aes-192-ccms   aes-256-ccms   aes-128-gcms   aes-192-gcms   aes-256-gcmé   i  é   c                 C   sˆ   t  ¡ | _| jj| _| jj| _d| _|  ¡ | _	i | _
|  ¡  | j	rX| jjrXt dt¡ n|  ¡  | jjg| _| jjr„| j | jj¡ d S )NFz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r%   ZBindingÚ_bindingÚffiÚ_ffiÚlibÚ_libÚ_rsa_skip_check_keyÚ_is_fips_enabledÚ_fips_enabledÚ_cipher_registryÚ_register_default_ciphersÚ"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEÚwarningsÚwarnÚUserWarningÚactivate_osrandom_engineZEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendZEVP_PKEY_DHX©Úselfr]   r]   r^   Ú__init__¹   s     



þzBackend.__init__)Úreturnc                 C   s   d  |  ¡ | j¡S )Nz'<OpenSSLBackend(version: {}, FIPS: {})>)ÚformatÚopenssl_version_textri   rt   r]   r]   r^   Ú__repr__Í   s     ÿzBackend.__repr__N)ÚokÚerrorsrw   c                 C   s   t j| j||dS )N)r|   )r%   Z_openssl_assertrf   )ru   r{   r|   r]   r]   r^   Úopenssl_assertÒ   s    zBackend.openssl_assertc                 C   sH   | j jr| j  | jj¡}nt| j ddd„ ƒƒ }|dkr@| j  ¡  t|ƒS )NZ	FIPS_modec                   S   s   dS ©Nr   r]   r]   r]   r]   r^   Ú<lambda>ß   ó    z*Backend._is_fips_enabled.<locals>.<lambda>r   )rf   ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrd   ÚNULLÚgetattrZERR_clear_errorÚbool)ru   Úmoder]   r]   r^   rh   Ù   s    ÿ
zBackend._is_fips_enabledc                 C   s$   | j  ¡  |  ¡ st‚|  ¡ | _d S ©N)rb   Ú_enable_fipsrh   ÚAssertionErrorri   rt   r]   r]   r^   r†   æ   s    
zBackend._enable_fipsc                 C   sf   | j jrb| j  ¡ }|| jjkrb| j  |¡ | j  | jj¡}|  |dk¡ | j  |¡}|  |dk¡ d S ©Nra   )	rf   rl   ZENGINE_get_default_RANDrd   r   ZENGINE_unregister_RANDÚRAND_set_rand_methodr}   ÚENGINE_finish©ru   ÚeÚresr]   r]   r^   Úactivate_builtin_randomí   s    
zBackend.activate_builtin_randomc              
   c   s‚   | j  | j j¡}|  || jjk¡ | j  |¡}|  |dk¡ z
|V  W 5 | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ X d S rˆ   )	rf   ZENGINE_by_idZCryptography_osrandom_engine_idr}   rd   r   ZENGINE_initZENGINE_freerŠ   r‹   r]   r]   r^   Ú_get_osurandom_engineú   s    
zBackend._get_osurandom_enginec              	   C   s`   | j jr\|  ¡  |  ¡  }| j  |¡}|  |dk¡ W 5 Q R X | j  | jj¡}|  |dk¡ d S rˆ   )	rf   rl   rŽ   r   ZENGINE_set_default_RANDr}   r‰   rd   r   r‹   r]   r]   r^   rp     s    
z Backend.activate_osrandom_enginec              	   C   s`   | j  dd¡}|  ¡ 2}| j |dt|ƒ|| j jd¡}|  |dk¡ W 5 Q R X | j  |¡ 	d¡S )Núchar[]é@   s   get_implementationr   Úascii)
rd   Únewr   rf   ZENGINE_ctrl_cmdÚlenr   r}   ÚstringÚdecode)ru   ÚbufrŒ   r   r]   r]   r^   Úosrandom_engine_implementation  s    
     ÿz&Backend.osrandom_engine_implementationc                 C   s   | j  | j | jj¡¡ d¡S )zÀ
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r’   )rd   r•   rf   ZOpenSSL_versionÚOPENSSL_VERSIONr–   rt   r]   r]   r^   ry   #  s
    ÿþzBackend.openssl_version_textc                 C   s
   | j  ¡ S r…   )rf   ZOpenSSL_version_numrt   r]   r]   r^   Úopenssl_version_number.  s    zBackend.openssl_version_number)ÚkeyÚ	algorithmrw   c                 C   s   t | ||ƒS r…   r   )ru   r›   rœ   r]   r]   r^   Úcreate_hmac_ctx1  s    zBackend.create_hmac_ctx)rœ   c                 C   sL   |j dks|j dkr0d |j |jd ¡ d¡}n|j  d¡}| j |¡}|S )NÚblake2bÚblake2sz{}{}é   r’   )Únamerx   Údigest_sizeÚencoderf   ZEVP_get_digestbyname)ru   rœ   ÚalgÚevp_mdr]   r]   r^   Ú_evp_md_from_algorithm6  s     ÿþzBackend._evp_md_from_algorithmc                 C   s    |   |¡}|  || jjk¡ |S r…   )r¦   r}   rd   r   ©ru   rœ   r¥   r]   r]   r^   Ú_evp_md_non_null_from_algorithmA  s    
z'Backend._evp_md_non_null_from_algorithm)rœ   rw   c                 C   s,   | j rt|| jƒsdS |  |¡}|| jjkS ©NF)ri   Ú
isinstanceÚ_fips_hashesr¦   rd   r   r§   r]   r]   r^   Úhash_supportedF  s    
zBackend.hash_supportedc                 C   s    | j rt|tjƒrdS |  |¡S r©   ©ri   rª   r&   ÚSHA1r¬   ©ru   rœ   r]   r]   r^   Úsignature_hash_supportedM  s    z Backend.signature_hash_supportedc                 C   s   | j r
dS | jjdkS d S ©NFra   )ri   rf   ZCryptography_HAS_SCRYPTrt   r]   r]   r^   Úscrypt_supportedV  s    zBackend.scrypt_supportedc                 C   s    | j rt|tjƒrdS |  |¡S )NTr­   r¯   r]   r]   r^   Úhmac_supported\  s    zBackend.hmac_supportedc                 C   s
   t | |ƒS r…   r   r¯   r]   r]   r^   Úcreate_hash_ctxc  s    zBackend.create_hash_ctx)Úcipherr„   rw   c                 C   s`   | j rt|| jƒsdS z| jt|ƒt|ƒf }W n tk
rF   Y dS X || ||ƒ}| jj|kS r©   )ri   rª   Ú_fips_ciphersrj   ÚtypeÚKeyErrorrd   r   )ru   rµ   r„   ÚadapterÚ
evp_cipherr]   r]   r^   Úcipher_supportedh  s    zBackend.cipher_supportedc                 C   s0   ||f| j krtd ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)rj   Ú
ValueErrorrx   )ru   Ú
cipher_clsÚmode_clsr¹   r]   r]   r^   Úregister_cipher_adapterv  s     ÿÿzBackend.register_cipher_adapterc                 C   sŽ  t ttfD ].}ttttttt	fD ]}|  
||tdƒ¡ q q
tttttfD ]}|  
t|tdƒ¡ qHttttfD ]}|  
t|tdƒ¡ ql|  
tttdƒ¡ ttttfD ]}|  
t|tdƒ¡ q¢ttttfD ]}|  
t|tdƒ¡ qÆt ttgttttg¡D ]\}}|  
||tdƒ¡ qö|  
ttd ƒtdƒ¡ |  
ttd ƒtdƒ¡ |  
ttd ƒtd	ƒ¡ |  
t tt¡ tttttfD ]}|  
t|td
ƒ¡ qpd S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20zsm4-{mode.name})r:   r;   r<   rF   rI   rJ   rM   rG   rH   rK   r¿   ÚGetCipherByNamer>   rA   rB   rE   Ú	itertoolsÚproductrC   rD   r=   r·   rY   r?   rN   Ú_get_xts_cipherr@   )ru   r½   r¾   r]   r]   r^   rk     sz    ÿýý  ÿ  ÿ  ÿ  ÿ
þý  ÿ  ÿz!Backend._register_default_ciphersc                 C   s   t | ||t jƒS r…   )r   Z_ENCRYPT©ru   rµ   r„   r]   r]   r^   Úcreate_symmetric_encryption_ctx³  s    z'Backend.create_symmetric_encryption_ctxc                 C   s   t | ||t jƒS r…   )r   Z_DECRYPTrÄ   r]   r]   r^   Úcreate_symmetric_decryption_ctx¸  s    z'Backend.create_symmetric_decryption_ctxc                 C   s
   |   |¡S r…   )r³   r¯   r]   r]   r^   Úpbkdf2_hmac_supported½  s    zBackend.pbkdf2_hmac_supported)rœ   ÚlengthÚsaltÚ
iterationsÚkey_materialrw   c           
   
   C   sh   | j  d|¡}|  |¡}| j  |¡}| j |t|ƒ|t|ƒ||||¡}	|  |	dk¡ | j  |¡d d … S )Núunsigned char[]ra   )	rd   r“   r¨   Úfrom_bufferrf   ZPKCS5_PBKDF2_HMACr”   r}   Úbuffer)
ru   rœ   rÈ   rÉ   rÊ   rË   r—   r¥   Úkey_material_ptrr   r]   r]   r^   Úderive_pbkdf2_hmacÀ  s    
ø
zBackend.derive_pbkdf2_hmacc                 C   s   t  | j¡S r…   )r%   Ú_consume_errorsrf   rt   r]   r]   r^   rÑ   Ø  s    zBackend._consume_errorsc                 C   s   t  | j¡S r…   )r%   Ú_consume_errors_with_textrf   rt   r]   r]   r^   rÒ   Û  s    z!Backend._consume_errors_with_textc                 C   sz   || j jkst‚|  | j |¡ ¡ | j |¡}| j  d|¡}| j ||¡}|  |dk¡ t	 
| j  |¡d |… d¡}|S )NrÌ   r   Úbig)rd   r   r‡   r}   rf   ZBN_is_negativeZBN_num_bytesr“   Z	BN_bn2binÚintÚ
from_bytesrÎ   )ru   ÚbnZbn_num_bytesZbin_ptrZbin_lenÚvalr]   r]   r^   Ú
_bn_to_intà  s    zBackend._bn_to_int)Únumc                 C   sn   |dks|| j jkst‚|dkr(| j j}| t| ¡ d d ƒd¡}| j |t|ƒ|¡}|  	|| j jk¡ |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @ra   rÓ   )
rd   r   r‡   Úto_bytesrÔ   Ú
bit_lengthrf   Z	BN_bin2bnr”   r}   )ru   rÙ   rÖ   ÚbinaryZbn_ptrr]   r]   r^   Ú
_int_to_bnì  s    zBackend._int_to_bn)Úpublic_exponentÚkey_sizerw   c                 C   s”   t  ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||| jƒS rˆ   )r.   Z_verify_rsa_parametersrf   ÚRSA_newr}   rd   r   ÚgcÚRSA_freerÝ   ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyr   rg   )ru   rÞ   rß   Ú	rsa_cdatarÖ   r   Úevp_pkeyr]   r]   r^   Úgenerate_rsa_private_keyý  s(    

   ÿ
   ÿz Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )Né   ra   r   i   r]   )ru   rÞ   rß   r]   r]   r^   Ú!generate_rsa_parameters_supported  s
    
ÿýz)Backend.generate_rsa_parameters_supported)Únumbersrw   c              
   C   s6  t  |j|j|j|j|j|j|jj	|jj
¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |jj	¡}	|  |jj
¡}
| j |||¡}|  |dk¡ | j ||
|	|¡}|  |dk¡ | j ||||¡}|  |dk¡ |  |¡}t| ||| jƒS rˆ   )r.   Z_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersrŒ   Únrf   rà   r}   rd   r   rá   râ   rÝ   ZRSA_set0_factorsÚRSA_set0_keyZRSA_set0_crt_paramsrä   r   rg   )ru   rê   rå   rë   rì   rí   rî   rï   rð   rŒ   rò   r   ræ   r]   r]   r^   Úload_rsa_private_numbers  sD    ø


   ÿz Backend.load_rsa_private_numbersc                 C   s   t  |j|j¡ | j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS rˆ   )r.   Z_check_public_key_componentsrŒ   rò   rf   rà   r}   rd   r   rá   râ   rÝ   ró   rä   r    )ru   rê   rå   rŒ   rò   r   ræ   r]   r]   r^   Úload_rsa_public_numbers@  s    

zBackend.load_rsa_public_numbersc                 C   s2   | j  ¡ }|  || jjk¡ | j || j j¡}|S r…   )rf   ZEVP_PKEY_newr}   rd   r   rá   ÚEVP_PKEY_free©ru   ræ   r]   r]   r^   Ú_create_evp_pkey_gcO  s    
zBackend._create_evp_pkey_gcc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_RSAr}   )ru   rå   ræ   r   r]   r]   r^   rä   U  s    zBackend._rsa_cdata_to_evp_pkey)Údatac                 C   sH   | j  |¡}| j |t|ƒ¡}|  || j jk¡ t| j  || jj	¡|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rd   rÍ   rf   ZBIO_new_mem_bufr”   r}   r   rW   rá   ÚBIO_free)ru   rù   Údata_ptrrX   r]   r]   r^   Ú_bytes_to_bio[  s    zBackend._bytes_to_bioc                 C   sP   | j  ¡ }|  || jjk¡ | j  |¡}|  || jjk¡ | j || j j¡}|S )z.
        Creates an empty memory BIO.
        )rf   Z	BIO_s_memr}   rd   r   ZBIO_newrá   rú   )ru   Z
bio_methodrX   r]   r]   r^   Ú_create_mem_bio_gch  s    
zBackend._create_mem_bio_gcc                 C   s\   | j  d¡}| j ||¡}|  |dk¡ |  |d | j jk¡ | j  |d |¡dd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rd   r“   rf   ZBIO_get_mem_datar}   r   rÎ   )ru   rX   r—   Úbuf_lenÚbio_datar]   r]   r^   Ú_read_mem_bios  s    zBackend._read_mem_bioc           	      C   sD  | j  |¡}|| j jkrX| j  |¡}|  || jjk¡ | j || j j¡}t	| ||| j
ƒS || j jkrä| j jsä| j jsä| j jsä| j  |¡}|  || jjk¡ | j || j j¡}|  ¡ }| j  ||¡}|  |dk¡ | j|  |¡ddS || j jkr.| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrx| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jkrÀ| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrÞt | |ƒS |t| j ddƒkrüt!| |ƒS |t| j ddƒkrt"| |ƒS |t| j ddƒkr8t#| |ƒS t$dƒ‚dS )	zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ra   N)ÚpasswordÚEVP_PKEY_ED25519ÚEVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.)%rf   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAr}   rd   r   rá   râ   r   rg   ÚEVP_PKEY_RSA_PSSÚCRYPTOGRAPHY_IS_LIBRESSLÚCRYPTOGRAPHY_IS_BORINGSSLÚ#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Erý   Úi2d_RSAPrivateKey_bioÚload_der_private_keyr   ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer   rq   ÚEVP_PKEY_get1_DHÚDH_freer   r‚   r   r#   r!   r   r   )	ru   ræ   Úkey_typerå   rX   r   Ú	dsa_cdataÚec_cdataÚdh_cdatar]   r]   r^   Ú_evp_pkey_to_private_key~  sj       ÿ
ÿþýü
 ÿ



z Backend._evp_pkey_to_private_keyc           
      C   sJ  | j  |¡}|| j jkrT| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krÜ| j jsÜ| j jsÜ| j jsÜ| j  |¡}|  || jjk¡ | j || j j¡}|  ¡ }| j  ||¡}|  |dk¡ |  |  |¡¡S || j jkr&| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkr~| j  |¡}|| jjkr`|  ¡ }td|ƒ‚| j || j j¡}t| ||ƒS || jkrÆ| j  |¡}	|  |	| jjk¡ | j |	| j j¡}	t| |	|ƒS |t | j ddƒkrät!| |ƒS |t | j ddƒkrt"| |ƒS |t | j ddƒkr t#| |ƒS |t | j ddƒkr>t$| |ƒS t%dƒ‚dS )	zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        ra   zUnable to load EC keyr  Nr  r  r  r  )&rf   r  r  r	  r}   rd   r   rá   râ   r    r
  r  r  r  rý   Úi2d_RSAPublicKey_bioÚload_der_public_keyr   r  r  r  r   r  r  rÒ   r¼   r  r   rq   r  r  r   r‚   r   r$   r"   r   r   )
ru   ræ   r  rå   rX   r   r  r  r|   r  r]   r]   r^   Ú_evp_pkey_to_public_key¾  s^    
ÿþýü




zBackend._evp_pkey_to_public_keyc                 C   s   t |tjtjtjtjtjfƒS r…   )rª   r&   r®   ÚSHA224ÚSHA256ÚSHA384ÚSHA512r¯   r]   r]   r^   Ú_oaep_hash_supportedø  s    ûþzBackend._oaep_hash_supported)Úpaddingrw   c                 C   s†   t |tƒrdS t |tƒrNt |jtƒrN| jr>t |jjtjƒr>dS |  	|jj¡S n4t |t
ƒr~t |jtƒr~|  |jj¡o||  |j¡S dS d S )NTF)rª   r3   r4   Z_mgfr1   ri   Ú
_algorithmr&   r®   r¬   r2   r$  )ru   r%  r]   r]   r^   Úrsa_padding_supported  s     
 ÿÿ
þzBackend.rsa_padding_supported)rß   rw   c              	   C   s~   |dkrt dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}|  |dk¡ t	| |ƒS )N)i   r`   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   ra   )
r¼   rf   ÚDSA_newr}   rd   r   rá   r  ZDSA_generate_parameters_exr   )ru   rß   Úctxr   r]   r]   r^   Úgenerate_dsa_parameters  s$    ÿ
ù
zBackend.generate_dsa_parameters)Ú
parametersrw   c                 C   sT   | j  |j¡}|  || jjk¡ | j || j j¡}| j  |¡ |  	|¡}t
| ||ƒS r…   )rf   ZDSAparams_dupZ
_dsa_cdatar}   rd   r   rá   r  ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr   )ru   r+  r)  ræ   r]   r]   r^   Úgenerate_dsa_private_key/  s    ÿ
z Backend.generate_dsa_private_keyc                 C   s   |   |¡}|  |¡S r…   )r*  r-  )ru   rß   r+  r]   r]   r^   Ú'generate_dsa_private_key_and_parameters<  s    
z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j  ||||¡}|  |dk¡ | j  |||¡}|  |dk¡ d S rˆ   )rf   ÚDSA_set0_pqgr}   ZDSA_set0_key)ru   r  rë   rì   ÚgÚpub_keyÚpriv_keyr   r]   r]   r^   Ú_dsa_cdata_set_valuesB  s    zBackend._dsa_cdata_set_valuesc           
      C   s¨   t  |¡ |jj}| j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}|  |j¡}|  |jj¡}|  |j¡}|  ||||||¡ |  |¡}	t| ||	ƒS r…   )r*   Z_check_dsa_private_numbersrñ   Úparameter_numbersrf   r(  r}   rd   r   rá   r  rÝ   rë   rì   r0  ÚyÚxr3  r,  r   )
ru   rê   r4  r  rë   rì   r0  r1  r2  ræ   r]   r]   r^   Úload_dsa_private_numbersH  s    


z Backend.load_dsa_private_numbersc           	      C   s¢   t  |j¡ | j ¡ }|  || jjk¡ | j || jj	¡}|  
|jj¡}|  
|jj¡}|  
|jj¡}|  
|j¡}| jj}|  ||||||¡ |  |¡}t| ||ƒS r…   )r*   Ú_check_dsa_parametersr4  rf   r(  r}   rd   r   rá   r  rÝ   rë   rì   r0  r5  r3  r,  r   )	ru   rê   r  rë   rì   r0  r1  r2  ræ   r]   r]   r^   Úload_dsa_public_numbers]  s    

zBackend.load_dsa_public_numbersc                 C   s†   t  |¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|  	|j¡}| j ||||¡}|  |dk¡ t| |ƒS rˆ   )r*   r8  rf   r(  r}   rd   r   rá   r  rÝ   rë   rì   r0  r/  r   )ru   rê   r  rë   rì   r0  r   r]   r]   r^   Úload_dsa_parameter_numbersp  s    

z"Backend.load_dsa_parameter_numbersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_DSAr}   )ru   r  ræ   r   r]   r]   r^   r,  €  s    zBackend._dsa_cdata_to_evp_pkeyc                 C   s   | j  S r…   )ri   rt   r]   r]   r^   Údsa_supported†  s    zBackend.dsa_supportedc                 C   s   |   ¡ sdS |  |¡S r©   )r;  r°   r¯   r]   r]   r^   Údsa_hash_supported‰  s    zBackend.dsa_hash_supportedc                 C   s   |   |td|j ƒ¡S )Nó    )r»   rF   Ú
block_sizer¯   r]   r]   r^   Úcmac_algorithm_supportedŽ  s     ÿz Backend.cmac_algorithm_supportedc                 C   s
   t | |ƒS r…   r	   r¯   r]   r]   r^   Úcreate_cmac_ctx“  s    zBackend.create_cmac_ctx)rù   r  rw   c                 C   s   |   | jj| j||¡S r…   )Ú	_load_keyrf   ZPEM_read_bio_PrivateKeyr  )ru   rù   r  r]   r]   r^   Úload_pem_private_key–  s    üzBackend.load_pem_private_key)rù   rw   c                 C   sî   |   |¡}| j d¡}| j |j| jj| j | jjd¡|¡}|| jjkrd| j 	|| jj
¡}|  |¡S |  ¡  | j |j¡}|  |dk¡ | j |j| jj| j | jjd¡|¡}|| jjkrâ| j 	|| jj¡}|  |¡}t| ||ƒS |  ¡  d S )NúCRYPTOGRAPHY_PASSWORD_DATA *ÚCryptography_pem_password_cbra   )rü   rd   r“   rf   ZPEM_read_bio_PUBKEYrX   r   Ú	addressofÚ_original_librá   rö   r  rÑ   Ú	BIO_resetr}   ZPEM_read_bio_RSAPublicKeyrâ   rä   r    Ú_handle_key_loading_error)ru   rù   Úmem_bioÚuserdataræ   r   rå   r]   r]   r^   Úload_pem_public_key   s>    
 ÿú
 ÿú
zBackend.load_pem_public_keyc                 C   s^   |   |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}t| |ƒS |  	¡  d S r…   )
rü   rf   ZPEM_read_bio_DHparamsrX   rd   r   rá   r  r   rH  )ru   rù   rI  r  r]   r]   r^   Úload_pem_parametersÊ  s    
   ÿ
zBackend.load_pem_parametersc                 C   s>   |   |¡}|  ||¡}|r$|  |¡S |  | jj| j||¡S d S r…   )rü   Ú"_evp_pkey_from_der_traditional_keyr  rA  rf   Zd2i_PKCS8PrivateKey_bio)ru   rù   r  rÿ   r›   r]   r]   r^   r  Ö  s    

üzBackend.load_der_private_keyc                 C   s^   | j  |j| jj¡}|| jjkrN|  ¡  | j || j j¡}|d k	rJtdƒ‚|S |  ¡  d S d S )Nú4Password was given but private key is not encrypted.)	rf   Úd2i_PrivateKey_biorX   rd   r   rÑ   rá   rö   Ú	TypeError)ru   rÿ   r  r›   r]   r]   r^   rM  ë  s    ÿz*Backend._evp_pkey_from_der_traditional_keyc                 C   s¾   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj¡}|| jjkr²| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rˆ   )rü   rf   Zd2i_PUBKEY_biorX   rd   r   rá   rö   r  rÑ   rG  r}   Zd2i_RSAPublicKey_biorâ   rä   r    rH  )ru   rù   rI  ræ   r   rå   r]   r]   r^   r  þ  s"    

 ÿ
zBackend.load_der_public_keyc                 C   sº   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}t| |ƒS | jj	r®|  
¡  | j |j¡}|  |dk¡ | j |j| jj¡}|| jjkr®| j || jj¡}t| |ƒS |  ¡  d S rˆ   )rü   rf   Zd2i_DHparams_biorX   rd   r   rá   r  r   rr   rÑ   rG  r}   ZCryptography_d2i_DHxparams_biorH  )ru   rù   rI  r  r   r]   r]   r^   Úload_der_parameters  s"    

 ÿ
zBackend.load_der_parameters)Úcertrw   c                 C   sT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S r…   )Úpublic_bytesr'   ÚEncodingÚDERrü   rf   Zd2i_X509_biorX   rd   r   r}   rá   Ú	X509_free)ru   rR  rù   rI  r   r]   r]   r^   Ú
_cert2ossl)  s    
zBackend._cert2ossl)r   rw   c                 C   s4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S rˆ   )rý   rf   Zi2d_X509_bior}   Ú	rust_x509Zload_der_x509_certificater   )ru   r   rX   r   r]   r]   r^   Ú
_ossl2cert1  s    zBackend._ossl2cert)Úcsrrw   c                 C   sT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S r…   )rS  r'   rT  rU  rü   rf   Zd2i_X509_REQ_biorX   rd   r   r}   rá   ZX509_REQ_free)ru   rZ  rù   rI  Úx509_reqr]   r]   r^   Ú	_csr2ossl7  s    
zBackend._csr2ossl)r[  rw   c                 C   s4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S rˆ   )rý   rf   Zi2d_X509_REQ_bior}   rX  Zload_der_x509_csrr   )ru   r[  rX   r   r]   r]   r^   Ú	_ossl2csr?  s    zBackend._ossl2csr)Úcrlrw   c                 C   sT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S r…   )rS  r'   rT  rU  rü   rf   Zd2i_X509_CRL_biorX   rd   r   r}   rá   ZX509_CRL_free)ru   r^  rù   rI  Úx509_crlr]   r]   r^   Ú	_crl2osslG  s    
zBackend._crl2ossl)r_  rw   c                 C   s4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S rˆ   )rý   rf   Zi2d_X509_CRL_bior}   rX  Zload_der_x509_crlr   )ru   r_  rX   r   r]   r]   r^   Ú	_ossl2crlO  s    zBackend._ossl2crl)r^  Ú
public_keyrw   c                 C   sJ   t |tttfƒstdƒ‚|  |¡}| j ||j¡}|dkrF|  	¡  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.ra   FT)
rª   r   r    r   rP  r`  rf   ZX509_CRL_verifyÚ	_evp_pkeyrÑ   )ru   r^  rb  r_  r   r]   r]   r^   Ú_crl_is_signature_validW  s     ýþÿ
zBackend._crl_is_signature_validc                 C   s`   |   |¡}| j |¡}|  || jjk¡ | j || jj¡}| j ||¡}|dkr\|  	¡  dS dS )Nra   FT)
r\  rf   ZX509_REQ_get_pubkeyr}   rd   r   rá   rö   ZX509_REQ_verifyrÑ   )ru   rZ  r[  Úpkeyr   r]   r]   r^   Ú_csr_is_signature_validq  s    
zBackend._csr_is_signature_validc                 C   s"   | j  |j|j¡dkrtdƒ‚d S )Nra   zKeys do not correspond)rf   ZEVP_PKEY_cmprc  r¼   )ru   Úkey1Úkey2r]   r]   r^   Ú_check_keys_correspond€  s    zBackend._check_keys_correspondc           	      C   s&  |   |¡}| j d¡}|d k	rFt d|¡ | j |¡}||_t|ƒ|_||j	| jj
| j | jjd¡|ƒ}|| jj
krÆ|jdkr¾|  ¡  |jdkrštdƒ‚qÆ|jdks¨t‚td |jd	 ¡ƒ‚n|  ¡  |  ¡  | j || jj¡}|d k	rú|jdkrútd
ƒ‚|d k	r|jd	ks|d kst‚||ƒS )NrC  r  rD  r   éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.ra   rN  )rü   rd   r“   r   Ú_check_byteslikerÍ   r  r”   rÈ   rX   r   rE  rf   rF  ÚerrorrÑ   rP  r‡   r¼   rx   ÚmaxsizerH  rá   rö   Úcalled)	ru   Zopenssl_read_funcZconvert_funcrù   r  rI  rJ  Zpassword_ptrræ   r]   r]   r^   rA  „  sV    

 ÿú	

ÿÿÿÿÿÿþzBackend._load_keyc                    s¨   ˆ   ¡ }|stdƒ‚nŽ|d  ˆ jjˆ jj¡sf|d  ˆ jjˆ jj¡sfˆ jjrp|d  ˆ jj	ˆ jj
¡rptdƒ‚n4t‡ fdd„|D ƒƒrtdƒ‚nt |¡}td|ƒ‚d S )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3   s"   | ]}|  ˆ jjˆ jj¡V  qd S r…   )Ú_lib_reason_matchrf   ÚERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)Ú.0rm  rt   r]   r^   Ú	<genexpr>Õ  s
   üþz4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.zÊCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)rÑ   r¼   rp  rf   rq  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZERR_LIB_PROVZPROV_R_BAD_DECRYPTÚanyr%   Z_errors_with_text)ru   r|   Zerrors_with_textr]   rt   r^   rH  ¹  s@    ÿ ÿÿþü	÷
þö
û

ûz!Backend._handle_key_loading_error)Úcurverw   c                 C   sv   z|   |¡}W n tk
r*   | jj}Y nX | j |¡}|| jjkrP|  ¡  dS |  || jjk¡ | j 	|¡ dS d S )NFT)
Ú_elliptic_curve_to_nidr   rf   Ú	NID_undefZEC_GROUP_new_by_curve_namerd   r   rÑ   r}   ZEC_GROUP_free)ru   ru  Ú	curve_nidÚgroupr]   r]   r^   Úelliptic_curve_supportedè  s    z Backend.elliptic_curve_supported)Úsignature_algorithmru  rw   c                 C   s   t |tjƒsdS |  |¡S r©   )rª   r+   ZECDSArz  )ru   r{  ru  r]   r]   r^   Ú,elliptic_curve_signature_algorithm_supportedø  s    z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   s\   |   |¡rD|  |¡}| j |¡}|  |dk¡ |  |¡}t| ||ƒS td |j	¡t
jƒ‚dS )z@
        Generate a new private key on the named curve.
        ra   z#Backend object does not support {}.N)rz  Ú_ec_key_new_by_curverf   ZEC_KEY_generate_keyr}   Ú_ec_cdata_to_evp_pkeyr   r   rx   r¡   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)ru   ru  r  r   ræ   r]   r]   r^   Ú#generate_elliptic_curve_private_key  s    



þz+Backend.generate_elliptic_curve_private_keyc                 C   sz   |j }|  |j¡}| j |  |j¡| jj¡}| j 	||¡}|dkrR|  
¡  tdƒ‚|  ||j|j¡ |  |¡}t| ||ƒS )Nra   úInvalid EC key.)rñ   r}  ru  rd   rá   rÝ   Úprivate_valuerf   ÚBN_clear_freeÚEC_KEY_set_private_keyrÑ   r¼   Ú)_ec_key_set_public_key_affine_coordinatesr6  r5  r~  r   )ru   rê   Úpublicr  r‚  r   ræ   r]   r]   r^   Ú#load_elliptic_curve_private_numbers  s"    
 ÿ  ÿ
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |   |j¡}|  ||j|j¡ |  |¡}t| ||ƒS r…   )r}  ru  r…  r6  r5  r~  r   )ru   rê   r  ræ   r]   r]   r^   Ú"load_elliptic_curve_public_numbers0  s      ÿ
z*Backend.load_elliptic_curve_public_numbers)ru  Úpoint_bytesrw   c           	   	   C   sÎ   |   |¡}| j |¡}|  || jjk¡ | j |¡}|  || jjk¡ | j || jj¡}|  	¡ 6}| j 
|||t|ƒ|¡}|dkr’|  ¡  tdƒ‚W 5 Q R X | j ||¡}|  |dk¡ |  |¡}t| ||ƒS )Nra   z(Invalid public bytes for the given curve)r}  rf   ÚEC_KEY_get0_groupr}   rd   r   ÚEC_POINT_newrá   ÚEC_POINT_freeÚ_tmp_bn_ctxZEC_POINT_oct2pointr”   rÑ   r¼   ÚEC_KEY_set_public_keyr~  r   )	ru   ru  r‰  r  ry  ÚpointÚbn_ctxr   ræ   r]   r]   r^   Ú load_elliptic_curve_public_bytes;  s*    

    ÿ
z(Backend.load_elliptic_curve_public_bytes)r‚  ru  rw   c              	   C   sN  |   |¡}|  |¡\}}| j |¡}|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}|  ¡ r}| j |||| jj| jj|¡}	|  |	dk¡ | j |¡}
| j |¡}||||
||ƒ}	|	dkrÚ|  ¡  tdƒ‚W 5 Q R X | j ||¡}	|  |	dk¡ |  	|¡}| j || jj
¡}| j ||¡}	|  |	dk¡ |  |¡}t| ||ƒS )Nra   z'Unable to derive key from private_value)r}  Ú _ec_key_determine_group_get_funcrf   r‹  r}   rd   r   rá   rŒ  rÝ   rƒ  r  ZEC_POINT_mulZ
BN_CTX_getrÑ   r¼   rŽ  r„  r~  r   )ru   r‚  ru  r  Úget_funcry  r  Úvaluer  r   Zbn_xZbn_yÚprivateræ   r]   r]   r^   Ú!derive_elliptic_curve_private_keyQ  s>    


     ÿ

z)Backend.derive_elliptic_curve_private_key)ru  c                 C   s   |   |¡}|  |¡S r…   )rv  Ú_ec_key_new_by_curve_nid)ru   ru  rx  r]   r]   r^   r}  x  s    
zBackend._ec_key_new_by_curve)rx  c                 C   s0   | j  |¡}|  || jjk¡ | j || j j¡S r…   )rf   ZEC_KEY_new_by_curve_namer}   rd   r   rá   r  )ru   rx  r  r]   r]   r^   r—  |  s    z Backend._ec_key_new_by_curve_nid)rœ   ru  rw   c                 C   s,   | j rt|| jƒsdS |  |¡o*t|tjƒS r©   )ri   rª   Ú_fips_ecdh_curvesrz  r+   ÚECDH)ru   rœ   ru  r]   r]   r^   Ú+elliptic_curve_exchange_algorithm_supported  s     ÿ ÿz3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_EC_KEYr}   )ru   r  ræ   r   r]   r]   r^   r~    s    zBackend._ec_cdata_to_evp_pkeyc                 C   sN   dddœ}|  |j|j¡}| j | ¡ ¡}|| jjkrJtd |j¡tj	ƒ‚|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z${} is not a supported elliptic curve)
Úgetr¡   rf   Ú
OBJ_sn2nidr£   rw  r   rx   r   r  )ru   ru  Zcurve_aliasesZ
curve_namerx  r]   r]   r^   rv  “  s    

þzBackend._elliptic_curve_to_nidc              	   c   sX   | j  ¡ }|  || jjk¡ | j || j j¡}| j  |¡ z
|V  W 5 | j  |¡ X d S r…   )	rf   Z
BN_CTX_newr}   rd   r   rá   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)ru   r  r]   r]   r^   r  ¤  s    

zBackend._tmp_bn_ctxc                 C   s¼   |   || jjk¡ | j d¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ ||kr¤| jj	r¤| jj
}n| jj}|s´t‚||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r}   rd   r   rf   rœ  rw  rŠ  ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFpr‡   )ru   r)  Znid_two_fieldry  ÚmethodÚnidr“  r]   r]   r^   r’  ¯  s    
z(Backend._ec_key_determine_group_get_func)r6  r5  c                 C   st   |dk s|dk rt dƒ‚| j |  |¡| jj¡}| j |  |¡| jj¡}| j |||¡}|dkrp|  ¡  t dƒ‚dS )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.ra   r  N)r¼   rd   rá   rÝ   rf   rã   Z(EC_KEY_set_public_key_affine_coordinatesrÑ   )ru   r)  r6  r5  r   r]   r]   r^   r…  Ë  s    ÿz1Backend._ec_key_set_public_key_affine_coordinates)Úencodingrx   Úencryption_algorithmrw   c           
      C   s`  t |tjƒstdƒ‚t |tjƒs(tdƒ‚t |tjƒs<tdƒ‚t |tjƒrNd}nbt |tjƒrv|j}t	|ƒdkr°t
dƒ‚n:t |tjƒr¨|j|  krœtjjkr¨n n|j}nt
dƒ‚|tjjkrþ|tjjkrÒ| jj}n|tjjkrè| jj}nt
dƒ‚|  |||¡S |tjjkr"| jr*t |tjƒs*t
d	ƒ‚| j |¡}	|tjjkr¢|	| jjkr\| jj}n8|	| jjkrt| jj}n |	| jjkrŒ| jj}nt
d
ƒ‚|  |||¡S |tjjkr|r¾t
dƒ‚|	| jjkrÖ| jj}n8|	| jjkrî| jj}n |	| jjkr| jj }nt
d
ƒ‚|  !||¡S t
dƒ‚|tjjkrT|tjjkrLt" #|||¡S t
dƒ‚t
dƒ‚d S )Nú/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancer€   iÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingúformat is invalid with this key)$rª   r'   rT  rP  ÚPrivateFormatÚKeySerializationEncryptionÚNoEncryptionÚBestAvailableEncryptionr  r”   r¼   Ú_KeySerializationEncryptionÚ_formatÚOpenSSHZPKCS8ÚPEMrf   ZPEM_write_bio_PKCS8PrivateKeyrU  Zi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioZTraditionalOpenSSLri   r  r  ZPEM_write_bio_RSAPrivateKeyr  ZPEM_write_bio_DSAPrivateKeyr  ZPEM_write_bio_ECPrivateKeyr  Zi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bioÚ_bio_func_outputrQ   Z_serialize_ssh_private_key)
ru   rŸ  rx   r   r›   ræ   Úcdatar  Ú	write_bior  r]   r]   r^   Ú_private_key_bytesÝ  sÄ    
ÿ ÿÿ ÿÿ ÿÿûú


  ÿ
 ÿÿ


ÿ  ÿÿ


ÿ  ÿÿzBackend._private_key_bytesc              	   C   s<   |s| j j}n| j d¡}|  ||||t|ƒ| j j| j j¡S )Ns   aes-256-cbc)rd   r   rf   ÚEVP_get_cipherbynamer¬  r”   )ru   r®  ræ   r  rº   r]   r]   r^   r«  W  s    
ùz"Backend._private_key_bytes_via_bioc                 G   s.   |   ¡ }||f|žŽ }|  |dk¡ |  |¡S rˆ   )rý   r}   r   )ru   r®  ÚargsrX   r   r]   r]   r^   r¬  h  s    zBackend._bio_func_output)rŸ  rx   rw   c                 C   s  t |tjƒstdƒ‚t |tjƒs(tdƒ‚|tjjkrt|tjjkrJ| jj}n|tjj	kr`| jj
}ntdƒ‚|  ||¡S |tjjkrà| j |¡}|| jjkr tdƒ‚|tjjkr¶| jj}n|tjj	krÌ| jj}ntdƒ‚|  ||¡S |tjjkr|tjjkrt |¡S tdƒ‚tdƒ‚d S )Nr¡  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingr¢  )rª   r'   rT  rP  ÚPublicFormatZSubjectPublicKeyInforª  rf   ZPEM_write_bio_PUBKEYrU  Zi2d_PUBKEY_bior¼   r¬  ZPKCS1r  r  ZPEM_write_bio_RSAPublicKeyr  r©  rQ   Zserialize_ssh_public_key)ru   rŸ  rx   r›   ræ   r­  r®  r  r]   r]   r^   Ú_public_key_bytesn  s@    ÿ

ÿ


ÿzBackend._public_key_bytesc                 C   s
   | j j S r…   ©rf   r  rt   r]   r]   r^   Údh_supported¥  s    zBackend.dh_supported)Ú	generatorrß   rw   c                 C   s†   |t jk rtd t j¡ƒ‚|dkr*tdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}| j |||| jj¡}|  |dk¡ t| |ƒS )Nz$DH key_size must be at least {} bits)é   é   zDH generator must be 2 or 5ra   )r)   Z_MIN_MODULUS_SIZEr¼   rx   rf   ÚDH_newr}   rd   r   rá   r  ZDH_generate_parameters_exr   )ru   r¶  rß   Zdh_param_cdatar   r]   r]   r^   Úgenerate_dh_parameters¨  s&    
ÿÿ
   ÿzBackend.generate_dh_parametersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_DHr}   )ru   r  ræ   r   r]   r]   r^   Ú_dh_cdata_to_evp_pkeyÀ  s    zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| ƒ}| j |¡}|  |dk¡ |  |¡}t| ||ƒS rˆ   )r   Z	_dh_cdatarf   ZDH_generate_keyr}   r»  r   )ru   r+  Zdh_key_cdatar   ræ   r]   r]   r^   Úgenerate_dh_private_keyÆ  s     ÿ
zBackend.generate_dh_private_keyc                 C   s   |   |  ||¡¡S r…   )r¼  rº  )ru   r¶  rß   r]   r]   r^   Ú&generate_dh_private_key_and_parametersÔ  s    
ÿz.Backend.generate_dh_private_key_and_parametersc                 C   s>  |j j}| j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|jd k	rf|  	|j¡}n| jj}|  	|j j¡}|  	|j¡}| j ||||¡}	|  |	dk¡ | j |||¡}	|  |	dk¡ | j dd¡}
| j ||
¡}	|  |	dk¡ |
d dkr(|jdkr |
d | jjA dks(tdƒ‚|  |¡}t| ||ƒS )Nra   úint[]r   r·  z.DH private numbers did not pass safety checks.)rñ   r4  rf   r¹  r}   rd   r   rá   r  rÝ   rë   r0  rì   r5  r6  ÚDH_set0_pqgÚDH_set0_keyr“   ÚCryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr¼   r»  r   )ru   rê   r4  r  rë   r0  rì   r1  r2  r   Úcodesræ   r]   r]   r^   Úload_dh_private_numbersÛ  s4    


ÿþ
zBackend.load_dh_private_numbersc           
      C   sÐ   | j  ¡ }|  || jjk¡ | j || j j¡}|j}|  |j	¡}|  |j
¡}|jd k	rd|  |j¡}n| jj}|  |j¡}| j  ||||¡}|  |dk¡ | j  ||| jj¡}|  |dk¡ |  |¡}	t| ||	ƒS rˆ   )rf   r¹  r}   rd   r   rá   r  r4  rÝ   rë   r0  rì   r5  r¿  rÀ  r»  r   )
ru   rê   r  r4  rë   r0  rì   r1  r   ræ   r]   r]   r^   Úload_dh_public_numbers  s     


zBackend.load_dh_public_numbersc                 C   s   | j  ¡ }|  || jjk¡ | j || j j¡}|  |j¡}|  |j	¡}|j
d k	r^|  |j
¡}n| jj}| j  ||||¡}|  |dk¡ t| |ƒS rˆ   )rf   r¹  r}   rd   r   rá   r  rÝ   rë   r0  rì   r¿  r   )ru   rê   r  rë   r0  rì   r   r]   r]   r^   Úload_dh_parameter_numbers(  s    

z!Backend.load_dh_parameter_numbers)rë   r0  rì   rw   c                 C   s´   | j  ¡ }|  || jjk¡ | j || j j¡}|  |¡}|  |¡}|d k	rV|  |¡}n| jj}| j  ||||¡}|  |dk¡ | j 	dd¡}| j  
||¡}|  |dk¡ |d dkS )Nra   r¾  r   )rf   r¹  r}   rd   r   rá   r  rÝ   r¿  r“   rÁ  )ru   rë   r0  rì   r  r   rÂ  r]   r]   r^   Údh_parameters_supported<  s    


zBackend.dh_parameters_supportedc                 C   s   | j jdkS rˆ   )rf   rr   rt   r]   r]   r^   Údh_x942_serialization_supportedT  s    z'Backend.dh_x942_serialization_supportedc                 C   sh   t |ƒdkrtdƒ‚|  ¡ }| j || jj¡}|  |dk¡ | j ||t |ƒ¡}|  |dk¡ t| |ƒS )Né    z%An X25519 public key is 32 bytes longra   )	r”   r¼   rø   rf   ZEVP_PKEY_set_typeÚ
NID_X25519r}   ZEVP_PKEY_set1_tls_encodedpointr"   )ru   rù   ræ   r   r]   r]   r^   Úx25519_load_public_bytesW  s      ÿz Backend.x25519_load_public_bytesc              	   C   s¬   t |ƒdkrtdƒ‚d}|  d¡<}||dd…< ||dd …< |  |¡}| j |j| jj¡}W 5 Q R X |  	|| jjk¡ | j 
|| jj¡}|  	| j |¡| jjk¡ t| |ƒS )NrÈ  z&An X25519 private key is 32 bytes longs   0. 0+en" é0   r   é   )r”   r¼   Ú_zeroed_bytearrayrü   rf   rO  rX   rd   r   r}   rá   rö   r  r  r!   )ru   rù   Zpkcs8_prefixÚbarX   ræ   r]   r]   r^   Úx25519_load_private_bytesf  s    
ÿz!Backend.x25519_load_private_bytesc                 C   s¨   | j  || jj¡}|  || jjk¡ | j || j j¡}| j  |¡}|  |dk¡ | j d¡}| j  	||¡}|  |dk¡ |  |d | jjk¡ | j |d | j j
¡}|S )Nra   úEVP_PKEY **r   )rf   ZEVP_PKEY_CTX_new_idrd   r   r}   rá   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr“   ZEVP_PKEY_keygenrö   )ru   rž  Zevp_pkey_ctxr   Z	evp_ppkeyræ   r]   r]   r^   Ú_evp_pkey_keygen_gcŠ  s    zBackend._evp_pkey_keygen_gcc                 C   s   |   | jj¡}t| |ƒS r…   )rÑ  rf   rÉ  r!   r÷   r]   r]   r^   Úx25519_generate_key—  s    zBackend.x25519_generate_keyc                 C   s   | j r
dS | jj S r©   )ri   rf   r  rt   r]   r]   r^   Úx25519_supported›  s    zBackend.x25519_supportedc                 C   s`   t |ƒdkrtdƒ‚| j | jj| jj|t |ƒ¡}|  || jjk¡ | j || jj	¡}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)r”   r¼   rf   ÚEVP_PKEY_new_raw_public_keyÚNID_X448rd   r   r}   rá   rö   r$   ©ru   rù   ræ   r]   r]   r^   Úx448_load_public_bytes   s       ÿzBackend.x448_load_public_bytesc                 C   sl   t |ƒdkrtdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}|  || jjk¡ | j 	|| jj
¡}t| |ƒS )NrÔ  z$An X448 private key is 56 bytes long)r”   r¼   rd   rÍ   rf   ÚEVP_PKEY_new_raw_private_keyrÖ  r   r}   rá   rö   r#   ©ru   rù   rû   ræ   r]   r]   r^   Úx448_load_private_bytes«  s       ÿzBackend.x448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r…   )rÑ  rf   rÖ  r#   r÷   r]   r]   r^   Úx448_generate_key·  s    zBackend.x448_generate_keyc                 C   s   | j r
dS | jj o| jj S r©   )ri   rf   Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r  rt   r]   r]   r^   Úx448_supported»  s
    
þzBackend.x448_supportedc                 C   s   | j r
dS | jj S r©   )ri   rf   Ú#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Brt   r]   r]   r^   Úed25519_supportedÃ  s    zBackend.ed25519_supportedc                 C   sn   t  d|¡ t|ƒtjkr"tdƒ‚| j | jj| j	j
|t|ƒ¡}|  || j	j
k¡ | j	 || jj¡}t| |ƒS )Nrù   z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesr”   r,   Ú_ED25519_KEY_SIZEr¼   rf   rÕ  ÚNID_ED25519rd   r   r}   rá   rö   r   r×  r]   r]   r^   Úed25519_load_public_bytesÈ  s       ÿz!Backend.ed25519_load_public_bytesc                 C   sz   t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j 	| jj
| jj|t |ƒ¡}|  || jjk¡ | j || jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longrù   )r”   r,   rá  r¼   r   rl  rd   rÍ   rf   rÙ  râ  r   r}   rá   rö   r   rÚ  r]   r]   r^   Úed25519_load_private_bytesØ  s       ÿz"Backend.ed25519_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r…   )rÑ  rf   râ  r   r÷   r]   r]   r^   Úed25519_generate_keyè  s    zBackend.ed25519_generate_keyc                 C   s   | j r
dS | jj o| jj S r©   )ri   rf   rÞ  r  rt   r]   r]   r^   Úed448_supportedì  s
    
þzBackend.ed448_supportedc                 C   sl   t  d|¡ t|ƒtkr tdƒ‚| j | jj| jj	|t|ƒ¡}|  
|| jj	k¡ | j || jj¡}t| |ƒS )Nrù   z$An Ed448 public key is 57 bytes long)r   rà  r”   r   r¼   rf   rÕ  Ú	NID_ED448rd   r   r}   rá   rö   r   r×  r]   r]   r^   Úed448_load_public_bytesô  s       ÿzBackend.ed448_load_public_bytesc                 C   sx   t  d|¡ t|ƒtkr tdƒ‚| j |¡}| j | jj	| jj
|t|ƒ¡}|  || jj
k¡ | j || jj¡}t| |ƒS )Nrù   z%An Ed448 private key is 57 bytes long)r   rl  r”   r   r¼   rd   rÍ   rf   rÙ  rç  r   r}   rá   rö   r   rÚ  r]   r]   r^   Úed448_load_private_bytes  s       ÿz Backend.ed448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r…   )rÑ  rf   rç  r   r÷   r]   r]   r^   Úed448_generate_key  s    zBackend.ed448_generate_key)rË   rÉ   rÈ   rò   Úrrë   rw   c                 C   s†   | j  d|¡}| j  |¡}| j |t|ƒ|t|ƒ|||tj||¡
}	|	dkrr|  ¡ }
d| | d }t	d 
|¡|
ƒ‚| j  |¡d d … S )NrÌ   ra   é€   i   zJNot enough memory to derive key. These parameters require {} MB of memory.)rd   r“   rÍ   rf   ZEVP_PBE_scryptr”   rO   Z
_MEM_LIMITrÒ   ÚMemoryErrorrx   rÎ   )ru   rË   rÉ   rÈ   rò   rë  rë   r—   rÏ   r   r|   Z
min_memoryr]   r]   r^   Úderive_scrypt  s0    	öÿýzBackend.derive_scryptc                 C   sL   t  |¡}| jr|| jkrdS | d¡r4| jjdkS | j |¡| jj	kS d S )NFs   -sivra   )
r   Z_aead_cipher_nameri   Ú
_fips_aeadÚendswithrf   Ú#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr°  rd   r   )ru   rµ   Úcipher_namer]   r]   r^   Úaead_cipher_supported6  s    

ÿzBackend.aead_cipher_supported)rÈ   rw   c              
   c   s&   t |ƒ}z
|V  W 5 |  ||¡ X dS )zÁ
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)Ú	bytearrayÚ
_zero_data)ru   rÈ   rÎ  r]   r]   r^   rÍ  D  s    
zBackend._zeroed_bytearrayc                 C   s   t |ƒD ]}d||< qd S r~   )Úrange)ru   rù   rÈ   Úir]   r]   r^   rõ  Q  s    zBackend._zero_datac                 c   sf   |dkr| j jV  nNt|ƒ}| j  d|d ¡}| j  |||¡ z
|V  W 5 |  | j  d|¡|¡ X dS )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr   ra   z	uint8_t *)rd   r   r”   r“   Zmemmoverõ  Úcast)ru   rù   Údata_lenr—   r]   r]   r^   Ú_zeroed_null_terminated_bufX  s    
z#Backend._zeroed_null_terminated_bufc                 C   s2   |   ||¡}|j|jr|jjnd dd„ |jD ƒfS )Nc                 S   s   g | ]
}|j ‘qS r]   )Úcertificate©rr  rR  r]   r]   r^   Ú
<listcomp>z  s     zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)Úload_pkcs12r›   rR  rû  Zadditional_certs)ru   rù   r  Zpkcs12r]   r]   r^   Ú%load_key_and_certificates_from_pkcs12o  s
    ýz-Backend.load_key_and_certificates_from_pkcs12c              	   C   sf  |d k	rt  d|¡ |  |¡}| j |j| jj¡}|| jjkrN|  ¡  t	dƒ‚| j 
|| jj¡}| j d¡}| j d¡}| j d¡}|  |¡}| j |||||¡}	W 5 Q R X |  ¡  |	dkrÆt	dƒ‚d }
d }g }|d | jjkr| j 
|d | jj¡}|  |¡}|d | jjkrp| j 
|d | jj¡}|  |¡}d }| j || jj¡}|| jjkrf| j |¡}t||ƒ}
|d | jjkrZ| j 
|d | jj¡}| j |d ¡}| jjs¼| jjrÆt|ƒ}ntt|ƒƒ}|D ]‚}| j ||¡}|  || jjk¡ | j 
|| jj¡}|  |¡}d }| j || jj¡}|| jjkrF| j |¡}| t||ƒ¡ qÖt||
|ƒS )Nr  z!Could not deserialize PKCS12 datarÐ  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data) r   rl  rü   rf   Zd2i_PKCS12_biorX   rd   r   rÑ   r¼   rá   ÚPKCS12_freer“   rú  ZPKCS12_parserö   r  rV  rY  ZX509_alias_get0r•   rS   Úsk_X509_freeÚsk_X509_numrñ  r  rö  ÚreversedÚsk_X509_valuer}   rs   rT   )ru   rù   r  rX   Úp12Zevp_pkey_ptrZx509_ptrZsk_x509_ptrÚpassword_bufr   rR  r›   Zadditional_certificatesræ   r   Zcert_objr¡   Z
maybe_nameÚsk_x509rÙ   Úindicesr÷  Z	addl_certZ	addl_namer]   r]   r^   rþ  }  st    
    ÿ


ÿþ

ÿzBackend.load_pkcs12)r¡   r›   rR  Úcasr   rw   c                 C   sX  d }|d k	rt  d|¡ t|tjƒr@d}d}d}	d}
| jj}nDt|tjƒrŽ| jj	rf| jj
}| jj
}n| jj}| jj}d}	d}
| jj}|j}nöt|tjƒr||jtjjkr|d}d}d}	d}
|j}|j}|tjkrä| jj}| jj}n>|tjkr| jj	stdƒ‚| jj
}| jj
}n|d ks"t‚|jd k	r`| jjs@tdƒ‚|  |j¡}|  || jjk¡ n| jj}|jd k	r„|j}	ntdƒ‚|d ksœt|ƒdkr¦| jj}n°| j ¡ }| j || jj ¡}g }|D ]Š}t|t!ƒr"|j"}|  #|j$¡}|  %|¡$}| j &||d¡}|  |dk¡ W 5 Q R X n
|  #|¡}| '|¡ | j (||¡}t) |dk¡ qÊ|  %|¡ }|  %|¡V}|r~|  #|¡n| jj}|d k	r˜|j*}n| jj}| j +||||||||	|
d¡
}W 5 Q R X | jjrü|| jjkrü| j ,||d| jjd|
|¡ W 5 Q R X |  || jjk¡ | j || jj-¡}|  .¡ }| j /||¡}|  |dk¡ |  0|¡S )	Nr¡   rj  r   i N  ra   z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption type)1r   rà  rª   r'   r¥  rd   r   r¦  rf   rñ  ZNID_aes_256_cbcZ&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr  r§  r¨  r£  ZPKCS12Z_key_cert_algorithmrR   ZPBESv1SHA1And3KeyTripleDESCBCZPBESv2SHA256AndAES256CBCr   r‡   Z
_hmac_hashZCryptography_HAS_PKCS12_SET_MACr¨   r}   Z_kdf_roundsr¼   r”   Úsk_X509_new_nullrá   r  rS   Zfriendly_namerW  rû  rú  ZX509_alias_set1rs   Úsk_X509_pushÚbackendrc  ZPKCS12_createZPKCS12_set_macr   rý   Zi2d_PKCS12_bior   )ru   r¡   r›   rR  r	  r   r  Znid_certZnid_keyZpkcs12_iterZmac_iterZmac_algZ
keycertalgr  Zossl_casÚcaZca_aliasZossl_caZca_name_bufr   r  Zname_bufÚ	ossl_certræ   r  rX   r]   r]   r^   Ú(serialize_key_and_certificates_to_pkcs12Ç  sò     ÿ
 ÿÿÿü	


ÿ

ÿÿ

ÿ  ÿ


öÿ
þù
z0Backend.serialize_key_and_certificates_to_pkcs12c                 C   s   | j r
dS | jjdkS r±   )ri   rf   ZCryptography_HAS_POLY1305rt   r]   r]   r^   Úpoly1305_supportedd	  s    zBackend.poly1305_supported)r›   rw   c                 C   s*   t  d|¡ t|ƒtkr tdƒ‚t| |ƒS )Nr›   zA poly1305 key is 32 bytes long)r   rl  r”   r   r¼   r   )ru   r›   r]   r]   r^   Úcreate_poly1305_ctxi	  s    zBackend.create_poly1305_ctxc                 C   s
   | j j S r…   r´  rt   r]   r]   r^   Úpkcs7_supportedp	  s    zBackend.pkcs7_supportedc                 C   sn   t  d|¡ |  |¡}| j |j| jj| jj| jj¡}|| jjkrR|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S ©Nrù   zUnable to parse PKCS7 data)r   rà  rü   rf   ZPEM_read_bio_PKCS7rX   rd   r   rÑ   r¼   rá   Ú
PKCS7_freeÚ_load_pkcs7_certificates©ru   rù   rX   Úp7r]   r]   r^   Úload_pem_pkcs7_certificatess	  s    
   ÿz#Backend.load_pem_pkcs7_certificatesc                 C   sb   t  d|¡ |  |¡}| j |j| jj¡}|| jjkrF|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S r  )r   rà  rü   rf   Zd2i_PKCS7_biorX   rd   r   rÑ   r¼   rá   r  r  r  r]   r]   r^   Úload_der_pkcs7_certificates‚	  s    
z#Backend.load_der_pkcs7_certificatesc           
      C   sÊ   | j  |j¡}|  || j jk¡ || j jkr>td |¡tj	ƒ‚|j
jj}| j  |¡}g }t|ƒD ]d}| j  ||¡}|  || jjk¡ | j  |¡}|  |dk¡ | j || j j¡}|  |¡}	| |	¡ q`|S )NzNOnly basic signed structures are currently supported. NID for this data was {}ra   )rf   ZOBJ_obj2nidr·   r}   rw  ZNID_pkcs7_signedr   rx   r   ZUNSUPPORTED_SERIALIZATIONrí   ÚsignrR  r  rö  r  rd   r   ZX509_up_refrá   rV  rY  rs   )
ru   r  rž  r  rÙ   Úcertsr÷  r   r   rR  r]   r]   r^   r  	  s*    ÿý

z Backend._load_pkcs7_certificates)r  rŸ  c           
      C   s"  t |ƒ}|rtdd„ |D ƒƒs&tdƒ‚|tjjtjjfkrBtdƒ‚| j ¡ }| j	 
|| jj¡}g }|D ]4}|  |¡}| |¡ | j ||¡}|  |dk¡ qf| j | j	j| j	j|| j	j| jj¡}|  ¡ }	|tjjkrì| j |	|| j	jd¡}n|tjjksüt‚| j |	|¡}|  |dk¡ |  |	¡S )Nc                 s   s   | ]}t |tjƒV  qd S r…   )rª   r   ÚCertificaterü  r]   r]   r^   rs  ¯	  s    z7Backend.pkcs7_serialize_certificates.<locals>.<genexpr>z.certs must be a list of certs with length >= 1z/encoding must DER or PEM from the Encoding enumra   r   )ÚlistÚallrP  r'   rT  rª  rU  rf   r
  rd   rá   r  rW  rs   r  r}   Ú
PKCS7_signr   ÚPKCS7_PARTIALrý   ÚPEM_write_bio_PKCS7_streamr‡   Úi2d_PKCS7_bior   )
ru   r  rŸ  Zcerts_skÚ
ossl_certsrR  r  r   r  Úbio_outr]   r]   r^   Úpkcs7_serialize_certificates©	  sJ    ÿþ


û   ÿz$Backend.pkcs7_serialize_certificates)ÚbuilderrŸ  Úoptionsrw   c                 C   sÂ  |j d k	st‚|  |j ¡}| jj}d}t|jƒdkr>| jj}n\| j 	¡ }| j 
|| jj¡}g }|jD ]4}	|  |	¡}
| |
¡ | j ||
¡}|  |dk¡ qdtjj|kr¾|| jjO }|| jjO }| j | jj| jj|| jj|¡}|  || jjk¡ | j 
|| jj¡}d}tjj|kr"|| jjO }ntjj|kr<|| jjO }tjj|krV|| jjO }|jD ]H\}}}|  |¡}
|  |¡}| j ||
|j||¡}|  || jjk¡ q\|D ]<}|tjj krÊ|| jj!O }n|tjj"krª|| jj#O }qª|  $¡ }|t%j&j'kr| j (|||j)|¡}n–|t%j&j*krX| j +||j)|¡}|  |dk¡ | j ,|||j)|¡}nR|t%j&j-ksjt‚| j +||j)|¡}|  |dk¡ | jj.rœ|  /¡  | j 0||¡}|  |dk¡ |  1|¡S )Nr   ra   )2Ú_datar‡   rü   rf   r   r”   Z_additional_certsrd   r   r
  rá   r  rW  rs   r  r}   rP   ÚPKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDr  r  ZNoCapabilitiesZPKCS7_NOSMIMECAPZNoAttributesZPKCS7_NOATTRZNoCertsZPKCS7_NOCERTSZ_signersr¨   ZPKCS7_sign_add_signerrc  ÚTextZ
PKCS7_TEXTÚBinaryZPKCS7_BINARYrý   r'   rT  ZSMIMEZSMIME_write_PKCS7rX   rª  ZPKCS7_finalr!  rU  rñ  rÑ   r"  r   )ru   r&  rŸ  r'  rX   Z
init_flagsZfinal_flagsr  r#  rR  r  r   r  Zsigner_flagsrû  Zprivate_keyZhash_algorithmÚmdZp7signerinfoÚoptionr$  r]   r]   r^   Ú
pkcs7_signØ	  s”    




û

û   ÿ   ÿ
zBackend.pkcs7_sign)N)N)N)ûrZ   r[   r\   Ú__doc__r¡   rï  r:   r¶   r&   r   r!  r"  r#  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r«   r+   Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1r˜  Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrv   Ústrrz   rƒ   ÚtypingÚOptionalÚListr%   Z_OpenSSLErrorr}   rh   r†   rŽ   Ú
contextlibr   r   rp   r˜   ry   rÔ   rš   ÚbytesZHashAlgorithmr   r   r¦   r¨   r¬   r°   r²   r³   ZHashContextr´   r9   rL   r»   r¿   rk   r   rÅ   rÆ   rÇ   rÐ   rÑ   Z_OpenSSLErrorWithTextrÒ   rØ   rÝ   r.   ZRSAPrivateKeyrç   ré   ZRSAPrivateNumbersrô   ZRSAPublicNumbersZRSAPublicKeyrõ   rø   rä   rü   rý   r   r6   r  r7   r  r$  r(   r'  r*   ZDSAParametersr*  ZDSAPrivateKeyr-  r.  r3  ZDSAPrivateNumbersr7  ZDSAPublicNumbersZDSAPublicKeyr9  ZDSAParameterNumbersr:  r,  r;  r<  r?  r8   r
   r@  rB  rK  r)   ZDHParametersrL  r  rM  r  rQ  r   r  ÚAnyrW  rY  ZCertificateSigningRequestr\  r]  ZCertificateRevocationListr`  ra  r5   rd  rf  ri  rA  ÚNoReturnrH  ZEllipticCurverz  ZEllipticCurveSignatureAlgorithmr|  ZEllipticCurvePrivateKeyr€  ZEllipticCurvePrivateNumbersr‡  ZEllipticCurvePublicNumbersZEllipticCurvePublicKeyrˆ  r‘  r–  r}  r—  r™  rš  r~  rv  r  r’  r…  r'   rT  r£  r¤  r¯  r«  r¬  r²  r³  rµ  rº  r»  ZDHPrivateKeyr¼  r½  ZDHPrivateNumbersrÃ  ZDHPublicNumbersZDHPublicKeyrÄ  ZDHParameterNumbersrÅ  rÆ  rÇ  r/   ZX25519PublicKeyrÊ  ZX25519PrivateKeyrÏ  rÑ  rÒ  rÓ  r0   ZX448PublicKeyrØ  ZX448PrivateKeyrÛ  rÜ  rÝ  rß  r,   ZEd25519PublicKeyrã  ZEd25519PrivateKeyrä  rå  ræ  r-   ZEd448PublicKeyrè  ZEd448PrivateKeyré  rê  rî  ró  ÚIteratorrô  rÍ  rõ  rú  ÚTuplerÿ  rT   rþ  rU   rV   r  r  r   r  r  r  r  r  r%  rP   ZPKCS7SignatureBuilderr)  r.  r]   r]   r]   r^   r_   ‡   s|  ú
ôüýü
	 þþ	þ	5 þ þù
þ þ þ
þ%þ@:þþþþþ þ
* þ	þ	þ
üþ5/üþþþ þ þ' þ

øzù7 þþ þþ1þþÿ  þþ$þþø# 

þÿþ þL
ù 
þ
þ
ý1
ûr_   c                   @   s,   e Zd Zedœdd„Zeeedœdd„ZdS )rÀ   )Úfmtc                 C   s
   || _ d S r…   )Ú_fmt)ru   r:  r]   r]   r^   rv   <
  s    zGetCipherByName.__init__)r  rµ   r„   c                 C   sd   | j j||d ¡ }|j | d¡¡}||jjkrX|jjrX|j 	|jj| d¡|jj¡}| 
¡  |S )N)rµ   r„   r’   )r;  rx   Úlowerrf   r°  r£   rd   r   ZCryptography_HAS_300_EVP_CIPHERZEVP_CIPHER_fetchrÑ   )ru   r  rµ   r„   rò  rº   r]   r]   r^   Ú__call__?
  s    ÿ
ÿþýzGetCipherByName.__call__N)	rZ   r[   r\   r0  rv   r_   r9   rL   r=  r]   r]   r]   r^   rÀ   ;
  s   rÀ   )r  rµ   c                 C   s"   d  |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsr·  r’   )rx   rß   rf   r°  r£   )r  rµ   r„   rò  r]   r]   r^   rÃ   T
  s    rÃ   )|Úcollectionsr4  rÁ   r1  rm   r   Zcryptographyr   r   Zcryptography.exceptionsr   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr
   Z'cryptography.hazmat.backends.openssl.dhr   r   r   r   Z(cryptography.hazmat.backends.openssl.dsar   r   r   Z'cryptography.hazmat.backends.openssl.ecr   r   Z,cryptography.hazmat.backends.openssl.ed25519r   r   Z*cryptography.hazmat.backends.openssl.ed448r   r   r   Z+cryptography.hazmat.backends.openssl.hashesr   Z)cryptography.hazmat.backends.openssl.hmacr   Z-cryptography.hazmat.backends.openssl.poly1305r   r   Z(cryptography.hazmat.backends.openssl.rsar   r    Z+cryptography.hazmat.backends.openssl.x25519r!   r"   Z)cryptography.hazmat.backends.openssl.x448r#   r$   Z"cryptography.hazmat.bindings._rustrX  Z$cryptography.hazmat.bindings.opensslr%   Zcryptography.hazmat.primitivesr&   r'   Z*cryptography.hazmat.primitives._asymmetricr(   Z)cryptography.hazmat.primitives.asymmetricr)   r*   r+   r,   r-   r.   r/   r0   Z1cryptography.hazmat.primitives.asymmetric.paddingr1   r2   r3   r4   Z/cryptography.hazmat.primitives.asymmetric.typesr5   r6   r7   Z&cryptography.hazmat.primitives.ciphersr8   r9   Z1cryptography.hazmat.primitives.ciphers.algorithmsr:   r;   r<   r=   r>   r?   r@   rA   rB   rC   rD   rE   Z,cryptography.hazmat.primitives.ciphers.modesrF   rG   rH   rI   rJ   rK   rL   rM   rN   Z"cryptography.hazmat.primitives.kdfrO   Z,cryptography.hazmat.primitives.serializationrP   rQ   Z3cryptography.hazmat.primitives.serialization.pkcs12rR   rS   rT   rU   rV   Ú
namedtuplerW   rY   r_   rÀ   rÃ   r  r]   r]   r]   r^   Ú<module>   sv   (
8,	                   G