3
ꅭh @ s d dl mZmZmZ d dlZd dlZd dlZd dlZd dlmZ d dl Z d dl
m Z d dl m
Z
mZ d dlmZmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z% d d l&m'Z' d d
l(m)Z) d d l*m+Z+ d d l,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d d
l6m7Z7m8Z8m9Z9m:Z: d dl;mZ> d dl?m@Z@mAZA d dlBmCZCmDZD d dlEmFZFmGZGmHZH d dlImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZR d dlSmTZT d dlUmVZV d dlWmXZXmYZY d dlZm[Z[m\Z\ d dl]m^Z^m_Z_ d dl`maZambZb d dlcmdZdmeZe d dlfmgZgmhZhmiZimjZj d dlkmlZl d d lmmnZnmoZo d d lpmqZqmrZrmsZsmtZtmuZu d d lvmwZwmxZxmyZymzZz d d l{m|Z|m}Z}m~Z~mZmZmZmZmZmZ d d lmZmZmZmZmZmZmZmZ d d!lmZ d d"lmZmZ d d#lmZ ejd$d%d&gZG d'd( d(eZe
jee
jee
jee
je e
je e
je e
je e
je e
je!e
je#e
je"e
je%e
jelj jje$G d)d* d*eZG d+d, d,eZd-d. Ze ZdS )/ )absolute_importdivisionprint_functionN)contextmanager)range)utilsx509)UnsupportedAlgorithm_Reasons)INTEGERNULLSEQUENCE
encode_derencode_der_integer)
CMACBackend
CipherBackendDERSerializationBackend DHBackend
DSABackendEllipticCurveBackend HMACBackend HashBackendPBKDF2HMACBackendPEMSerializationBackend
RSABackend
ScryptBackend X509Backend)aead)_CipherContext) _CMACContext) _CRL_ENTRY_REASON_ENUM_TO_CODE_CRL_EXTENSION_HANDLERS_EXTENSION_HANDLERS_BASE_EXTENSION_HANDLERS_SCT"_OCSP_BASICRESP_EXTENSION_HANDLERS _OCSP_REQ_EXTENSION_HANDLERS'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCT_REVOKED_EXTENSION_HANDLERS_X509ExtensionParser)
_DHParameters
_DHPrivateKey _DHPublicKey_dh_params_dup)_DSAParameters_DSAPrivateKey
_DSAPublicKey)_EllipticCurvePrivateKey_EllipticCurvePublicKey)_Ed25519PrivateKey_Ed25519PublicKey)_ED448_KEY_SIZE_Ed448PrivateKey_Ed448PublicKey) $_CRL_ENTRY_EXTENSION_ENCODE_HANDLERS _CRL_EXTENSION_ENCODE_HANDLERS_EXTENSION_ENCODE_HANDLERS)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERS'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERS_encode_asn1_int_gc_encode_asn1_str_gc_encode_name_gc _txt2obj_gc) _HashContext) _HMACContext) _OCSPRequest
_OCSPResponse)_POLY1305_KEY_SIZE_Poly1305Context)_RSAPrivateKey
_RSAPublicKey)_X25519PrivateKey_X25519PublicKey)_X448PrivateKey_X448PublicKey) _Certificate_CertificateRevocationList_CertificateSigningRequest_RevokedCertificate)binding)hashes
serialization)dsaeced25519ed448rsa)MGF1OAEPPKCS1v15PSS) AESARC4BlowfishCAST5CamelliaChaCha20IDEASEED TripleDES)CBCCFBCFB8CTRECBGCMOFBXTS)scrypt)pkcs7ssh)ocsp
_MemoryBIObioZchar_ptrc @ s e Zd ZdS )_RC2N)__name__
__module__ __qualname__ rw rw /usr/lib64/python3.6/backend.pyrs s rs c
@ s| e Zd ZdZdZddddddhZeefZe j
e j e j e j
e je je je je je je je je jf
Zd Zd
Zd d > Zd Zd e> Z d d
Z d-ddZ dd Z dd Z e!j"dd Z#dd Z$dd Z%dd Z&d d Z'd d Z(d!d" Z)d#d$ Z*d%d& Z+d'd( Z,d)d* Z-d+d, Z.d-d. Z/d/d0 Z0d1d2 Z1d3d4 Z2d5d6 Z3d7d8 Z4d9d: Z5d;d< Z6d=d> Z7d?d@ Z8dAdB Z9d.dCdDZ:dEdF Z;dGdH ZdMdN Z?dOdP Z@dQdR ZAdSdT ZBdUdV ZCdWdX ZDdYdZ ZEd[d\ ZFd]d^ ZGd_d` ZHdadb ZIdcdd ZJdedf ZKdgdh ZLdidj ZMdkdl ZNdmdn ZOdodp ZPdqdr ZQdsdt ZRdudv ZSdwdx ZTdydz ZUd{d| ZVd}d~ ZWdd ZXdd ZYdd ZZdd Z[dd Z\dd Z]dd Z^dd Z_dd Z`dd Zadd Zbdd Zcdd Zddd Zedd Zfdd Zgdd Zhdd Zidd Zjdd Zkdd Zldd Zmdd Zndd Zodd Zpdd Zqdd Zrdd Zsdd Ztdd Zudd Zvdd Zwdd Zxdd ZyddĄ ZzddƄ Z{ddȄ Z|ddʄ Z}dd̄ Z~e"dd΄ ZddЄ Zdd҄ ZddԄ Zddք Zdd Zddڄ Zdd܄ Zddބ Zdd Zdd Zdd Zdd Zdd Zdd Zd/ddZdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Zdd Zdd Zdd Zdd Ze!j"dd Zdd Ze!j"dd Zd d Zd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Zd+d, ZdS (0 Backendz)
OpenSSL API binding interfaces.
Zopenssls aes-128-ccms aes-192-ccms aes-256-ccms aes-128-gcms aes-192-gcms aes-256-gcmi i c C s t j | _| jj| _| jj| _| j | _i | _ | j
| j | j | jrb| jj
rbtjdt n| j | jjg| _| jjr| jj| jj d S )Nz s z*Backend._is_fips_enabled..r )getattrr~ ZERR_clear_errorbool)r Z fips_modemoderw rw rx r s
zBackend._is_fips_enabledc C sf | j jrb| j j }|| jjkrb| j j| | j j| jj}| j|dk | j j|}| j|dk d S )Nrz ) r~ r ZENGINE_get_default_RANDr| r ZENGINE_unregister_RANDRAND_set_rand_methodr
ENGINE_finish)r eresrw rw rx activate_builtin_random s
z Backend.activate_builtin_randomc c s | j j| j j}| j|| jjk | j j|}| j|dk z
|V W d | j j|}| j|dk | j j|}| j|dk X d S )Nrz ) r~ Z ENGINE_by_idZ Cryptography_osrandom_engine_idr r| r Z ENGINE_initZ ENGINE_freer )r r r rw rw rx _get_osurandom_engine s
z Backend._get_osurandom_enginec
C s` | j jr\| j | j }| j j|}| j|dk W d Q R X | j j| jj}| j|dk d S )Nrz ) r~ r r r ZENGINE_set_default_RANDr r r| r )r r r rw rw rx r s
z Backend.activate_osrandom_enginec C s` | j jdd}| j 2}| jj|dt||| j jd}| j|dk W d Q R X | j j|j dS )Nzchar[]@ s get_implementationr ascii)
r| newr r~ ZENGINE_ctrl_cmdlenr r stringdecode)r bufr r rw rw rx osrandom_engine_implementation+ s
z&Backend.osrandom_engine_implementationc C s | j j| jj| jjjdS )z
Friendly string name of the loaded OpenSSL library. This is not
necessarily the same version as it was compiled against.
Example: OpenSSL 1.1.1d 10 Sep 2019
r )r| r r~ ZOpenSSL_versionZOPENSSL_VERSIONr )r rw rw rx openssl_version_text4 s z Backend.openssl_version_textc C s
| j j S )N)r~ ZOpenSSL_version_num)r rw rw rx openssl_version_number? s z Backend.openssl_version_numberc C s t | ||S )N)rA )r key algorithmrw rw rx create_hmac_ctxB s zBackend.create_hmac_ctxc C sL |j dks|j dkr0dj|j |jd jd}n |j jd}| jj|}|S )NZblake2bZblake2sz{}{} r )nameformatZ digest_sizeencoder~ ZEVP_get_digestbyname)r r Zalgevp_mdrw rw rx _evp_md_from_algorithmE s z Backend._evp_md_from_algorithmc C s | j |}| j|| jjk |S )N)r r r| r )r r r rw rw rx _evp_md_non_null_from_algorithmP s
z'Backend._evp_md_non_null_from_algorithmc C s. | j rt|| j rdS | j|}|| jjkS )NF)r
isinstance _fips_hashesr r| r )r r r rw rw rx hash_supportedU s
zBackend.hash_supportedc C s
| j |S )N)r )r r rw rw rx hmac_supported\ s zBackend.hmac_supportedc C s
t | |S )N)r@ )r r rw rw rx create_hash_ctx_ s zBackend.create_hash_ctxc C s` | j rt|| j rdS y| jt|t|f }W n tk
rF dS X || ||}| jj|kS )NF)r r
_fips_ciphersr typeKeyErrorr| r )r cipherr adapter
evp_cipherrw rw rx cipher_supportedb s zBackend.cipher_supportedc C s0 ||f| j kr tdj|||| j ||f< d S )Nz"Duplicate registration for: {} {}.)r
ValueErrorr )r
cipher_clsmode_clsr rw rw rx register_cipher_adapterl s
z Backend.register_cipher_adapterc C sn x,t ttttttgD ]}| jt|t d qW x(t ttttgD ]}| jt
|t d q>W x&t tttgD ]}| jt |t d qfW | jt tt d x&t tttgD ]}| jt |t d qW x&t tttgD ]}| jt
|t d qW x6tjttgt tttgD ]\}}| j||t d qW | jttd t d | jttd t d | jttd t d | jttt d S )
Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20)re rh ri rk rf rg rj r r\ GetCipherByNamer` rd r^ rc itertoolsproductr_ rb r] r rs ra rl _get_xts_cipher)r r r rw rw rx r u sB z!Backend._register_default_ciphersc C s t j }tj }| jjr,|jt |jt t| | jj | jj
|d| _ t| | jj | jj
|d| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jjt d| _ t| | jj | jj |d| _ d S )N)Z ext_countZget_exthandlers)!r" copyr' r~ ZCryptography_HAS_SCTupdater# r& r( ZX509_get_ext_countZ X509_get_extZ _certificate_extension_parserZsk_X509_EXTENSION_numZsk_X509_EXTENSION_valueZ_csr_extension_parserZX509_REVOKED_get_ext_countZX509_REVOKED_get_extZ _revoked_cert_extension_parserZX509_CRL_get_ext_countZX509_CRL_get_extr! Z_crl_extension_parserZOCSP_REQUEST_get_ext_countZOCSP_REQUEST_get_extr% Z_ocsp_req_ext_parserZ OCSP_BASICRESP_get_ext_countZOCSP_BASICRESP_get_extr$ Z_ocsp_basicresp_ext_parserZ OCSP_SINGLERESP_get_ext_countZOCSP_SINGLERESP_get_extZ_ocsp_singleresp_ext_parser)r Z ext_handlersZsingleresp_handlersrw rw rx r sP
z"Backend._register_x509_ext_parsersc C s6 t j | _tj | _tj | _tj | _t j | _
d S )N) r9 r _extension_encode_handlersr8 _crl_extension_encode_handlersr7 $_crl_entry_extension_encode_handlersr; '_ocsp_request_extension_encode_handlersr: )_ocsp_basicresp_extension_encode_handlers)r rw rw rx r s
z Backend._register_x509_encodersc C s t | ||t jS )N)r Z_ENCRYPT)r r r rw rw rx create_symmetric_encryption_ctx s z'Backend.create_symmetric_encryption_ctxc C s t | ||t jS )N)r Z_DECRYPT)r r r rw rw rx create_symmetric_decryption_ctx s z'Backend.create_symmetric_decryption_ctxc C s
| j |S )N)r )r r rw rw rx pbkdf2_hmac_supported s z Backend.pbkdf2_hmac_supportedc
C sh | j jd|}| j|}| j j|}| jj|t||t|||||} | j| dk | j j|d d S )Nzunsigned char[]rz ) r| r r from_bufferr~ ZPKCS5_PBKDF2_HMACr r buffer)
r r lengthsaltZ
iterations key_materialr r key_material_ptrr rw rw rx derive_pbkdf2_hmac s
zBackend.derive_pbkdf2_hmacc C s t j| jS )N)rP _consume_errorsr~ )r rw rw rx r s zBackend._consume_errorsc C s t j| jS )N)rP _consume_errors_with_textr~ )r rw rw rx r s z!Backend._consume_errors_with_textc C s || j jksttjs~| jj|}| j jd|}| jj||}| j |dk t
j | j j |d | d}| jj
|rz| }|S | jj|}| j || j jk | j j|}| jj| t
|dS d S )Nzunsigned char[]r big )r| r AssertionErrorsixPY2r~ Z BN_num_bytesr Z BN_bn2binr int
from_bytesr ZBN_is_negativeZ BN_bn2hexr OPENSSL_free)r bnZ bn_num_bytesZbin_ptrZbin_lenvalZ hex_cdataZhex_strrw rw rx
_bn_to_int s zBackend._bn_to_intc C s |dks|| j jkst|dkr(| j j}tjst|jt|j d d d}| jj |t
||}| j || j jk |S t |j
ddd jd}| j jd}||d < | jj||}| j |d k | j |d | j jk |d S dS )
a
Converts a python integer to a BIGNUM. The returned BIGNUM will not
be garbage collected (to support adding them to structs that take
ownership of the object). Be sure to register it for GC if it will
be discarded after use.
Ng @rz r L r z BIGNUM **r )r| r r r r to_bytesr
bit_lengthr~ Z BN_bin2bnr r hexrstripr r Z BN_hex2bn)r numr ZbinaryZbn_ptrZhex_numr rw rw rx
_int_to_bn s zBackend._int_to_bnc C s t j|| | jj }| j|| jjk | jj|| jj}| j |}| jj|| jj
}| jj |||| jj}| j|dk | j |}t
| ||S )Nrz )rW Z_verify_rsa_parametersr~ RSA_newr r| r gcRSA_freer BN_freeZRSA_generate_key_ex_rsa_cdata_to_evp_pkeyrF )r public_exponentkey_size rsa_cdatar r evp_pkeyrw rw rx generate_rsa_private_key= s
z Backend.generate_rsa_private_keyc C s |dko|d@ dko|dkS )N rz r i rw )r r r rw rw rx !generate_rsa_parameters_supportedO s z)Backend.generate_rsa_parameters_supportedc
C s2 t j|j|j|j|j|j|j|jj |jj
| j j }| j
|| jjk | jj|| j j}| j|j}| j|j}| j|j}| j|j}| j|j}| j|j}| j|jj } | j|jj
}
| j j|||} | j
| dk | j j||
| |} | j
| dk | j j||||} | j
| dk | j|} t| || S )Nrz )rW Z _check_private_key_componentspqddmp1dmq1iqmppublic_numbersr nr~ r r r| r r r r ZRSA_set0_factors RSA_set0_keyZRSA_set0_crt_paramsr rF )
r numbersr r r r r r r r r r r rw rw rx load_rsa_private_numbersV s8
z Backend.load_rsa_private_numbersc C s t j|j|j | jj }| j|| jjk | jj || jj
}| j |j}| j |j}| jj |||| jj}| j|dk | j
|}t| ||S )Nrz )rW Z _check_public_key_componentsr r r~ r r r| r r r r r r rG )r r r r r r r rw rw rx load_rsa_public_numbersv s
z Backend.load_rsa_public_numbersc C s2 | j j }| j|| jjk | jj|| j j}|S )N)r~ Z EVP_PKEY_newr r| r r
EVP_PKEY_free)r r rw rw rx _create_evp_pkey_gc s
zBackend._create_evp_pkey_gcc C s( | j }| jj||}| j|dk |S )Nrz )r r~ ZEVP_PKEY_set1_RSAr )r r r r rw rw rx r s z Backend._rsa_cdata_to_evp_pkeyc C sH | j j|}| jj|t|}| j|| j jk t| j j|| jj |S )z
Return a _MemoryBIO namedtuple of (BIO, char*).
The char* is the storage for the BIO and it must stay alive until the
BIO is finished with.
)
r| r r~ ZBIO_new_mem_bufr r r rq r BIO_free)r datadata_ptrrr rw rw rx
_bytes_to_bio s zBackend._bytes_to_bioc C sP | j j }| j|| jjk | j j|}| j|| jjk | jj|| j j}|S )z.
Creates an empty memory BIO.
)r~ Z BIO_s_memr r| r ZBIO_newr r )r Z
bio_methodrr rw rw rx _create_mem_bio_gc s
zBackend._create_mem_bio_gcc C s\ | j jd}| jj||}| j|dk | j|d | j jk | j j|d |dd }|S )zE
Reads a memory BIO. This only works on memory BIOs.
zchar **r N)r| r r~ ZBIO_get_mem_datar r r )r rr r Zbuf_lenbio_datarw rw rx
_read_mem_bio s zBackend._read_mem_bioc C s | j j|}|| j jkrT| j j|}| j|| jjk | jj|| j j}t | ||S || j j
kr| j j |}| j|| jjk | jj|| j j }t
| ||S || j jkr| j j|}| j|| jjk | jj|| j j}t| ||S || jkr,| j j|}| j|| jjk | jj|| j j}t| ||S |t| j ddkrJt| |S |t| j ddkrht| |S |t| j ddkrt| |S |t| j ddkrt| |S tddS )zd
Return the appropriate type of PrivateKey given an evp_pkey cdata
pointer.
EVP_PKEY_ED25519N
EVP_PKEY_X448EVP_PKEY_X25519EVP_PKEY_ED448zUnsupported key type.) r~ EVP_PKEY_id EVP_PKEY_RSAEVP_PKEY_get1_RSAr r| r r r rF EVP_PKEY_DSAEVP_PKEY_get1_DSADSA_freer. EVP_PKEY_ECEVP_PKEY_get1_EC_KEY EC_KEY_freer0 r EVP_PKEY_get1_DHDH_freer* r r2 rJ rH r5 r )r r key_typer dsa_cdataec_cdatadh_cdatarw rw rx _evp_pkey_to_private_key s<
z Backend._evp_pkey_to_private_keyc C s | j j|}|| j jkrT| j j|}| j|| jjk | jj|| j j}t | ||S || j j
kr| j j |}| j|| jjk | jj|| j j }t
| ||S || j jkr| j j|}| j|| jjk | jj|| j j}t| ||S || jkr,| j j|}| j|| jjk | jj|| j j}t| ||S |t| j ddkrJt| |S |t| j ddkrht| |S |t| j ddkrt| |S |t| j ddkrt| |S tddS )zc
Return the appropriate type of PublicKey given an evp_pkey cdata
pointer.
r Nr
r r zUnsupported key type.) r~ r r r r r| r r r rG r r r r/ r r r r1 r r r r+ r r3 rK rI r6 r )r r r r r r r rw rw rx _evp_pkey_to_public_key s<
z Backend._evp_pkey_to_public_keyc C s6 | j jr&t|tjtjtjtjtjfS t|tjS d S )N) r~ Z Cryptography_HAS_RSA_OAEP_MDr rQ SHA1SHA224SHA256SHA384SHA512)r r rw rw rx _oaep_hash_supported s
z Backend._oaep_hash_supportedc C s t |trdS t |tr2t |jtr2| j|jjS t |trt |jtr| j|jjo| j|jo|j d kpt
|j dkp| j j dkS dS d S )NTr rz F)
r rZ r[ Z_mgfrX r
_algorithmrY r& Z_labelr r~ Z Cryptography_HAS_RSA_OAEP_LABEL)r Zpaddingrw rw rx rsa_padding_supported s
z Backend.rsa_padding_supportedc C s~ |dkrt d| jj }| j|| jjk | jj|| jj}| jj||| jjd| jj| jj| jj}| j|dk t | |S ) N z0Key size must be 1024, 2048, 3072, or 4096 bits.r rz )r) r* r+ r, )
r r~ DSA_newr r| r r r ZDSA_generate_parameters_exr- )r r ctxr rw rw rx generate_dsa_parameters( s
z Backend.generate_dsa_parametersc C sT | j j|j}| j|| jjk | jj|| j j}| j j| | j |}t
| ||S )N) r~ Z
DSAparams_dupZ
_dsa_cdatar r| r r r ZDSA_generate_key_dsa_cdata_to_evp_pkeyr. )r
parametersr. r rw rw rx generate_dsa_private_key@ s
z Backend.generate_dsa_private_keyc C s | j |}| j|S )N)r/ r2 )r r r1 rw rw rx 'generate_dsa_private_key_and_parametersI s
z/Backend.generate_dsa_private_key_and_parametersc C sB | j j||||}| j|dk | j j|||}| j|dk d S )Nrz )r~ DSA_set0_pqgr Z DSA_set0_key)r r r r gpub_keypriv_keyr rw rw rx _dsa_cdata_set_valuesM s z Backend._dsa_cdata_set_valuesc
C s t j| |jj}| jj }| j|| jjk | jj || jj
}| j |j }| j |j
}| j |j}| j |jj}| j |j}| j|||||| | j|} t| || S )N)rS Z_check_dsa_private_numbersr parameter_numbersr~ r- r r| r r r r r r r5 yxr8 r0 r. )
r r r9 r r r r5 r6 r7 r rw rw rx load_dsa_private_numbersS s
z Backend.load_dsa_private_numbersc C s t j|j | jj }| j|| jjk | jj|| jj }| j
|jj }| j
|jj }| j
|jj
}| j
|j}| jj}| j|||||| | j|}t| ||S )N)rS _check_dsa_parametersr9 r~ r- r r| r r r r r r r5 r: r8 r0 r/ ) r r r r r r5 r6 r7 r rw rw rx load_dsa_public_numbersf s
z Backend.load_dsa_public_numbersc C s t j| | jj }| j|| jjk | jj|| jj}| j |j
}| j |j }| j |j }| jj
||||}| j|dk t| |S )Nrz )rS r= r~ r- r r| r r r r r r r5 r4 r- )r r r r r r5 r rw rw rx load_dsa_parameter_numbersw s
z"Backend.load_dsa_parameter_numbersc C s( | j }| jj||}| j|dk |S )Nrz )r r~ ZEVP_PKEY_set1_DSAr )r r r r rw rw rx r0 s z Backend._dsa_cdata_to_evp_pkeyc C s
| j |S )N)r )r r rw rw rx dsa_hash_supported s zBackend.dsa_hash_supportedc C s dS )NTrw )r r r r5 rw rw rx dsa_parameters_supported s z Backend.dsa_parameters_supportedc C s | j |td|j S )N )r re Z
block_size)r r rw rw rx cmac_algorithm_supported s z Backend.cmac_algorithm_supportedc C s
t | |S )N)r )r r rw rw rx create_cmac_ctx s zBackend.create_cmac_ctxc C s t |tjtjfr$|d k r|tdnXt |tjtj t
j fsDt dn8t |t
jsZt dn"t |t
jr|t |tj r|tdd S )Nz8algorithm must be None when signing via ed25519 or ed448z;Key must be an rsa, dsa, ec, ed25519, or ed448 private key.z.Algorithm must be a registered hash algorithm.z2MD5 hash algorithm is only supported with RSA keys)r rU Ed25519PrivateKeyrV Ed448PrivateKeyr rW Z
RSAPrivateKeyrS Z
DSAPrivateKeyrT ZEllipticCurvePrivateKey TypeErrorrQ Z
HashAlgorithmZMD5)r private_keyr rw rw rx _x509_check_signature_params s
z$Backend._x509_check_signature_paramsc
s t |tjstd j|| j||} jj } j| j j
k j j | jj } jj
|tjjj} j|dk jj|t |j} j|dk |j } jj||j} j|dk jj } j| j j
k j j | fdd} j|j j| jjdd jj ||} j|dk xN|j D ]D\} }
t | j } jj || tj!j"j#j|
t$|
} j|dk q8W jj%||j|}|dkr j& } t'd| t( |S ) NzBuilder type mismatch.rz c s j j| jj j jdS )NX509_EXTENSION_free)r~ Zsk_X509_EXTENSION_pop_freer| addressof
_original_lib)r; )r rw rx r s z)Backend.create_x509_csr..F)
extensionsr x509_objadd_funcr r zSigning failed))r r Z CertificateSigningRequestBuilderrG rI _evp_md_x509_null_if_eddsar~ Z X509_REQ_newr r| r r
X509_REQ_freeZX509_REQ_set_versionZVersionZv1valueZX509_REQ_set_subject_namer>
_subject_name
public_keyZX509_REQ_set_pubkey _evp_pkeyZsk_X509_EXTENSION_new_null_create_x509_extensions _extensionsr Zsk_X509_EXTENSION_insertZX509_REQ_add_extensions _attributesr?
dotted_stringZX509_REQ_add1_attr_by_OBJr Z _ASN1TypeZ
UTF8Stringr Z
X509_REQ_signr r rN )
r builderrH r r x509_reqr rT Z sk_extensionZattr_oidZattr_valobjr rw )r rx create_x509_csr sT
zBackend.create_x509_csrc C sx t |tjstd| j|| | j||}| jj }| jj || jj
}| jj ||j j
}| j|dk | jj|t| |j}| j|dk | jj||jj}| j|dk t| |j}| jj||}| j|dk | j| jj||j | j| jj||j | j |j | j || jj dd | jj!|t| |j"}| j|dk | jj#||j|}|dkrn| j$ }t%d|t&| |S )NzBuilder type mismatch.rz T)rM r rN rO r r zSigning failed)'r r ZCertificateBuilderrG rI rP r~ ZX509_newr| r X509_freeZX509_set_versionZ_versionrR r ZX509_set_subject_namer> rS ZX509_set_pubkeyZ _public_keyrU r< _serial_numberZX509_set_serialNumber_set_asn1_timeZX509_getm_notBeforeZ_not_valid_beforeZX509_getm_notAfterZ_not_valid_afterrV rW r Z X509_add_extZX509_set_issuer_name _issuer_nameZ X509_signr r rL ) r rZ rH r r Z x509_certr
serial_numberr rw rw rx create_x509_certificate sF
z Backend.create_x509_certificatec C s( t |tjtjfr| jjS | j|S d S )N)r rU rE rV rF r| r r )r rH r rw rw rx rP ; s z"Backend._evp_md_x509_null_if_eddsac C sL |j dkr |jdjd}n|jdjd}| jj||}| j|dk d S )Ni z
%Y%m%d%H%M%SZr z
%y%m%d%H%M%SZrz )ZyearZstrftimer r~ ZASN1_TIME_set_stringr )r asn1_timetimeZasn1_strr rw rw rx r` D s
zBackend._set_asn1_timec C s> | j j }| j|| jjk | jj|| j j}| j|| |S )N)r~ Z
ASN1_TIME_newr r| r r ZASN1_TIME_freer` )r re rd rw rw rx _create_asn1_timeL s
zBackend._create_asn1_timec C sx t |tjstd| j|| | j||}| jj }| jj || jj
}| jj |d}| j |dk | jj
|t| |j}| j |dk | j|j}| jj||}| j |dk | j|j}| jj||}| j |dk | j|j| j|| jjdd xJ|jD ]@} | jj| j}
| j |
| jj k | jj ||
}| j |dk qW | jj ||j |}|dkrn| j } t!d| t"| |S )NzBuilder type mismatch.rz T)rM r rN rO r r zSigning failed)#r r Z CertificateRevocationListBuilderrG rI rP r~ Z X509_CRL_newr| r
X509_CRL_freeZX509_CRL_set_versionr ZX509_CRL_set_issuer_namer> ra rf Z _last_updateZX509_CRL_set_lastUpdate _next_updateZX509_CRL_set_nextUpdaterV rW r ZX509_CRL_add_extZ_revoked_certificatesZX509_REVOKED_dupZ
_x509_revokedr ZX509_CRL_add0_revokedZ
X509_CRL_signrU r r rM ) r rZ rH r r x509_crlr Z last_update next_updateZ revoked_certZrevokedr rw rw rx create_x509_crlS sB
zBackend.create_x509_crlc
C sh xbt |D ]V\}}| j||}| j|| jjk |rF| jj|| jj}||||} | j| dk q
W d S )Nrz ) enumerate_create_x509_extensionr r| r r r~ rJ )
r rM r rN rO r i extensionZx509_extensionr rw rw rx rV s z Backend._create_x509_extensionsc C s. t | |jj}| jj| jj||jr&dnd|S )Nrz r )r? oidrY r~ Z X509_EXTENSION_create_by_OBJr| r critical)r ro rR r\ rw rw rx _create_raw_x509_extension s z"Backend._create_raw_x509_extensionc C s t |jtjr(t| |jj}| j||S t |jtjrfttfdd |jD }t| |}| j||S t |jtj rt| tt
}| j||S y||j }W n$ t k
r t
dj|j Y nX || |j}| jj|j jjd}| j|| jjk | jj||jr
dnd|S d S )Nc S s g | ]}t tt|jqS rw )r r r rR ).0r; rw rw rx
s z2Backend._create_x509_extension..zExtension not supported: {}r rz r )r rR r ZUnrecognizedExtensionr= rr Z
TLSFeaturer r
Z
PrecertPoisonr rp r NotImplementedErrorr r~ Z OBJ_txt2nidrY r r NID_undefZX509V3_EXT_i2drq )r r ro rR Zasn1r Z
ext_structnidrw rw rx rm s0
z Backend._create_x509_extensionc C s t |tjstd| jj }| j|| jjk | jj || jj
}t | |j }| jj
||}| j|dk | j|j}| jj||}| j|dk | j|j| j|| jjdd t| d |S )NzBuilder type mismatch.rz T)rM r rN rO r )r r ZRevokedCertificateBuilderrG r~ ZX509_REVOKED_newr r| r r ZX509_REVOKED_freer< r_ Z X509_REVOKED_set_serialNumberrf Z_revocation_dateZ X509_REVOKED_set_revocationDaterV rW r ZX509_REVOKED_add_extrO )r rZ Z x509_revokedrb r Zrev_daterw rw rx create_x509_revoked_certificate s&
z'Backend.create_x509_revoked_certificatec C s | j | jj| j||S )N) _load_keyr~ ZPEM_read_bio_PrivateKeyr )r r passwordrw rw rx load_pem_private_key s
z Backend.load_pem_private_keyc C s | j |}| jj|j| jj| jj| jj}|| jjkrR| jj|| jj}| j|S | j | jj
|j}| j |dk | jj |j| jj| jj| jj}|| jjkr| jj|| jj
}| j|}t| ||S | j d S )Nrz )r r~ ZPEM_read_bio_PUBKEYrr r| r r r r r BIO_resetr ZPEM_read_bio_RSAPublicKeyr r rG _handle_key_loading_error)r r mem_bior r r rw rw rx load_pem_public_key s
zBackend.load_pem_public_keyc C s^ | j |}| jj|j| jj| jj| jj}|| jjkrR| jj|| jj}t| |S | j d S )N)
r r~ ZPEM_read_bio_DHparamsrr r| r r r r) r} )r r r~ r rw rw rx load_pem_parameters s
zBackend.load_pem_parametersc C s> | j |}| j||}|r$| j|S | j| jj| j||S d S )N)r "_evp_pkey_from_der_traditional_keyr ry r~ Zd2i_PKCS8PrivateKey_bio)r r rz r
r rw rw rx load_der_private_key s
z Backend.load_der_private_keyc C sV | j j|j| jj}|| jjkrF| jj|| j j}|d k rBtd|S | j d S d S )Nz4Password was given but private key is not encrypted.) r~ d2i_PrivateKey_biorr r| r r r rG r )r r
rz r rw rw rx r s z*Backend._evp_pkey_from_der_traditional_keyc C s | j |}| jj|j| jj}|| jjkrF| jj|| jj}| j|S | j | jj
|j}| j |dk | jj |j| jj}|| jjkr| jj|| jj
}| j|}t| ||S | j d S )Nrz )r r~ Zd2i_PUBKEY_biorr r| r r r r r r| r Zd2i_RSAPublicKey_bior r rG r} )r r r~ r r r rw rw rx load_der_public_key( s
zBackend.load_der_public_keyc C s | j |}| jj|j| jj}|| jjkrF| jj|| jj}t| |S | jj r| j
| jj |j}| j |dk | jj
|j| jj}|| jjkr| jj|| jj}t| |S | j d S )Nrz )r r~ Zd2i_DHparams_biorr r| r r r r) r r r| r Z Cryptography_d2i_DHxparams_bior} )r r r~ r r rw rw rx load_der_parameters? s
zBackend.load_der_parametersc C sb | j |}| jj|j| jj| jj| jj}|| jjkrF| j td| jj|| jj }t
| |S )NzwUnable to load certificate. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.) r r~ ZPEM_read_bio_X509rr r| r r r r r^ rL )r r r~ r rw rw rx load_pem_x509_certificateS s
z!Backend.load_pem_x509_certificatec C sV | j |}| jj|j| jj}|| jjkr:| j td| jj|| jj }t
| |S )NzUnable to load certificate) r r~ Z d2i_X509_biorr r| r r r r r^ rL )r r r~ r rw rw rx load_der_x509_certificateb s
z!Backend.load_der_x509_certificatec C sb | j |}| jj|j| jj| jj| jj}|| jjkrF| j td| jj|| jj }t
| |S )NzoUnable to load CRL. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.) r r~ ZPEM_read_bio_X509_CRLrr r| r r r r rg rM )r r r~ ri rw rw rx load_pem_x509_crll s
zBackend.load_pem_x509_crlc C sV | j |}| jj|j| jj}|| jjkr:| j td| jj|| jj }t
| |S )NzUnable to load CRL) r r~ Zd2i_X509_CRL_biorr r| r r r r rg rM )r r r~ ri rw rw rx load_der_x509_crl{ s
zBackend.load_der_x509_crlc C sb | j |}| jj|j| jj| jj| jj}|| jjkrF| j td| jj|| jj }t
| |S )NzsUnable to load request. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.) r r~ ZPEM_read_bio_X509_REQrr r| r r r r rQ rN )r r r~ r[ rw rw rx load_pem_x509_csr s
zBackend.load_pem_x509_csrc C sV | j |}| jj|j| jj}|| jjkr:| j td| jj|| jj }t
| |S )NzUnable to load request) r r~ Zd2i_X509_REQ_biorr r| r r r r rQ rN )r r r~ r[ rw rw rx load_der_x509_csr s
zBackend.load_der_x509_csrc
C s* | j |}| jjd}|d k rFtjd| | jj|}||_t||_||j | jj
| jj | j j
d|}|| jj
kr|jdkr| j } | j| |jd
krtdq|jd ksttdj|jd n| j | jj|| j j}|d k o|jdk rtd |d k r|jdks"|d ks"t||S ) Nz CRYPTOGRAPHY_PASSWORD_DATA *rz Z Cryptography_pem_password_cbr rz z3Password was not given but private key is encryptedr zAPasswords longer than {} bytes are not supported by this backend.z4Password was given but private key is not encrypted.)r r| r r _check_bytesliker rz r r rr r rK r~ rL errorr r rG r r r maxsizer} r r Zcalled)
r Zopenssl_read_funcZ convert_funcr rz r~ ZuserdataZ password_ptrr r rw rw rx ry s@
zBackend._load_keyc s j }|stdn|d j jj jjsF|d j jj jjrPtdn|d j jj jjs|d j jj jj
rt dt j
nLt fdd|D rtdn,|d j jj jj jjfksttdd S )Nz Could not deserialize key data.r z Bad decrypt. Incorrect password?z0PEM data is encrypted with an unsupported cipherc 3 s" | ]}|j jj jjV qd S )N)_lib_reason_matchr~ ERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)rs r )r rw rx s z4Backend._handle_key_loading_error..z!Unsupported public key algorithm.)r r r r~ r ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZEVP_R_UNKNOWN_PBE_ALGORITHMZ ERR_LIB_PEMZ PEM_R_UNSUPPORTED_ENCRYPTIONr r
ZUNSUPPORTED_CIPHERanyr} Z ERR_LIB_ASN1r )r r rw )r rx r} s2
z!Backend._handle_key_loading_errorc C sv y| j |}W n tk
r* | jj}Y nX | jj|}|| jjkrP| j dS | j|| jjk | jj | dS d S )NFT)
_elliptic_curve_to_nidr r~ rv ZEC_GROUP_new_by_curve_namer| r r r Z
EC_GROUP_free)r curve curve_nidgrouprw rw rx elliptic_curve_supported s z Backend.elliptic_curve_supportedc C s t |tjsdS | j|S )NF)r rT ZECDSAr )r Zsignature_algorithmr rw rw rx ,elliptic_curve_signature_algorithm_supported s z4Backend.elliptic_curve_signature_algorithm_supportedc C s\ | j |rD| j|}| jj|}| j|dk | j|}t| ||S tdj|j t
j dS )z@
Generate a new private key on the named curve.
rz z#Backend object does not support {}.N) r _ec_key_new_by_curver~ ZEC_KEY_generate_keyr _ec_cdata_to_evp_pkeyr0 r r r r
UNSUPPORTED_ELLIPTIC_CURVE)r r r r r rw rw rx #generate_elliptic_curve_private_key s
z+Backend.generate_elliptic_curve_private_keyc C sp |j }| j|j}| jj| j|j| jj}| jj ||}| j
|dk | j ||j |j
}| j|}t| ||S )Nrz )r r r r| r r
private_valuer~
BN_clear_freeEC_KEY_set_private_keyr )_ec_key_set_public_key_affine_coordinatesr; r: r r0 )r r Zpublicr r r r rw rw rx #load_elliptic_curve_private_numbers% s
z+Backend.load_elliptic_curve_private_numbersc C s4 | j |j}| j||j|j}| j|}t| ||S )N)r r r r; r: r r1 )r r r r rw rw rx "load_elliptic_curve_public_numbers8 s
z*Backend.load_elliptic_curve_public_numbersc
C s | j |}| jj|}| j|| jjk | jj|}| j|| jjk | jj|| jj}| j 6}| jj
|||t ||}|dkr| j t
dW d Q R X | jj||}| j|dk | j|}t| ||S )Nrz z(Invalid public bytes for the given curve)r r~ EC_KEY_get0_groupr r| r EC_POINT_newr
EC_POINT_free _tmp_bn_ctxZEC_POINT_oct2pointr r r EC_KEY_set_public_keyr r1 ) r r Z point_bytesr r pointbn_ctxr r rw rw rx load_elliptic_curve_public_bytesA s
z(Backend.load_elliptic_curve_public_bytesc C sD | j |}| j|\}}| jj|}| j|| jjk | jj|| jj}| j |}| jj|| jj
}| j h}| jj |||| jj| jj|} | j| dk | jj
|}
| jj
|} ||||
| |} | j| dk W d Q R X | jj||} | j| dk | j |} | jj| | jj
} | jj|| } | j| dk | j|}
t| ||
S )Nrz )r _ec_key_determine_group_get_funcr~ r r r| r r r r r r Z EC_POINT_mulZ
BN_CTX_getr r r r0 )r r r r get_funcr r rR r r Zbn_xZbn_yZprivater rw rw rx !derive_elliptic_curve_private_keyU s.
z)Backend.derive_elliptic_curve_private_keyc C s | j |}| j|S )N)r _ec_key_new_by_curve_nid)r r r rw rw rx r x s
z Backend._ec_key_new_by_curvec C sB | j j|}| j|| jjk | j j|tj j | jj|| j j S )N)
r~ ZEC_KEY_new_by_curve_namer r| r ZEC_KEY_set_asn1_flagbackendZOPENSSL_EC_NAMED_CURVEr r )r r r rw rw rx r | s
z Backend._ec_key_new_by_curve_nidc C sV | j |}| jj|j| jj}|| jjkr:| j td| jj|| jj }t
| |S )NzUnable to load OCSP request) r r~ Zd2i_OCSP_REQUEST_biorr r| r r r r OCSP_REQUEST_freerB )r r r~ Zrequestrw rw rx load_der_ocsp_request s
z Backend.load_der_ocsp_requestc C sV | j |}| jj|j| jj}|| jjkr:| j td| jj|| jj }t
| |S )Nz Unable to load OCSP response) r r~ Zd2i_OCSP_RESPONSE_biorr r| r r r r OCSP_RESPONSE_freerC )r r r~ Zresponserw rw rx load_der_ocsp_response s
z Backend.load_der_ocsp_responsec C s | j j }| j|| jjk | jj|| j j}|j\}}}| j|}| j j ||j
|j
}| j|| jjk | j j ||}| j|| jjk | j |j
| j|| j jdd t| |S )NT)rM r rN rO r )r~ ZOCSP_REQUEST_newr r| r r r Z_requestr OCSP_cert_to_id_x509ZOCSP_request_add0_idrV rW r ZOCSP_REQUEST_add_extrB ) r rZ Zocsp_reqcertZissuerr r certidZonereqrw rw rx create_ocsp_request s
zBackend.create_ocsp_requestc C s | j || | jj }| j|| jjk | jj|| jj}| j|j j
}| jj ||j j j
|j jj
}| j|| jjk | jj|| jj}|j jd krd}n t|j j }|j jd kr| jj}n| j|j j}| jj} |j jd k r| j|j j} | j|j j}
| jj|||j jj|||
| } | j| | jjk | j||}|j\} }
| jj}|
t j j krb|| jj O }|j d k rx.|j D ]$}| jj!||j
} | j| dk qvW | j"|j#| j$|| jj%dd | jj&|| j
|j'|| jj|} | dkr| j( }t)d||S )Nrz T)rM r rN rO r zAError while signing. responder_cert must be signed by private_keyr )*rI r~ ZOCSP_BASICRESP_newr r| r r ZOCSP_BASICRESP_freer Z _responser' r Z_certr Z_issuerZOCSP_CERTID_freeZ_revocation_reasonr Z_revocation_timerf rh Z _this_updateZOCSP_basic_add1_statusZ _cert_statusrR rP Z
_responder_idZ OCSP_NOCERTSrp ZOCSPResponderEncodingZHASHZOCSP_RESPID_KEYZ_certsZOCSP_basic_add1_certrV rW r ZOCSP_BASICRESP_add_extZOCSP_basic_signrU r r )r rZ rH r basicr r reasonZrev_timerj Z this_updater Zresponder_certZresponder_encodingflagsr r rw rw rx _create_ocsp_basic_response s|
z#Backend._create_ocsp_basic_responsec C sb |t jjkr | j|||}n| jj}| jj|j|}| j || jjk | jj
|| jj }t | |S )N)
rp ZOCSPResponseStatusZ
SUCCESSFULr r| r r~ ZOCSP_response_createrR r r r rC )r Zresponse_statusrZ rH r r Z ocsp_resprw rw rx create_ocsp_response s
z Backend.create_ocsp_responsec C s | j |ot|tjS )N)r r rT ZECDH)r r r rw rw rx +elliptic_curve_exchange_algorithm_supported s z3Backend.elliptic_curve_exchange_algorithm_supportedc C s( | j }| jj||}| j|dk |S )Nrz )r r~ ZEVP_PKEY_set1_EC_KEYr )r r r r rw rw rx r s z Backend._ec_cdata_to_evp_pkeyc C sN ddd}|j |j|j}| jj|j }|| jjkrJtdj|jtj |S )z/
Get the NID for a curve name.
Z
prime192v1Z
prime256v1)Z secp192r1Z secp256r1z${} is not a supported elliptic curve)
getr r~
OBJ_sn2nidr rv r r r
r )r r Z
curve_aliasesZ
curve_namer rw rw rx r ! s
z Backend._elliptic_curve_to_nidc c sX | j j }| j|| jjk | jj|| j j}| j j| z
|V W d | j j| X d S )N) r~ Z
BN_CTX_newr r| r r Z BN_CTX_freeZ BN_CTX_startZ
BN_CTX_end)r r rw rw rx r 2 s
zBackend._tmp_bn_ctxc C s | j || jjk | jjd}| j || jjk | jj|}| j || jjk | jj|}| j || jjk | jj|}| j || jjk ||kr| jj r| jj
}n| jj }|st ||fS )zu
Given an EC_KEY determine the group and what function is required to
get point coordinates.
s characteristic-two-field)
r r| r r~ r rv r ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFpr )r r. Z
nid_two_fieldr methodrw r rw rw rx r = s
z(Backend._ec_key_determine_group_get_funcc C st |dk s|dk rt d| jj| j|| jj}| jj| j|| jj}| jj|||}|dkrp| j t d|S )zg
Sets the public key point in the EC_KEY context to the affine x and y
values.
r z2Invalid EC key. Both x and y must be non-negative.rz zInvalid EC key.)r r| r r r~ r Z(EC_KEY_set_public_key_affine_coordinatesr )r r. r; r: r rw rw rx r Y s z1Backend._ec_key_set_public_key_affine_coordinatesc
C s* t |tjstdt |tjs(tdt |tjs.) r> r| r r~ Z
i2d_X509_NAMEr r r r )r r Z x509_nameZppr rw )r rx x509_name_bytes s
zBackend.x509_name_bytesc C sh t |dkrtd| j }| jj|| jj}| j|dk | jj||t |}| j|dk t| |S )N z%An X25519 public key is 32 bytes longrz ) r r r r~ ZEVP_PKEY_set_type
NID_X25519r Z EVP_PKEY_set1_tls_encodedpointrI )r r r r rw rw rx x25519_load_public_bytes s z Backend.x25519_load_public_bytesc C s t |dkrtdd}| jd<}||dd< ||dd < | j|}| jj|j| jj}W d Q R X | j || jjk | jj
|| jj }| j | jj || jj
k t| |S )Nr z&An X25519 private key is 32 bytes longs 0. 0+en" 0 r r )r r _zeroed_bytearrayr r~ r rr r| r r r r r r rH )r r Z pkcs8_prefixbarr r rw rw rx x25519_load_private_bytes s
z!Backend.x25519_load_private_bytesc C s | j j|| jj}| j|| jjk | jj|| j j}| j j|}| j|dk | jjd}| j j ||}| j|dk | j|d | jjk | jj|d | j j
}|S )Nrz z EVP_PKEY **r ) r~ ZEVP_PKEY_CTX_new_idr| r r r ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr ZEVP_PKEY_keygenr )r rw Z evp_pkey_ctxr Z evp_ppkeyr rw rw rx _evp_pkey_keygen_gc
s zBackend._evp_pkey_keygen_gcc C s | j | jj}t| |S )N)r r~ r rH )r r rw rw rx x25519_generate_key s zBackend.x25519_generate_keyc C s | j r
dS | jjS )NF)r r~ Z#CRYPTOGRAPHY_OPENSSL_110_OR_GREATER)r rw rw rx x25519_supported s zBackend.x25519_supportedc C s` t |dkrtd| jj| jj| jj|t |}| j|| jjk | jj|| jj }t
| |S )N8 z#An X448 public key is 56 bytes long) r r r~ EVP_PKEY_new_raw_public_keyNID_X448r| r r r r rK )r r r rw rw rx x448_load_public_bytes# s z Backend.x448_load_public_bytesc C sl t |dkrtd| jj|}| jj| jj| jj|t |}| j|| jjk | jj || jj
}t | |S )Nr z$An X448 private key is 56 bytes long) r r r| r r~ EVP_PKEY_new_raw_private_keyr r r r r rJ )r r r r rw rw rx x448_load_private_bytes. s z Backend.x448_load_private_bytesc C s | j | jj}t| |S )N)r r~ r rJ )r r rw rw rx x448_generate_key: s zBackend.x448_generate_keyc C s | j r
dS | jj S )NF)r r~ Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111)r rw rw rx x448_supported> s zBackend.x448_supportedc C s | j r
dS | jj S )NF)r r~ #CRYPTOGRAPHY_OPENSSL_LESS_THAN_111B)r rw rw rx ed25519_supportedC s zBackend.ed25519_supportedc C sn t jd| t|tjkr"td| jj| jj| j j
|t|}| j || j j
k | j j || jj
}t| |S )Nr z&An Ed25519 public key is 32 bytes long)r _check_bytesr rU _ED25519_KEY_SIZEr r~ r NID_ED25519r| r r r r r3 )r r r rw rw rx ed25519_load_public_bytesH s z!Backend.ed25519_load_public_bytesc C sz t |tjkrtdtjd| | jj|}| jj | jj
| jj |t |}| j || jj k | jj
|| jj}t| |S )Nz'An Ed25519 private key is 32 bytes longr )r rU r r r r r| r r~ r r r r r r r2 )r r r r rw rw rx ed25519_load_private_bytesV s z"Backend.ed25519_load_private_bytesc C s | j | jj}t| |S )N)r r~ r r2 )r r rw rw rx ed25519_generate_keyd s z Backend.ed25519_generate_keyc C s | j r
dS | jj S )NF)r r~ r )r rw rw rx ed448_supportedh s zBackend.ed448_supportedc C sl t jd| t|tkr td| jj| jj| jj |t|}| j
|| jj k | jj || jj }t
| |S )Nr z$An Ed448 public key is 57 bytes long)r r r r4 r r~ r NID_ED448r| r r r r r6 )r r r rw rw rx ed448_load_public_bytesm s z Backend.ed448_load_public_bytesc C sx t jd| t|tkr td| jj|}| jj| jj | jj
|t|}| j || jj
k | jj || jj
}t| |S )Nr z%An Ed448 private key is 57 bytes long)r r r r4 r r| r r~ r r r r r r r5 )r r r r rw rw rx ed448_load_private_bytesz s z Backend.ed448_load_private_bytesc C s | j | jj}t| |S )N)r r~ r r5 )r r rw rw rx ed448_generate_key s zBackend.ed448_generate_keyc C s | j jd|}| j j|}| jj|t||t||||tj||
} | dkrr| j }
d| | d } t dj
| |
| j j |d d S )Nzunsigned char[]rz i r zJNot enough memory to derive key. These parameters require {} MB of memory.i ) r| r r r~ ZEVP_PBE_scryptr rm Z
_MEM_LIMITr MemoryErrorr r ) r r r r r rr r r r r Z
min_memoryrw rw rx
derive_scrypt s* zBackend.derive_scryptc C s2 t j|}| jr || jkr dS | jj|| jjkS )NF)r Z_aead_cipher_namer
_fips_aeadr~ r r| r )r r cipher_namerw rw rx aead_cipher_supported s
z Backend.aead_cipher_supportedc c s& t |}z
|V W d| j|| X dS )z
This method creates a bytearray, which we copy data into (hopefully
also from a mutable buffer that can be dynamically erased!), and then
zero when we're done.
N) bytearray
_zero_data)r r r rw rw rx r s
zBackend._zeroed_bytearrayc C s xt |D ] }d||< q
W d S )Nr )r )r r r rn rw rw rx r s zBackend._zero_datac
c sf |dkr| j jV nNt|}| j jd|d }| j j||| z
|V W d| j| j jd|| X dS )a
This method takes bytes, which can be a bytestring or a mutable
buffer like a bytearray, and yields a null-terminated version of that
data. This is required because PKCS12_parse doesn't take a length with
its password char * and ffi.from_buffer doesn't provide null
termination. So, to support zeroing the data via bytearray we
need to build this ridiculous construct that copies the memory, but
zeroes it after use.
Nzchar[]rz z uint8_t *)r| r r r Zmemmover cast)r r Zdata_lenr rw rw rx _zeroed_null_terminated_buf s
z#Backend._zeroed_null_terminated_bufc
C s |d k rt jd| | j|}| jj|j| jj}|| jjkrN| j t d| jj
|| jj }| jj d}| jj d}| jj d}| j
|}| jj|||||} W d Q R X | dkr| j t dd }
d } g } |d | jjkr| jj
|d | jj}
| j|
} |d | jjkr6| jj
|d | jj}t| |}
|d | jjkr| jj
|d | jj}| jj|d }xTt|D ]H}| jj||}| j|| jjk | jj
|| jj}| jt| | qxW | |
| fS )Nrz z!Could not deserialize PKCS12 dataz EVP_PKEY **zX509 **z Cryptography_STACK_OF_X509 **r z Invalid password or PKCS12 data)r r r r~ Zd2i_PKCS12_biorr r| r r r r PKCS12_freer r Z PKCS12_parser r r^ rL sk_X509_free sk_X509_numr
sk_X509_valuer r )r r rz rr p12Z evp_pkey_ptrZx509_ptrZ sk_x509_ptr password_bufr r r Zadditional_certificatesr r sk_x509r rn rw rw rx %load_key_and_certificates_from_pkcs12 sF
z-Backend.load_key_and_certificates_from_pkcs12c C s d }|d k rt jd| t|tjr6d}d}d} d}
n4t|tjrb| jj}| jj}d} d}
|j}nt d|d ks~t
|dkr| j j } nL| jj
} | j j| | jj} x.t|D ]"} | jj| | j}
tj|
dk qW | j|Z}| j|D}| jj|||r|jn| j j |r|jn| j j | ||| |
d
}W d Q R X W d Q R X | j|| j j k | j j|| jj}| j }| jj||}
| j|
dk | j|S )Nr rz r i N z Unsupported key encryption typer r ) r r r rR r r r~ Z&NID_pbe_WithSHA1And3_Key_TripleDES_CBCrz r r r| r sk_X509_new_nullr r reversed sk_X509_pushr r r r Z
PKCS12_createrU r r Zi2d_PKCS12_bior )r r r r Zcasr rz Znid_certZnid_keyZ pkcs12_iterZmac_iterr Zcar r Zname_bufr rr rw rw rx (serialize_key_and_certificates_to_pkcs12
sT
z0Backend.serialize_key_and_certificates_to_pkcs12c C s | j r
dS | jjdkS )NFrz )r r~ ZCryptography_HAS_POLY1305)r rw rw rx poly1305_supportedF
s zBackend.poly1305_supportedc C s* t jd| t|tkr tdt| |S )Nr z A poly1305 key is 32 bytes long)r r r rD r rE )r r rw rw rx create_poly1305_ctxK
s zBackend.create_poly1305_ctxc C sn t jd| | j|}| jj|j| jj| jj| jj}|| jjkrR| j t d| jj
|| jj }| j |S )Nr zUnable to parse PKCS7 data)
r r r r~ ZPEM_read_bio_PKCS7rr r| r r r r
PKCS7_free_load_pkcs7_certificates)r r rr p7rw rw rx load_pem_pkcs7_certificatesR
s
z#Backend.load_pem_pkcs7_certificatesc C sb t jd| | j|}| jj|j| jj}|| jjkrF| j t d| jj
|| jj }| j |S )Nr zUnable to parse PKCS7 data)
r r r r~ Z
d2i_PKCS7_biorr r| r r r r r r )r r rr r! rw rw rx load_der_pkcs7_certificates_
s
z#Backend.load_der_pkcs7_certificatesc C s | j j|j}| j|| j jk || j jkr>tdj|tj g }|j
j | j j
krV|S |j
j j}| j j|}xlt|D ]`}| j j||}| j|| j j
k | j j|}| j|dk | j j|| j j}|jt| | qvW |S )NzNOnly basic signed structures are currently supported. NID for this data was {}rz )r~ Z OBJ_obj2nidr r rv ZNID_pkcs7_signedr r r
ZUNSUPPORTED_SERIALIZATIONr Zsignr| r r r r r Z X509_up_refr r^ r rL ) r r! rw certsr r rn r r rw rw rx r j
s(
z Backend._load_pkcs7_certificatesc C s | j |j}| jj}d}t|jdkr0| jj}nJ| jj }| jj || jj
}x,|jD ]"}| jj ||j } | j
| dk qTW tjj|kr|| jjO }|| jjO }| jj| jj| jj|| jj|}
| j
|
| jjk | jj |
| jj}
d} tjj|kr| | jjO } ntjj|kr | | jjO } tjj|kr6| | jjO } xJ|jD ]@\} }
}| j|}| jj |
| j |
j || }| j
|| jjk q>W xD|D ]<}|tjj kr|| jj O }n|tjj kr|| jj!O }qW | j" }|t#j$j%kr| jj&||
|j'|} n|t#j$j(kr8| jj)|
|j'|} | j
| dk | jj*||
|j'|} n@|t#j$j+ksJt,| jj)|
|j'|} | j
| dk | jj-||
} | j
| dk | j.|S )Nr rz )/r _datar~ Z
PKCS7_PARTIALr Z_additional_certsr| r r r r r r r rn Z PKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDZ
PKCS7_signr ZNoCapabilitiesZPKCS7_NOSMIMECAPZ NoAttributesZ PKCS7_NOATTRZNoCertsZ
PKCS7_NOCERTSZ_signersr ZPKCS7_sign_add_signerrU ZTextZ
PKCS7_TEXTZBinaryZ PKCS7_BINARYr rR r ZSMIMEZSMIME_write_PKCS7rr r Z PKCS7_finalZPEM_write_bio_PKCS7_streamr r Z
i2d_PKCS7_bior )r rZ r Zoptionsrr Z
init_flagsZ final_flagsr$ r r r! Z signer_flagsZ certificaterH Zhash_algorithmZmdZ p7signerinfoZoptionZbio_outrw rw rx
pkcs7_sign
sj
zBackend.pkcs7_sign)N)N)N)rt ru rv __doc__r r
r\ rd r rQ r! r" r# r$ r% Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r Z_fips_rsa_min_key_sizeZ _fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusr r r r
contextlibr r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r& r( r/ r2 r3 r8 r< r> r? r0 r@ rA rC rD rI r] rc rP r` rf rk rV rr rm rx r{ r r r r r r r r r r r r ry r} r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r" r# r r& rw rw rw rx ry sV
-5
++ HB 8"
1) #
U i0
. "
. @
ry c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S )N)_fmt)r Zfmtrw rw rx r
s zGetCipherByName.__init__c C s& | j j||dj }|jj|jdS )N)r r r )r) r lowerr~ r r )r r r r r rw rw rx __call__
s zGetCipherByName.__call__N)rt ru rv r r+ rw rw rw rx r
s r c C s" dj |jd }| jj|jdS )Nz
aes-{}-xtsr r )r r r~ r r )r r r r rw rw rx r
s r )Z
__future__r r r collectionsr( r r r r Z six.movesr Z cryptographyr r Zcryptography.exceptionsr r
Zcryptography.hazmat._derr r r
r r Z'cryptography.hazmat.backends.interfacesr r r r r r r r r r r r r Z$cryptography.hazmat.backends.opensslr Z,cryptography.hazmat.backends.openssl.ciphersr Z)cryptography.hazmat.backends.openssl.cmacr Z0cryptography.hazmat.backends.openssl.decode_asn1r r! r" r# r$ r% r& r' r( Z'cryptography.hazmat.backends.openssl.dhr) r* r+ r, Z(cryptography.hazmat.backends.openssl.dsar- r. r/ Z'cryptography.hazmat.backends.openssl.ecr0 r1 Z,cryptography.hazmat.backends.openssl.ed25519r2 r3 Z*cryptography.hazmat.backends.openssl.ed448r4 r5 r6 Z0cryptography.hazmat.backends.openssl.encode_asn1r7 r8 r9 r: r; r< r= r> r? Z+cryptography.hazmat.backends.openssl.hashesr@ Z)cryptography.hazmat.backends.openssl.hmacrA Z)cryptography.hazmat.backends.openssl.ocsprB rC Z-cryptography.hazmat.backends.openssl.poly1305rD rE Z(cryptography.hazmat.backends.openssl.rsarF rG Z+cryptography.hazmat.backends.openssl.x25519rH rI Z)cryptography.hazmat.backends.openssl.x448rJ rK Z)cryptography.hazmat.backends.openssl.x509rL rM rN rO Z$cryptography.hazmat.bindings.opensslrP Z cryptography.hazmat.primitivesrQ rR Z)cryptography.hazmat.primitives.asymmetricrS rT rU rV rW Z1cryptography.hazmat.primitives.asymmetric.paddingrX rY rZ r[ Z1cryptography.hazmat.primitives.ciphers.algorithmsr\ r] r^ r_ r` ra rb rc rd Z,cryptography.hazmat.primitives.ciphers.modesre rf rg rh ri rj rk rl Z"cryptography.hazmat.primitives.kdfrm Z,cryptography.hazmat.primitives.serializationrn ro Zcryptography.x509rp
namedtuplerq objectrs Zregister_interfaceZregister_interface_ifr{ r} ZCryptography_HAS_SCRYPTry r r r rw rw rw rx s < , , , (
5