o
    4¬Wc“• ã                   @   sº  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZmZ d dlmZm Z  d dl!m"Z"m#Z#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5mZ6 d dl7m8Z8 d dl9m:Z:m;Z; d dl<m=Z= d dl>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZF d dlGmHZHmIZImJZJmKZK d dlLmMZMmNZNmOZO d dlPmQZQmRZR d dlSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ d dl`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZi d dljmkZk d dllmmZmmnZn d dlompZpmqZqmrZrmsZsmtZt e  ud d!d"g¡ZvG d#d$„ d$ƒZwG d%d&„ d&ƒZxG d'd(„ d(ƒZyd)exd*eTfd+d,„Zzexƒ Z{dS )-é    N)Úcontextmanager)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)Úaead)Ú_CipherContext©Ú_CMACContext)Ú_DHParametersÚ_DHPrivateKeyÚ_DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey©Ú_HashContext©Ú_HMACContext)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)r   )Úbinding)ÚhashesÚserialization)ÚAsymmetricPadding)ÚdhÚdsaÚecÚed25519Úed448ÚrsaÚx25519Úx448)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)Ú#CERTIFICATE_ISSUER_PUBLIC_KEY_TYPESÚPRIVATE_KEY_TYPESÚPUBLIC_KEY_TYPES)ÚBlockCipherAlgorithmÚCipherAlgorithm)ÚAESÚAES128ÚAES256ÚARC4ÚCamelliaÚChaCha20ÚSM4Ú	TripleDESÚ_BlowfishInternalÚ_CAST5InternalÚ_IDEAInternalÚ_SEEDInternal)	ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚModeÚOFBÚXTS)Úscrypt)Úpkcs7Ússh)ÚPBESÚPKCS12CertificateÚPKCS12KeyAndCertificatesÚ_ALLOWED_PKCS12_TYPESÚ_PKCS12_CAS_TYPESÚ
_MemoryBIOÚbioZchar_ptrc                   @   s   e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú__qualname__© r]   r]   úND:\Flask\env\Lib\site-packages\cryptography/hazmat/backends/openssl/backend.pyrY   ƒ   s    rY   c                   @   s@  e Zd ZdZdZh d£ZefZej	ej
ejejejejejejejejejejfZejejejejfZdZdZdd> ZdZde> Z dd„ Z!d	e"fd
d„Z#	dEde$de%j&e%j'e(j)  d	dfdd„Z*d	e$fdd„Z+dFdd„Z,dFdd„Z-e.j/dd„ ƒZ0dFdd„Z1d	e"fdd„Z2d	e"fdd„Z3d	e4fdd „Z5d!e6d"ej7d	e8fd#d$„Z9d"ej7fd%d&„Z:d"ej7fd'd(„Z;d"ej7d	e$fd)d*„Z<d"ej7d	e$fd+d,„Z=d	e$fd-d.„Z>d"ej7d	e$fd/d0„Z?d"ej7d	ej@fd1d2„ZAd3eBd4eCd	e$fd5d6„ZDd7d8„ ZEdFd9d:„ZFd3eBd4eCd	eGfd;d<„ZHd3eBd4eCd	eGfd=d>„ZId"ej7d	e$fd?d@„ZJd"ej7dAe4dBe6dCe4dDe6d	e6fdEdF„ZKd	e%j'e(j) fdGdH„ZLd	e%j'e(jM fdIdJ„ZNd	e4fdKdL„ZOdEdMe4fdNdO„ZPdPe4dQe4d	eQjRfdRdS„ZSdPe4dQe4d	e$fdTdU„ZTdVeQjUd	eQjRfdWdX„ZVdVeQjWd	eQjXfdYdZ„ZYd[d\„ ZZd]d^„ Z[d_e6fd`da„Z\dbdc„ Z]d	e6fddde„Z^d	e_fdfdg„Z`d	eafdhdi„Zbd"ej7d	e$fdjdk„Zcdledd	e$fdmdn„ZedQe4d	efjgfdodp„Zhdqefjgd	efjifdrds„ZjdQe4d	efjifdtdu„Zkdvdw„ ZldVefjmd	efjifdxdy„ZndVefjod	efjpfdzd{„ZqdVefjrd	efjgfd|d}„Zsd~d„ Ztd	e$fd€d„Zud"ej7d	e$fd‚dƒ„Zvd	e$fd„d…„Zwd"exd	eyfd†d‡„Zzd_e6dˆe%j&e6 d	e_fd‰dŠ„Z{d_e6d	eafd‹dŒ„Z|d_e6d	e}j~fddŽ„Zd_e6dˆe%j&e6 d	e_fdd„Z€d‘d’„ Zd_e6d	eafd“d”„Z‚d_e6d	e}j~fd•d–„Zƒd—e„j…d	e%j†fd˜d™„Z‡dše%j†d	e„j…fd›dœ„Zˆde„j‰d	e%j†fdždŸ„ZŠd e%j†d	e„j‰fd¡d¢„Z‹d£e„jŒd	e%j†fd¤d¥„Zd¦e%j†d	e„jŒfd§d¨„ZŽd£e„jŒd©ed	e$fdªd«„Zde„j‰d	e$fd¬d­„Z‘d®d¯„ Z’d°d±„ Z“d	e%j”fd²d³„Z•d´ej–d	e$fdµd¶„Z—d·ej˜d´ej–d	e$fd¸d¹„Z™d´ej–d	ejšfdºd»„Z›dVejœd	ejšfd¼d½„ZdVejžd	ejŸfd¾d¿„Z d´ej–dÀe6d	ejŸfdÁdÂ„Z¡dÃe4d´ej–d	ejšfdÄdÅ„Z¢d´ej–fdÆdÇ„Z£dÈe4fdÉdÊ„Z¤d"ej¥d´ej–d	e$fdËdÌ„Z¦dÍdÎ„ Z§d´ej–d	e4fdÏdÐ„Z¨e/dÑdÒ„ ƒZ©dÓdÔ„ ZªdÕe4dÖe4fd×dØ„Z«dÙe¬j­dÚe¬j®dÛe¬j¯d	e6fdÜdÝ„Z°dÞdß„ Z±dàdá„ Z²dÙe¬j­dÚe¬j³d	e6fdâdã„Z´d	e$fdädå„Zµdæe4dQe4d	e}j~fdçdè„Z¶dédê„ Z·dqe}j~d	e}j¸fdëdì„Z¹dæe4dQe4d	e}j¸fdídî„ZºdVe}j»d	e}j¸fdïdð„Z¼dVe}j½d	e}j¾fdñdò„Z¿dVe}jÀd	e}j~fdódô„ZÁ	dEdõe4döe4d÷e%j&e4 d	e$fdødù„ZÂd	e$fdúdû„ZÃd_e6d	eÄjÅfdüdý„ZÆd_e6d	eÄjÇfdþdÿ„ZÈd d„ ZÉd	eÄjÇfdd„ZÊd	e$fdd„ZËd_e6d	eÌjÍfdd„ZÎd_e6d	eÌjÏfdd	„ZÐd	eÌjÏfd
d„ZÑd	e$fdd„ZÒd	e$fdd„ZÓd_e6d	eÔjÕfdd„ZÖd_e6d	eÔj×fdd„ZØd	eÔj×fdd„ZÙd	e$fdd„ZÚd_e6d	eÛjÜfdd„ZÝd_e6d	eÛjÞfdd„Zßd	eÛjÞfdd„ZàdDe6dBe6dAe4de4de4dõe4d	e6fd d!„Zád	e$fd"d#„Zâe.j/dAe4d	e%jãeä fd$d%„ƒZådAe4d	dfd&d'„Zæe.j/d(d)„ ƒZçd_e6dˆe%j&e6 d	e%jèe%j&e_ e%j&e„j… e%j'e„j… f fd*d+„Zéd_e6dˆe%j&e6 d	eêfd,d-„Zëd.e%j&e6 d!e%j&eì d—e%j&e„j… d/e%j&e%j'eí  dÛe¬j¯d	e6fd0d1„Zîd	e$fd2d3„Zïd!e6d	eðfd4d5„Zñd	e$fd6d7„Zòd_e6d	e%j'e„j… fd8d9„Zód_e6d	e%j'e„j… fd:d;„Zôd<d=„ Zõd>e%j'e„j… dÙe¬j­fd?d@„ZödAe÷jødÙe¬j­dBe%j'e÷jù d	e6fdCdD„ZúdS (G  ÚBackendz)
    OpenSSL API binding interfaces.
    Zopenssl>   s   aes-192-gcms   aes-192-ccms   aes-256-ccms   aes-256-gcms   aes-128-ccms   aes-128-gcmé   i  é   c                 C   sŒ   t  ¡ | _| jj| _| jj| _d| _|  ¡ | _	i | _
|  ¡  | j	r,| jjr,t dt¡ n|  ¡  | jjg| _| jjrD| j | jj¡ d S d S )NFz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r%   ZBindingÚ_bindingÚffiÚ_ffiÚlibÚ_libÚ_rsa_skip_check_keyÚ_is_fips_enabledÚ_fips_enabledÚ_cipher_registryÚ_register_default_ciphersÚ"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEÚwarningsÚwarnÚUserWarningÚactivate_osrandom_engineZEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendZEVP_PKEY_DHX©Úselfr]   r]   r^   Ú__init__¹   s"   



þÿzBackend.__init__Úreturnc                 C   s   d  |  ¡ | j¡S )Nz'<OpenSSLBackend(version: {}, FIPS: {})>)ÚformatÚopenssl_version_textri   rt   r]   r]   r^   Ú__repr__Í   s   
ÿzBackend.__repr__NÚokÚerrorsc                 C   s   t j| j||dS )N)r|   )r%   Z_openssl_assertrf   )ru   r{   r|   r]   r]   r^   Úopenssl_assertÒ   s   zBackend.openssl_assertc                 C   sH   | j jr| j  | jj¡}n
t| j ddd„ ƒƒ }|dkr | j  ¡  t|ƒS )NZ	FIPS_modec                   S   s   dS ©Nr   r]   r]   r]   r]   r^   Ú<lambda>ß   s    z*Backend._is_fips_enabled.<locals>.<lambda>r   )rf   ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrd   ÚNULLÚgetattrZERR_clear_errorÚbool)ru   Úmoder]   r]   r^   rh   Ù   s   ÿ
zBackend._is_fips_enabledc                 C   s$   | j  ¡  |  ¡ sJ ‚|  ¡ | _d S ©N)rb   Ú_enable_fipsrh   ri   rt   r]   r]   r^   r…   æ   s   
zBackend._enable_fipsc                 C   sn   | j jr3| j  ¡ }|| jjkr5| j  |¡ | j  | jj¡}|  |dk¡ | j  |¡}|  |dk¡ d S d S d S ©Nra   )	rf   rl   ZENGINE_get_default_RANDrd   r€   ZENGINE_unregister_RANDÚRAND_set_rand_methodr}   ÚENGINE_finish©ru   ÚeÚresr]   r]   r^   Úactivate_builtin_randomí   s   
özBackend.activate_builtin_randomc              
   c   s¶    | j  | j j¡}|  || jjk¡ | j  |¡}|  |dk¡ z |V  W | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ d S | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ w r†   )	rf   ZENGINE_by_idZCryptography_osrandom_engine_idr}   rd   r€   ZENGINE_initZENGINE_freerˆ   r‰   r]   r]   r^   Ú_get_osurandom_engineú   s   €üzBackend._get_osurandom_enginec                 C   sx   | j jr:|  ¡  |  ¡ }| j  |¡}|  |dk¡ W d   ƒ n1 s$w   Y  | j  | jj¡}|  |dk¡ d S d S r†   )	rf   rl   rŒ   r   ZENGINE_set_default_RANDr}   r‡   rd   r€   r‰   r]   r]   r^   rp     s   
ý÷z Backend.activate_osrandom_enginec              	   C   st   | j  dd¡}|  ¡ }| j |dt|ƒ|| j jd¡}|  |dk¡ W d   ƒ n1 s,w   Y  | j  |¡ 	d¡S )Núchar[]é@   s   get_implementationr   Úascii)
rd   Únewr   rf   ZENGINE_ctrl_cmdÚlenr€   r}   ÚstringÚdecode)ru   ÚbufrŠ   r‹   r]   r]   r^   Úosrandom_engine_implementation  s   
ÿüz&Backend.osrandom_engine_implementationc                 C   s   | j  | j | jj¡¡ d¡S )zÀ
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r   )rd   r“   rf   ZOpenSSL_versionÚOPENSSL_VERSIONr”   rt   r]   r]   r^   ry   #  s
   ÿþzBackend.openssl_version_textc                 C   s
   | j  ¡ S r„   )rf   ZOpenSSL_version_numrt   r]   r]   r^   Úopenssl_version_number.  ó   
zBackend.openssl_version_numberÚkeyÚ	algorithmc                 C   s   t | ||ƒS r„   r   )ru   rš   r›   r]   r]   r^   Úcreate_hmac_ctx1  ó   zBackend.create_hmac_ctxc                 C   sL   |j dks
|j dkrd |j |jd ¡ d¡}n|j  d¡}| j |¡}|S )NÚblake2bÚblake2sz{}{}é   r   )Únamerx   Údigest_sizeÚencoderf   ZEVP_get_digestbyname)ru   r›   ÚalgÚevp_mdr]   r]   r^   Ú_evp_md_from_algorithm6  s   ÿþzBackend._evp_md_from_algorithmc                 C   s    |   |¡}|  || jjk¡ |S r„   )r¦   r}   rd   r€   ©ru   r›   r¥   r]   r]   r^   Ú_evp_md_non_null_from_algorithmA  s   
z'Backend._evp_md_non_null_from_algorithmc                 C   s,   | j rt|| jƒsdS |  |¡}|| jjkS ©NF)ri   Ú
isinstanceÚ_fips_hashesr¦   rd   r€   r§   r]   r]   r^   Úhash_supportedF  s   
zBackend.hash_supportedc                 C   ó    | j rt|tjƒrdS |  |¡S r©   ©ri   rª   r&   ÚSHA1r¬   ©ru   r›   r]   r]   r^   Úsignature_hash_supportedM  s   
z Backend.signature_hash_supportedc                 C   ó   | j rdS | jjdkS ©NFra   )ri   rf   ZCryptography_HAS_SCRYPTrt   r]   r]   r^   Úscrypt_supportedV  s   zBackend.scrypt_supportedc                 C   r­   )NTr®   r°   r]   r]   r^   Úhmac_supported\  s   
zBackend.hmac_supportedc                 C   ó
   t | |ƒS r„   r   r°   r]   r]   r^   Úcreate_hash_ctxc  s   
zBackend.create_hash_ctxÚcipherrƒ   c                 C   s^   | j rt|| jƒsdS z| jt|ƒt|ƒf }W n
 ty"   Y dS w || ||ƒ}| jj|kS r©   )ri   rª   Ú_fips_ciphersrj   ÚtypeÚKeyErrorrd   r€   )ru   r¸   rƒ   ÚadapterÚ
evp_cipherr]   r]   r^   Úcipher_supportedh  s   ÿzBackend.cipher_supportedc                 C   s0   ||f| j v rtd ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)rj   Ú
ValueErrorrx   )ru   Ú
cipher_clsÚmode_clsr¼   r]   r]   r^   Úregister_cipher_adapterv  s   ÿÿzBackend.register_cipher_adapterc                 C   sŒ  t ttfD ]}ttttttt	fD ]}|  
||tdƒ¡ qqtttttfD ]}|  
t|tdƒ¡ q$ttttfD ]}|  
t|tdƒ¡ q6|  
tttdƒ¡ ttttfD ]}|  
t|tdƒ¡ qQttttfD ]}|  
t|tdƒ¡ qct ttgttttg¡D ]\}}|  
||tdƒ¡ q{|  
ttd ƒtdƒ¡ |  
ttd ƒtdƒ¡ |  
ttd ƒtd	ƒ¡ |  
t tt¡ tttttfD ]}|  
t|td
ƒ¡ q¸d S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20zsm4-{mode.name})r:   r;   r<   rF   rI   rJ   rM   rG   rH   rK   rÂ   ÚGetCipherByNamer>   rA   rB   rE   Ú	itertoolsÚproductrC   rD   r=   rº   rY   r?   rN   Ú_get_xts_cipherr@   )ru   rÀ   rÁ   r]   r]   r^   rk     sf   ÿýÿý
ÿ
ÿ
ÿ
ÿ
þýÿ
ÿÿz!Backend._register_default_ciphersc                 C   ó   t | ||t jƒS r„   )r   Z_ENCRYPT©ru   r¸   rƒ   r]   r]   r^   Úcreate_symmetric_encryption_ctx³  ó   z'Backend.create_symmetric_encryption_ctxc                 C   rÇ   r„   )r   Z_DECRYPTrÈ   r]   r]   r^   Úcreate_symmetric_decryption_ctx¸  rÊ   z'Backend.create_symmetric_decryption_ctxc                 C   s
   |   |¡S r„   )rµ   r°   r]   r]   r^   Úpbkdf2_hmac_supported½  r™   zBackend.pbkdf2_hmac_supportedÚlengthÚsaltÚ
iterationsÚkey_materialc           
   
   C   sh   | j  d|¡}|  |¡}| j  |¡}| j |t|ƒ|t|ƒ||||¡}	|  |	dk¡ | j  |¡d d … S )Núunsigned char[]ra   )	rd   r‘   r¨   Úfrom_bufferrf   ZPKCS5_PBKDF2_HMACr’   r}   Úbuffer)
ru   r›   rÍ   rÎ   rÏ   rÐ   r•   r¥   Úkey_material_ptrr‹   r]   r]   r^   Úderive_pbkdf2_hmacÀ  s   
ø
zBackend.derive_pbkdf2_hmacc                 C   ó   t  | j¡S r„   )r%   Ú_consume_errorsrf   rt   r]   r]   r^   r×   Ø  ó   zBackend._consume_errorsc                 C   rÖ   r„   )r%   Ú_consume_errors_with_textrf   rt   r]   r]   r^   rÙ   Û  r   z!Backend._consume_errors_with_textc                 C   sz   || j jksJ ‚|  | j |¡ ¡ | j |¡}| j  d|¡}| j ||¡}|  |dk¡ t 	| j  
|¡d |… d¡}|S )NrÑ   r   Úbig)rd   r€   r}   rf   ZBN_is_negativeZBN_num_bytesr‘   Z	BN_bn2binÚintÚ
from_bytesrÓ   )ru   ÚbnZbn_num_bytesZbin_ptrZbin_lenÚvalr]   r]   r^   Ú
_bn_to_intà  s   zBackend._bn_to_intÚnumc                 C   sn   |du s|| j jksJ ‚|du r| j j}| t| ¡ d d ƒd¡}| j |t|ƒ|¡}|  || j jk¡ |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @ra   rÚ   )	rd   r€   Úto_bytesrÛ   Ú
bit_lengthrf   Z	BN_bin2bnr’   r}   )ru   rà   rÝ   ÚbinaryZbn_ptrr]   r]   r^   Ú
_int_to_bnì  s   zBackend._int_to_bnÚpublic_exponentÚkey_sizec                 C   s”   t  ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||| jƒS r†   )r.   Z_verify_rsa_parametersrf   ÚRSA_newr}   rd   r€   ÚgcÚRSA_freerä   ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyr   rg   )ru   rå   ræ   Ú	rsa_cdatarÝ   r‹   Úevp_pkeyr]   r]   r^   Úgenerate_rsa_private_keyý  s   

ÿ

ÿz Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )Né   ra   r   i   r]   )ru   rå   ræ   r]   r]   r^   Ú!generate_rsa_parameters_supported  s
   
ÿýz)Backend.generate_rsa_parameters_supportedÚnumbersc              
   C   s6  t  |j|j|j|j|j|j|jj	|jj
¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |jj	¡}	|  |jj
¡}
| j |||¡}|  |dk¡ | j ||
|	|¡}|  |dk¡ | j ||||¡}|  |dk¡ |  |¡}t| ||| jƒS r†   )r.   Z_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersrŠ   Únrf   rç   r}   rd   r€   rè   ré   rä   ZRSA_set0_factorsÚRSA_set0_keyZRSA_set0_crt_paramsrë   r   rg   )ru   rñ   rì   rò   ró   rô   rõ   rö   r÷   rŠ   rù   r‹   rí   r]   r]   r^   Úload_rsa_private_numbers  s>   ø



ÿz Backend.load_rsa_private_numbersc                 C   s   t  |j|j¡ | j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS r†   )r.   Z_check_public_key_componentsrŠ   rù   rf   rç   r}   rd   r€   rè   ré   rä   rú   rë   r    )ru   rñ   rì   rŠ   rù   r‹   rí   r]   r]   r^   Úload_rsa_public_numbers@  s   

zBackend.load_rsa_public_numbersc                 C   s2   | j  ¡ }|  || jjk¡ | j || j j¡}|S r„   )rf   ZEVP_PKEY_newr}   rd   r€   rè   ÚEVP_PKEY_free©ru   rí   r]   r]   r^   Ú_create_evp_pkey_gcO  s   
zBackend._create_evp_pkey_gcc                 C   ó(   |   ¡ }| j ||¡}|  |dk¡ |S r†   )rÿ   rf   ZEVP_PKEY_set1_RSAr}   )ru   rì   rí   r‹   r]   r]   r^   rë   U  ó   zBackend._rsa_cdata_to_evp_pkeyÚdatac                 C   sH   | j  |¡}| j |t|ƒ¡}|  || j jk¡ t| j  || jj	¡|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rd   rÒ   rf   ZBIO_new_mem_bufr’   r}   r€   rW   rè   ÚBIO_free)ru   r  Údata_ptrrX   r]   r]   r^   Ú_bytes_to_bio[  s   zBackend._bytes_to_bioc                 C   sP   | j  ¡ }|  || jjk¡ | j  |¡}|  || jjk¡ | j || j j¡}|S )z.
        Creates an empty memory BIO.
        )rf   Z	BIO_s_memr}   rd   r€   ZBIO_newrè   r  )ru   Z
bio_methodrX   r]   r]   r^   Ú_create_mem_bio_gch  s   
zBackend._create_mem_bio_gcc                 C   s\   | j  d¡}| j ||¡}|  |dk¡ |  |d | j jk¡ | j  |d |¡dd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rd   r‘   rf   ZBIO_get_mem_datar}   r€   rÓ   )ru   rX   r•   Úbuf_lenÚbio_datar]   r]   r^   Ú_read_mem_bios  s   zBackend._read_mem_bioc           	      C   s6  | j  |¡}|| j jkr,| j  |¡}|  || jjk¡ | j || j j¡}t	| ||| j
ƒS || j jkrr| j jsr| j jsr| j jsr| j  |¡}|  || jjk¡ | j || j j¡}|  ¡ }| j  ||¡}|  |dk¡ | j|  |¡ddS || j jkr–| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrº| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jv rÝ| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrët | |ƒS |t| j ddƒkrùt!| |ƒS |t| j ddƒkrt"| |ƒS |t| j ddƒkrt#| |ƒS t$dƒ‚)	zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ra   N)ÚpasswordÚEVP_PKEY_ED25519ÚEVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.)%rf   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAr}   rd   r€   rè   ré   r   rg   ÚEVP_PKEY_RSA_PSSÚCRYPTOGRAPHY_IS_LIBRESSLÚCRYPTOGRAPHY_IS_BORINGSSLÚ#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Er  Úi2d_RSAPrivateKey_bioÚload_der_private_keyr	  ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer   rq   ÚEVP_PKEY_get1_DHÚDH_freer   r   r   r#   r!   r   r   )	ru   rí   Úkey_typerì   rX   r‹   Ú	dsa_cdataÚec_cdataÚdh_cdatar]   r]   r^   Ú_evp_pkey_to_private_key~  sb   
ÿ
ÿþýü

ÿ




z Backend._evp_pkey_to_private_keyc           
      C   s:  | j  |¡}|| j jkr*| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krn| j jsn| j jsn| j jsn| j  |¡}|  || jjk¡ | j || j j¡}|  ¡ }| j  ||¡}|  |dk¡ |  |  |¡¡S || j jkr’| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkr¼| j  |¡}|| jjkr­|  ¡ }td|ƒ‚| j || j j¡}t| ||ƒS || jv rß| j  |¡}	|  |	| jjk¡ | j |	| j j¡}	t| |	|ƒS |t | j ddƒkrít!| |ƒS |t | j ddƒkrût"| |ƒS |t | j ddƒkr
t#| |ƒS |t | j ddƒkrt$| |ƒS t%dƒ‚)	zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        ra   zUnable to load EC keyr  Nr  r  r  r  )&rf   r  r  r  r}   rd   r€   rè   ré   r    r  r  r  r  r  Úi2d_RSAPublicKey_bioÚload_der_public_keyr	  r  r  r  r   r  r  rÙ   r¿   r  r   rq   r  r   r   r   r   r$   r"   r   r   )
ru   rí   r!  rì   rX   r‹   r"  r#  r|   r$  r]   r]   r^   Ú_evp_pkey_to_public_key¾  s^   
ÿþýü





zBackend._evp_pkey_to_public_keyc                 C   s   t |tjtjtjtjtjfƒS r„   )rª   r&   r¯   ÚSHA224ÚSHA256ÚSHA384ÚSHA512r°   r]   r]   r^   Ú_oaep_hash_supportedø  s   ûþzBackend._oaep_hash_supportedÚpaddingc                 C   s€   t |tƒrdS t |tƒr&t |jtƒr&| jrt |jjtjƒrdS |  	|jj¡S t |t
ƒr>t |jtƒr>|  |jj¡o=|  |j¡S dS )NTF)rª   r3   r4   Z_mgfr1   ri   Ú
_algorithmr&   r¯   r¬   r2   r-  )ru   r.  r]   r]   r^   Úrsa_padding_supported  s   

ÿÿ
þzBackend.rsa_padding_supportedc              	   C   s~   |dvrt dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}|  |dk¡ t	| |ƒS )N)i   r`   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   ra   )
r¿   rf   ÚDSA_newr}   rd   r€   rè   r  ZDSA_generate_parameters_exr   )ru   ræ   Úctxr‹   r]   r]   r^   Úgenerate_dsa_parameters  s$   ÿ
ù

zBackend.generate_dsa_parametersÚ
parametersc                 C   sT   | j  |j¡}|  || jjk¡ | j || j j¡}| j  |¡ |  	|¡}t
| ||ƒS r„   )rf   ZDSAparams_dupZ
_dsa_cdatar}   rd   r€   rè   r  ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr   )ru   r4  r2  rí   r]   r]   r^   Úgenerate_dsa_private_key/  s   ÿ
z Backend.generate_dsa_private_keyc                 C   ó   |   |¡}|  |¡S r„   )r3  r6  )ru   ræ   r4  r]   r]   r^   Ú'generate_dsa_private_key_and_parameters<  s   

z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j  ||||¡}|  |dk¡ | j  |||¡}|  |dk¡ d S r†   )rf   ÚDSA_set0_pqgr}   ZDSA_set0_key)ru   r"  rò   ró   ÚgÚpub_keyÚpriv_keyr‹   r]   r]   r^   Ú_dsa_cdata_set_valuesB  s   zBackend._dsa_cdata_set_valuesc           
      C   s¨   t  |¡ |jj}| j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}|  |j¡}|  |jj¡}|  |j¡}|  ||||||¡ |  |¡}	t| ||	ƒS r„   )r*   Z_check_dsa_private_numbersrø   Úparameter_numbersrf   r1  r}   rd   r€   rè   r  rä   rò   ró   r:  ÚyÚxr=  r5  r   )
ru   rñ   r>  r"  rò   ró   r:  r;  r<  rí   r]   r]   r^   Úload_dsa_private_numbersH  s   


z Backend.load_dsa_private_numbersc           	      C   s¢   t  |j¡ | j ¡ }|  || jjk¡ | j || jj	¡}|  
|jj¡}|  
|jj¡}|  
|jj¡}|  
|j¡}| jj}|  ||||||¡ |  |¡}t| ||ƒS r„   )r*   Ú_check_dsa_parametersr>  rf   r1  r}   rd   r€   rè   r  rä   rò   ró   r:  r?  r=  r5  r   )	ru   rñ   r"  rò   ró   r:  r;  r<  rí   r]   r]   r^   Úload_dsa_public_numbers]  s   

zBackend.load_dsa_public_numbersc                 C   s†   t  |¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|  	|j¡}| j ||||¡}|  |dk¡ t| |ƒS r†   )r*   rB  rf   r1  r}   rd   r€   rè   r  rä   rò   ró   r:  r9  r   )ru   rñ   r"  rò   ró   r:  r‹   r]   r]   r^   Úload_dsa_parameter_numbersp  s   


z"Backend.load_dsa_parameter_numbersc                 C   r   r†   )rÿ   rf   ZEVP_PKEY_set1_DSAr}   )ru   r"  rí   r‹   r]   r]   r^   r5  €  r  zBackend._dsa_cdata_to_evp_pkeyc                 C   s   | j  S r„   )ri   rt   r]   r]   r^   Údsa_supported†  s   zBackend.dsa_supportedc                 C   s   |   ¡ sdS |  |¡S r©   )rE  r±   r°   r]   r]   r^   Údsa_hash_supported‰  s   
zBackend.dsa_hash_supportedc                 C   s   |   |td|j ƒ¡S )Nó    )r¾   rF   Ú
block_sizer°   r]   r]   r^   Úcmac_algorithm_supportedŽ  s   ÿz Backend.cmac_algorithm_supportedc                 C   r¶   r„   r	   r°   r]   r]   r^   Úcreate_cmac_ctx“  r™   zBackend.create_cmac_ctxr
  c                 C   s   |   | jj| j||¡S r„   )Ú	_load_keyrf   ZPEM_read_bio_PrivateKeyr%  )ru   r  r
  r]   r]   r^   Úload_pem_private_key–  s   üzBackend.load_pem_private_keyc                 C   sî   |   |¡}| j d¡}| j |j| jj| j | jjd¡|¡}|| jjkr2| j 	|| jj
¡}|  |¡S |  ¡  | j |j¡}|  |dk¡ | j |j| jj| j | jjd¡|¡}|| jjkrq| j 	|| jj¡}|  |¡}t| ||ƒS |  ¡  d S )NúCRYPTOGRAPHY_PASSWORD_DATA *ÚCryptography_pem_password_cbra   )r  rd   r‘   rf   ZPEM_read_bio_PUBKEYrX   r€   Ú	addressofÚ_original_librè   rý   r(  r×   Ú	BIO_resetr}   ZPEM_read_bio_RSAPublicKeyré   rë   r    Ú_handle_key_loading_error)ru   r  Úmem_bioÚuserdatarí   r‹   rì   r]   r]   r^   Úload_pem_public_key   s:   
ÿú
ÿú
zBackend.load_pem_public_keyc                 C   s^   |   |¡}| j |j| jj| jj| jj¡}|| jjkr)| j || jj¡}t| |ƒS |  	¡  d S r„   )
r  rf   ZPEM_read_bio_DHparamsrX   rd   r€   rè   r   r   rR  )ru   r  rS  r$  r]   r]   r^   Úload_pem_parametersÊ  s   
ÿ
zBackend.load_pem_parametersc                 C   s:   |   |¡}|  ||¡}|r|  |¡S |  | jj| j||¡S r„   )r  Ú"_evp_pkey_from_der_traditional_keyr%  rK  rf   Zd2i_PKCS8PrivateKey_bio)ru   r  r
  r  rš   r]   r]   r^   r  Ö  s   

üzBackend.load_der_private_keyc                 C   sZ   | j  |j| jj¡}|| jjkr'|  ¡  | j || j j¡}|d ur%tdƒ‚|S |  ¡  d S )Nú4Password was given but private key is not encrypted.)	rf   Úd2i_PrivateKey_biorX   rd   r€   r×   rè   rý   Ú	TypeError)ru   r  r
  rš   r]   r]   r^   rW  ë  s   ÿz*Backend._evp_pkey_from_der_traditional_keyc                 C   s¾   |   |¡}| j |j| jj¡}|| jjkr#| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj¡}|| jjkrY| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S r†   )r  rf   Zd2i_PUBKEY_biorX   rd   r€   rè   rý   r(  r×   rQ  r}   Zd2i_RSAPublicKey_bioré   rë   r    rR  )ru   r  rS  rí   r‹   rì   r]   r]   r^   r'  þ  s    


ÿ
zBackend.load_der_public_keyc                 C   sº   |   |¡}| j |j| jj¡}|| jjkr#| j || jj¡}t| |ƒS | jj	rW|  
¡  | j |j¡}|  |dk¡ | j |j| jj¡}|| jjkrW| j || jj¡}t| |ƒS |  ¡  d S r†   )r  rf   Zd2i_DHparams_biorX   rd   r€   rè   r   r   rr   r×   rQ  r}   ZCryptography_d2i_DHxparams_biorR  )ru   r  rS  r$  r‹   r]   r]   r^   Úload_der_parameters  s    


ÿ
zBackend.load_der_parametersÚcertc                 C   óT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S r„   )Úpublic_bytesr'   ÚEncodingÚDERr  rf   Zd2i_X509_biorX   rd   r€   r}   rè   Ú	X509_free)ru   r\  r  rS  r   r]   r]   r^   Ú
_cert2ossl)  ó   
zBackend._cert2osslr   c                 C   ó4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S r†   )r  rf   Zi2d_X509_bior}   Ú	rust_x509Zload_der_x509_certificater	  )ru   r   rX   r‹   r]   r]   r^   Ú
_ossl2cert1  s   zBackend._ossl2certÚcsrc                 C   r]  r„   )r^  r'   r_  r`  r  rf   Zd2i_X509_REQ_biorX   rd   r€   r}   rè   ZX509_REQ_free)ru   rg  r  rS  Úx509_reqr]   r]   r^   Ú	_csr2ossl7  rc  zBackend._csr2osslrh  c                 C   rd  r†   )r  rf   Zi2d_X509_REQ_bior}   re  Zload_der_x509_csrr	  )ru   rh  rX   r‹   r]   r]   r^   Ú	_ossl2csr?  ó   zBackend._ossl2csrÚcrlc                 C   r]  r„   )r^  r'   r_  r`  r  rf   Zd2i_X509_CRL_biorX   rd   r€   r}   rè   ZX509_CRL_free)ru   rl  r  rS  Úx509_crlr]   r]   r^   Ú	_crl2osslG  rc  zBackend._crl2osslrm  c                 C   rd  r†   )r  rf   Zi2d_X509_CRL_bior}   re  Zload_der_x509_crlr	  )ru   rm  rX   r‹   r]   r]   r^   Ú	_ossl2crlO  rk  zBackend._ossl2crlÚ
public_keyc                 C   sJ   t |tttfƒstdƒ‚|  |¡}| j ||j¡}|dkr#|  	¡  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.ra   FT)
rª   r   r    r   rZ  rn  rf   ZX509_CRL_verifyÚ	_evp_pkeyr×   )ru   rl  rp  rm  r‹   r]   r]   r^   Ú_crl_is_signature_validW  s    ýþÿ
zBackend._crl_is_signature_validc                 C   s`   |   |¡}| j |¡}|  || jjk¡ | j || jj¡}| j ||¡}|dkr.|  	¡  dS dS )Nra   FT)
ri  rf   ZX509_REQ_get_pubkeyr}   rd   r€   rè   rý   ZX509_REQ_verifyr×   )ru   rg  rh  Úpkeyr‹   r]   r]   r^   Ú_csr_is_signature_validq  s   
zBackend._csr_is_signature_validc                 C   s"   | j  |j|j¡dkrtdƒ‚d S )Nra   zKeys do not correspond)rf   ZEVP_PKEY_cmprq  r¿   )ru   Úkey1Úkey2r]   r]   r^   Ú_check_keys_correspond€  s   ÿzBackend._check_keys_correspondc           	      C   s  |   |¡}| j d¡}|d ur#t d|¡ | j |¡}||_t|ƒ|_||j	| jj
| j | jjd¡|ƒ}|| jj
kra|jdkr]|  ¡  |jdkrLtdƒ‚|jdksSJ ‚td |jd	 ¡ƒ‚|  ¡  |  ¡  | j || jj¡}|d ur{|jdkr{td
ƒ‚|d ur„|jd	ksŠ|d u sŠJ ‚||ƒS )NrM  r
  rN  r   éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.ra   rX  )r  rd   r‘   r   Ú_check_byteslikerÒ   r
  r’   rÍ   rX   r€   rO  rf   rP  Úerrorr×   rZ  r¿   rx   ÚmaxsizerR  rè   rý   Úcalled)	ru   Zopenssl_read_funcZconvert_funcr  r
  rS  rT  Zpassword_ptrrí   r]   r]   r^   rK  „  sR   

ÿú	

ÿþÿÿÿþzBackend._load_keyc                    sž   ˆ   ¡ }|s
tdƒ‚|d  ˆ jjˆ jj¡s2|d  ˆ jjˆ jj¡s2ˆ jjr6|d  ˆ jj	ˆ jj
¡r6tdƒ‚t‡ fdd„|D ƒƒrEtdƒ‚t |¡}td|ƒ‚)Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3   s$    | ]}|  ˆ jjˆ jj¡V  qd S r„   )Ú_lib_reason_matchrf   ÚERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)Ú.0r{  rt   r]   r^   Ú	<genexpr>Õ  s   € üþ
ÿz4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.zÊCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r×   r¿   r~  rf   r  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZERR_LIB_PROVZPROV_R_BAD_DECRYPTÚanyr%   Z_errors_with_text)ru   r|   Zerrors_with_textr]   rt   r^   rR  ¹  s>   ÿÿÿþü	÷
þöû
ûz!Backend._handle_key_loading_errorÚcurvec                 C   sp   z|   |¡}W n ty   | jj}Y nw | j |¡}|| jjkr'|  ¡  dS |  || jjk¡ | j 	|¡ dS )NFT)
Ú_elliptic_curve_to_nidr   rf   Ú	NID_undefZEC_GROUP_new_by_curve_namerd   r€   r×   r}   ZEC_GROUP_free)ru   rƒ  Ú	curve_nidÚgroupr]   r]   r^   Úelliptic_curve_supportedè  s   ÿz Backend.elliptic_curve_supportedÚsignature_algorithmc                 C   s   t |tjƒsdS |  |¡S r©   )rª   r+   ZECDSArˆ  )ru   r‰  rƒ  r]   r]   r^   Ú,elliptic_curve_signature_algorithm_supportedø  s   
z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   sX   |   |¡r"|  |¡}| j |¡}|  |dk¡ |  |¡}t| ||ƒS td |j	¡t
jƒ‚)z@
        Generate a new private key on the named curve.
        ra   z#Backend object does not support {}.)rˆ  Ú_ec_key_new_by_curverf   ZEC_KEY_generate_keyr}   Ú_ec_cdata_to_evp_pkeyr   r   rx   r¡   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)ru   rƒ  r#  r‹   rí   r]   r]   r^   Ú#generate_elliptic_curve_private_key  s   



þz+Backend.generate_elliptic_curve_private_keyc                 C   sz   |j }|  |j¡}| j |  |j¡| jj¡}| j 	||¡}|dkr)|  
¡  tdƒ‚|  ||j|j¡ |  |¡}t| ||ƒS )Nra   úInvalid EC key.)rø   r‹  rƒ  rd   rè   rä   Úprivate_valuerf   ÚBN_clear_freeÚEC_KEY_set_private_keyr×   r¿   Ú)_ec_key_set_public_key_affine_coordinatesr@  r?  rŒ  r   )ru   rñ   Úpublicr#  r  r‹   rí   r]   r]   r^   Ú#load_elliptic_curve_private_numbers  s   ÿ
ÿ
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |   |j¡}|  ||j|j¡ |  |¡}t| ||ƒS r„   )r‹  rƒ  r“  r@  r?  rŒ  r   )ru   rñ   r#  rí   r]   r]   r^   Ú"load_elliptic_curve_public_numbers0  s   
ÿ
z*Backend.load_elliptic_curve_public_numbersÚpoint_bytesc           	      C   sâ   |   |¡}| j |¡}|  || jjk¡ | j |¡}|  || jjk¡ | j || jj¡}|  	¡  }| j 
|||t|ƒ|¡}|dkrI|  ¡  tdƒ‚W d   ƒ n1 sSw   Y  | j ||¡}|  |dk¡ |  |¡}t| ||ƒS )Nra   z(Invalid public bytes for the given curve)r‹  rf   ÚEC_KEY_get0_groupr}   rd   r€   ÚEC_POINT_newrè   ÚEC_POINT_freeÚ_tmp_bn_ctxZEC_POINT_oct2pointr’   r×   r¿   ÚEC_KEY_set_public_keyrŒ  r   )	ru   rƒ  r—  r#  r‡  ÚpointÚbn_ctxr‹   rí   r]   r]   r^   Ú load_elliptic_curve_public_bytes;  s&   

ÿþü
z(Backend.load_elliptic_curve_public_bytesr  c              	   C   sb  |   |¡}|  |¡\}}| j |¡}|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}|  ¡ >}| j |||| jj| jj|¡}	|  |	dk¡ | j |¡}
| j |¡}||||
||ƒ}	|	dkrm|  ¡  tdƒ‚W d   ƒ n1 sww   Y  | j ||¡}	|  |	dk¡ |  	|¡}| j || jj
¡}| j ||¡}	|  |	dk¡ |  |¡}t| ||ƒS )Nra   z'Unable to derive key from private_value)r‹  Ú _ec_key_determine_group_get_funcrf   r™  r}   rd   r€   rè   rš  rä   r‘  r›  ZEC_POINT_mulZ
BN_CTX_getr×   r¿   rœ  r’  rŒ  r   )ru   r  rƒ  r#  Úget_funcr‡  r  Úvaluerž  r‹   Zbn_xZbn_yÚprivaterí   r]   r]   r^   Ú!derive_elliptic_curve_private_keyQ  s8   


ÿþö

z)Backend.derive_elliptic_curve_private_keyc                 C   r7  r„   )r„  Ú_ec_key_new_by_curve_nid)ru   rƒ  r†  r]   r]   r^   r‹  x  s   

zBackend._ec_key_new_by_curver†  c                 C   s0   | j  |¡}|  || jjk¡ | j || j j¡S r„   )rf   ZEC_KEY_new_by_curve_namer}   rd   r€   rè   r  )ru   r†  r#  r]   r]   r^   r¥  |  s   z Backend._ec_key_new_by_curve_nidc                 C   s,   | j rt|| jƒsdS |  |¡ot|tjƒS r©   )ri   rª   Ú_fips_ecdh_curvesrˆ  r+   ÚECDH)ru   r›   rƒ  r]   r]   r^   Ú+elliptic_curve_exchange_algorithm_supported  s   ÿÿz3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   r   r†   )rÿ   rf   ZEVP_PKEY_set1_EC_KEYr}   )ru   r#  rí   r‹   r]   r]   r^   rŒ    r  zBackend._ec_cdata_to_evp_pkeyc                 C   sN   dddœ}|  |j|j¡}| j | ¡ ¡}|| jjkr%td |j¡tj	ƒ‚|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z${} is not a supported elliptic curve)
Úgetr¡   rf   Ú
OBJ_sn2nidr£   r…  r   rx   r   r  )ru   rƒ  Zcurve_aliasesZ
curve_namer†  r]   r]   r^   r„  “  s   

þzBackend._elliptic_curve_to_nidc              	   c   sd    | j  ¡ }|  || jjk¡ | j || j j¡}| j  |¡ z|V  W | j  |¡ d S | j  |¡ w r„   )	rf   Z
BN_CTX_newr}   rd   r€   rè   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)ru   rž  r]   r]   r^   r›  ¤  s   €
zBackend._tmp_bn_ctxc                 C   s¼   |   || jjk¡ | j d¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ ||krR| jj	rR| jj
}n| jj}|sZJ ‚||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r}   rd   r€   rf   rª  r…  r˜  ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFp)ru   r2  Znid_two_fieldr‡  ÚmethodÚnidr¡  r]   r]   r^   r   ¯  s   
z(Backend._ec_key_determine_group_get_funcr@  r?  c                 C   st   |dk s|dk rt dƒ‚| j |  |¡| jj¡}| j |  |¡| jj¡}| j |||¡}|dkr8|  ¡  t dƒ‚dS )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.ra   r  N)r¿   rd   rè   rä   rf   rê   Z(EC_KEY_set_public_key_affine_coordinatesr×   )ru   r2  r@  r?  r‹   r]   r]   r^   r“  Ë  s   ÿþz1Backend._ec_key_set_public_key_affine_coordinatesÚencodingrx   Úencryption_algorithmc           
      C   sN  t |tjƒs
tdƒ‚t |tjƒstdƒ‚t |tjƒstdƒ‚t |tjƒr'd}n4t |tjƒr;|j}t	|ƒdkr:t
dƒ‚n t |tjƒrW|j|  u rNtjju rWn t
dƒ‚|j}nt
dƒ‚|tjju r‚|tjju rl| jj}n|tjju rw| jj}nt
dƒ‚|  |||¡S |tjju r
| jr–t |tjƒs–t
d	ƒ‚| j |¡}	|tjju rÎ|	| jjkr­| jj}n|	| jjkr¸| jj}n|	| jjkrÃ| jj}nt
d
ƒ‚|  |||¡S |tjju r|rÛt
dƒ‚|	| jjkræ| jj}n|	| jjkrñ| jj}n|	| jjkrü| jj }nt
d
ƒ‚|  !||¡S t
dƒ‚|tjju r#|tjju rt" #|||¡S t
dƒ‚t
dƒ‚)Nú/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instanceó    iÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingúformat is invalid with this key)$rª   r'   r_  rZ  ÚPrivateFormatÚKeySerializationEncryptionÚNoEncryptionÚBestAvailableEncryptionr
  r’   r¿   Ú_KeySerializationEncryptionÚ_formatÚOpenSSHZPKCS8ÚPEMrf   ZPEM_write_bio_PKCS8PrivateKeyr`  Zi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioZTraditionalOpenSSLri   r  r  ZPEM_write_bio_RSAPrivateKeyr  ZPEM_write_bio_DSAPrivateKeyr  ZPEM_write_bio_ECPrivateKeyr  Zi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bioÚ_bio_func_outputrQ   Z_serialize_ssh_private_key)
ru   r­  rx   r®  rš   rí   Úcdatar
  Ú	write_bior!  r]   r]   r^   Ú_private_key_bytesÝ  s´   
ÿÿÿÿÿÿÿÿûú
þ

ÿÿÿ


ÿÿÿ


ÿÿÿzBackend._private_key_bytesc              	   C   s<   |s| j j}n| j d¡}|  ||||t|ƒ| j j| j j¡S )Ns   aes-256-cbc)rd   r€   rf   ÚEVP_get_cipherbynamer»  r’   )ru   r½  rí   r
  r½   r]   r]   r^   rº  W  s   
ùz"Backend._private_key_bytes_via_bioc                 G   s0   |   ¡ }||g|¢R Ž }|  |dk¡ |  |¡S r†   )r  r}   r	  )ru   r½  ÚargsrX   r‹   r]   r]   r^   r»  h  s   
zBackend._bio_func_outputc                 C   s  t |tjƒs
tdƒ‚t |tjƒstdƒ‚|tjju r:|tjju r%| jj}n|tjj	u r0| jj
}ntdƒ‚|  ||¡S |tjju rp| j |¡}|| jjkrPtdƒ‚|tjju r[| jj}n|tjj	u rf| jj}ntdƒ‚|  ||¡S |tjju r…|tjju rt |¡S tdƒ‚tdƒ‚)Nr¯  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingr±  )rª   r'   r_  rZ  ÚPublicFormatZSubjectPublicKeyInfor¹  rf   ZPEM_write_bio_PUBKEYr`  Zi2d_PUBKEY_bior¿   r»  ZPKCS1r  r  ZPEM_write_bio_RSAPublicKeyr&  r¸  rQ   Zserialize_ssh_public_key)ru   r­  rx   rš   rí   r¼  r½  r!  r]   r]   r^   Ú_public_key_bytesn  s@   ÿ

ÿ


ÿzBackend._public_key_bytesc                 C   ó
   | j j S r„   ©rf   r  rt   r]   r]   r^   Údh_supported¥  r™   zBackend.dh_supportedÚ	generatorc                 C   s†   |t jk rtd t j¡ƒ‚|dvrtdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}| j |||| jj¡}|  |dk¡ t| |ƒS )Nz$DH key_size must be at least {} bits)é   é   zDH generator must be 2 or 5ra   )r)   Z_MIN_MODULUS_SIZEr¿   rx   rf   ÚDH_newr}   rd   r€   rè   r   ZDH_generate_parameters_exr   )ru   rÆ  ræ   Zdh_param_cdatar‹   r]   r]   r^   Úgenerate_dh_parameters¨  s    
ÿÿ
ÿ
zBackend.generate_dh_parametersc                 C   r   r†   )rÿ   rf   ZEVP_PKEY_set1_DHr}   )ru   r$  rí   r‹   r]   r]   r^   Ú_dh_cdata_to_evp_pkeyÀ  r  zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| ƒ}| j |¡}|  |dk¡ |  |¡}t| ||ƒS r†   )r   Z	_dh_cdatarf   ZDH_generate_keyr}   rË  r   )ru   r4  Zdh_key_cdatar‹   rí   r]   r]   r^   Úgenerate_dh_private_keyÆ  s   ÿ
zBackend.generate_dh_private_keyc                 C   s   |   |  ||¡¡S r„   )rÌ  rÊ  )ru   rÆ  ræ   r]   r]   r^   Ú&generate_dh_private_key_and_parametersÔ  s   
ÿz.Backend.generate_dh_private_key_and_parametersc                 C   s8  |j j}| j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|jd ur3|  	|j¡}n| jj}|  	|j j¡}|  	|j¡}| j ||||¡}	|  |	dk¡ | j |||¡}	|  |	dk¡ | j dd¡}
| j ||
¡}	|  |	dk¡ |
d dkr‘|jdkr|
d | jjA dks‘tdƒ‚|  |¡}t| ||ƒS )Nra   úint[]r   rÇ  z.DH private numbers did not pass safety checks.)rø   r>  rf   rÉ  r}   rd   r€   rè   r   rä   rò   r:  ró   r?  r@  ÚDH_set0_pqgÚDH_set0_keyr‘   ÚCryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr¿   rË  r   )ru   rñ   r>  r$  rò   r:  ró   r;  r<  r‹   Úcodesrí   r]   r]   r^   Úload_dh_private_numbersÛ  s4   


ÿþ
zBackend.load_dh_private_numbersc           
      C   sÐ   | j  ¡ }|  || jjk¡ | j || j j¡}|j}|  |j	¡}|  |j
¡}|jd ur2|  |j¡}n| jj}|  |j¡}| j  ||||¡}|  |dk¡ | j  ||| jj¡}|  |dk¡ |  |¡}	t| ||	ƒS r†   )rf   rÉ  r}   rd   r€   rè   r   r>  rä   rò   r:  ró   r?  rÏ  rÐ  rË  r   )
ru   rñ   r$  r>  rò   r:  ró   r;  r‹   rí   r]   r]   r^   Úload_dh_public_numbers  s    


zBackend.load_dh_public_numbersc                 C   s   | j  ¡ }|  || jjk¡ | j || j j¡}|  |j¡}|  |j	¡}|j
d ur/|  |j
¡}n| jj}| j  ||||¡}|  |dk¡ t| |ƒS r†   )rf   rÉ  r}   rd   r€   rè   r   rä   rò   r:  ró   rÏ  r   )ru   rñ   r$  rò   r:  ró   r‹   r]   r]   r^   Úload_dh_parameter_numbers(  s   


z!Backend.load_dh_parameter_numbersrò   r:  ró   c                 C   s´   | j  ¡ }|  || jjk¡ | j || j j¡}|  |¡}|  |¡}|d ur+|  |¡}n| jj}| j  ||||¡}|  |dk¡ | j 	dd¡}| j  
||¡}|  |dk¡ |d dkS )Nra   rÎ  r   )rf   rÉ  r}   rd   r€   rè   r   rä   rÏ  r‘   rÑ  )ru   rò   r:  ró   r$  r‹   rÒ  r]   r]   r^   Údh_parameters_supported<  s   


zBackend.dh_parameters_supportedc                 C   s   | j jdkS r†   )rf   rr   rt   r]   r]   r^   Údh_x942_serialization_supportedT  rØ   z'Backend.dh_x942_serialization_supportedc                 C   sh   t |ƒdkr
tdƒ‚|  ¡ }| j || jj¡}|  |dk¡ | j ||t |ƒ¡}|  |dk¡ t| |ƒS )Né    z%An X25519 public key is 32 bytes longra   )	r’   r¿   rÿ   rf   ZEVP_PKEY_set_typeÚ
NID_X25519r}   ZEVP_PKEY_set1_tls_encodedpointr"   )ru   r  rí   r‹   r]   r]   r^   Úx25519_load_public_bytesW  s   
ÿ
z Backend.x25519_load_public_bytesc                 C   sÀ   t |ƒdkr
tdƒ‚d}|  d¡#}||dd…< ||dd …< |  |¡}| j |j| jj¡}W d   ƒ n1 s7w   Y  |  	|| jjk¡ | j 
|| jj¡}|  	| j |¡| jjk¡ t| |ƒS )NrØ  z&An X25519 private key is 32 bytes longs   0. 0+en" é0   r   é   )r’   r¿   Ú_zeroed_bytearrayr  rf   rY  rX   rd   r€   r}   rè   rý   r  r  r!   )ru   r  Zpkcs8_prefixÚbarX   rí   r]   r]   r^   Úx25519_load_private_bytesf  s   
üÿ
z!Backend.x25519_load_private_bytesc                 C   s¨   | j  || jj¡}|  || jjk¡ | j || j j¡}| j  |¡}|  |dk¡ | j d¡}| j  	||¡}|  |dk¡ |  |d | jjk¡ | j |d | j j
¡}|S )Nra   úEVP_PKEY **r   )rf   ZEVP_PKEY_CTX_new_idrd   r€   r}   rè   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr‘   ZEVP_PKEY_keygenrý   )ru   r¬  Zevp_pkey_ctxr‹   Z	evp_ppkeyrí   r]   r]   r^   Ú_evp_pkey_keygen_gcŠ  s   zBackend._evp_pkey_keygen_gcc                 C   ó   |   | jj¡}t| |ƒS r„   )rá  rf   rÙ  r!   rþ   r]   r]   r^   Úx25519_generate_key—  ó   
zBackend.x25519_generate_keyc                 C   ó   | j rdS | jj S r©   )ri   rf   r  rt   r]   r]   r^   Úx25519_supported›  ó   
zBackend.x25519_supportedc                 C   s`   t |ƒdkr
tdƒ‚| j | jj| jj|t |ƒ¡}|  || jjk¡ | j || jj	¡}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)r’   r¿   rf   ÚEVP_PKEY_new_raw_public_keyÚNID_X448rd   r€   r}   rè   rý   r$   ©ru   r  rí   r]   r]   r^   Úx448_load_public_bytes   s   ÿ
zBackend.x448_load_public_bytesc                 C   sl   t |ƒdkr
tdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}|  || jjk¡ | j 	|| jj
¡}t| |ƒS )Nrè  z$An X448 private key is 56 bytes long)r’   r¿   rd   rÒ   rf   ÚEVP_PKEY_new_raw_private_keyrê  r€   r}   rè   rý   r#   ©ru   r  r  rí   r]   r]   r^   Úx448_load_private_bytes«  s   ÿ
zBackend.x448_load_private_bytesc                 C   râ  r„   )rá  rf   rê  r#   rþ   r]   r]   r^   Úx448_generate_key·  rä  zBackend.x448_generate_keyc                 C   ó   | j rdS | jj o| jj S r©   )ri   rf   Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r  rt   r]   r]   r^   Úx448_supported»  ó
   
þzBackend.x448_supportedc                 C   rå  r©   )ri   rf   Ú#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Brt   r]   r]   r^   Úed25519_supportedÃ  rç  zBackend.ed25519_supportedc                 C   sn   t  d|¡ t|ƒtjkrtdƒ‚| j | jj| j	j
|t|ƒ¡}|  || j	j
k¡ | j	 || jj¡}t| |ƒS )Nr  z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesr’   r,   Ú_ED25519_KEY_SIZEr¿   rf   ré  ÚNID_ED25519rd   r€   r}   rè   rý   r   rë  r]   r]   r^   Úed25519_load_public_bytesÈ  s   ÿ
z!Backend.ed25519_load_public_bytesc                 C   sz   t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j 	| jj
| jj|t |ƒ¡}|  || jjk¡ | j || jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longr  )r’   r,   r÷  r¿   r   rz  rd   rÒ   rf   rí  rø  r€   r}   rè   rý   r   rî  r]   r]   r^   Úed25519_load_private_bytesØ  s   ÿ
z"Backend.ed25519_load_private_bytesc                 C   râ  r„   )rá  rf   rø  r   rþ   r]   r]   r^   Úed25519_generate_keyè  rä  zBackend.ed25519_generate_keyc                 C   rñ  r©   )ri   rf   rô  r  rt   r]   r]   r^   Úed448_supportedì  ró  zBackend.ed448_supportedc                 C   sl   t  d|¡ t|ƒtkrtdƒ‚| j | jj| jj	|t|ƒ¡}|  
|| jj	k¡ | j || jj¡}t| |ƒS )Nr  z$An Ed448 public key is 57 bytes long)r   rö  r’   r   r¿   rf   ré  Ú	NID_ED448rd   r€   r}   rè   rý   r   rë  r]   r]   r^   Úed448_load_public_bytesô  s   ÿ
zBackend.ed448_load_public_bytesc                 C   sx   t  d|¡ t|ƒtkrtdƒ‚| j |¡}| j | jj	| jj
|t|ƒ¡}|  || jj
k¡ | j || jj¡}t| |ƒS )Nr  z%An Ed448 private key is 57 bytes long)r   rz  r’   r   r¿   rd   rÒ   rf   rí  rý  r€   r}   rè   rý   r   rî  r]   r]   r^   Úed448_load_private_bytes  s   ÿ
z Backend.ed448_load_private_bytesc                 C   râ  r„   )rá  rf   rý  r   rþ   r]   r]   r^   Úed448_generate_key  rä  zBackend.ed448_generate_keyrù   Úrc                 C   s†   | j  d|¡}| j  |¡}| j |t|ƒ|t|ƒ|||tj||¡
}	|	dkr9|  ¡ }
d| | d }t	d 
|¡|
ƒ‚| j  |¡d d … S )NrÑ   ra   é€   i   zJNot enough memory to derive key. These parameters require {} MB of memory.)rd   r‘   rÒ   rf   ZEVP_PBE_scryptr’   rO   Z
_MEM_LIMITrÙ   ÚMemoryErrorrx   rÓ   )ru   rÐ   rÎ   rÍ   rù   r  rò   r•   rÔ   r‹   r|   Z
min_memoryr]   r]   r^   Úderive_scrypt  s.   	öýzBackend.derive_scryptc                 C   sH   t  |¡}| jr|| jvrdS | d¡r| jjdkS | j |¡| jj	kS )NFs   -sivra   )
r   Z_aead_cipher_nameri   Ú
_fips_aeadÚendswithrf   Ú#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr¿  rd   r€   )ru   r¸   Úcipher_namer]   r]   r^   Úaead_cipher_supported6  s   

ÿzBackend.aead_cipher_supportedc              
   c   s2    t |ƒ}z|V  W |  ||¡ dS |  ||¡ w )zÁ
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)Ú	bytearrayÚ
_zero_data)ru   rÍ   rÞ  r]   r]   r^   rÝ  D  s
   €zBackend._zeroed_bytearrayc                 C   s   t |ƒD ]}d||< qd S r~   )Úrange)ru   r  rÍ   Úir]   r]   r^   r  Q  s   
ÿzBackend._zero_datac                 c   s~    |du r| j jV  dS t|ƒ}| j  d|d ¡}| j  |||¡ z|V  W |  | j  d|¡|¡ dS |  | j  d|¡|¡ w )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        NrŽ   ra   z	uint8_t *)rd   r€   r’   r‘   Úmemmover  Úcast)ru   r  Údata_lenr•   r]   r]   r^   Ú_zeroed_null_terminated_bufX  s   €2z#Backend._zeroed_null_terminated_bufc                 C   s2   |   ||¡}|j|jr|jjnd dd„ |jD ƒfS )Nc                 S   s   g | ]}|j ‘qS r]   )Úcertificate©r€  r\  r]   r]   r^   Ú
<listcomp>z  s    zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)Úload_pkcs12rš   r\  r  Zadditional_certs)ru   r  r
  Zpkcs12r]   r]   r^   Ú%load_key_and_certificates_from_pkcs12o  s
   ýz-Backend.load_key_and_certificates_from_pkcs12c                 C   s~  |d ur
t  d|¡ |  |¡}| j |j| jj¡}|| jjkr'|  ¡  t	dƒ‚| j 
|| jj¡}| j d¡}| j d¡}| j d¡}|  |¡}| j |||||¡}	W d   ƒ n1 s\w   Y  | jjri|  ¡  |	dkru|  ¡  t	dƒ‚d }
d }g }|d | jjkr“| j 
|d | jj¡}|  |¡}|d | jjkrÇ| j 
|d | jj¡}|  |¡}d }| j || jj¡}|| jjkrÂ| j |¡}t||ƒ}
|d | jjkr9| j 
|d | jj¡}| j |d ¡}| jjsë| jjrðt|ƒ}ntt|ƒƒ}|D ]@}| j ||¡}|  || jjk¡ | j 
|| jj¡}|  |¡}d }| j || jj¡}|| jjkr0| j |¡}| t||ƒ¡ qøt ||
|ƒS )Nr
  z!Could not deserialize PKCS12 datarà  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data)!r   rz  r  rf   Zd2i_PKCS12_biorX   rd   r€   r×   r¿   rè   ÚPKCS12_freer‘   r  ZPKCS12_parseZ#CRYPTOGRAPHY_LIBRESSL_LESS_THAN_340rý   r%  ra  rf  ZX509_alias_get0r“   rS   Úsk_X509_freeÚsk_X509_numr  r  r  ÚreversedÚsk_X509_valuer}   rs   rT   )ru   r  r
  rX   Úp12Zevp_pkey_ptrZx509_ptrZsk_x509_ptrÚpassword_bufr‹   r\  rš   Zadditional_certificatesrí   r   Zcert_objr¡   Z
maybe_nameÚsk_x509rà   Úindicesr  Z	addl_certZ	addl_namer]   r]   r^   r  }  sr   

ÿÿ


ÿþ

ÿzBackend.load_pkcs12r¡   Úcasc                 C   s‚  d }|d urt  d|¡ t|tjƒrd}d}d}	d}
| jj}nšt|tjƒrF| jj	r2| jj
}| jj
}n| jj}| jj}d}	d}
| jj}|j}nst|tjƒrµ|jtjju rµd}d}d}	d}
|j}|j}|tju ro| jj}| jj}n|tju r…| jj	s|tdƒ‚| jj
}| jj
}n|d u s‹J ‚|jd ur¨| jjs˜tdƒ‚|  |j¡}|  || jjk¡ n| jj}|jd ur´|j}	ntdƒ‚|d u sÃt|ƒdkrÈ| jj}nb| j ¡ }| j || jj¡}g }|D ]O}t|t ƒr|j!}|  "|j#¡}|  $|¡}| j %||d¡}|  |dk¡ W d   ƒ n	1 sw   Y  n|  "|¡}| &|¡ | j '||¡}t( |dk¡ qÚ|  $|¡`}|  $|¡0}|r>|  "|¡n| jj}|d urK|j)}n| jj}| j *||||||||	|
d¡
}W d   ƒ n	1 siw   Y  | jjrˆ|| jjkrˆ| j +||d| jjd|
|¡ W d   ƒ n	1 s“w   Y  |  || jjk¡ | j || jj,¡}|  -¡ }| j .||¡}|  |dk¡ |  /|¡S )	Nr¡   rx  r   i N  ra   z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption type)0r   rö  rª   r'   r´  rd   r€   rµ  rf   r  ZNID_aes_256_cbcZ&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr
  r¶  r·  r²  ZPKCS12Z_key_cert_algorithmrR   ZPBESv1SHA1And3KeyTripleDESCBCZPBESv2SHA256AndAES256CBCr   Z
_hmac_hashZCryptography_HAS_PKCS12_SET_MACr¨   r}   Z_kdf_roundsr¿   r’   Úsk_X509_new_nullrè   r  rS   Zfriendly_namerb  r  r  ZX509_alias_set1rs   Úsk_X509_pushÚbackendrq  ZPKCS12_createZPKCS12_set_macr  r  Zi2d_PKCS12_bior	  )ru   r¡   rš   r\  r   r®  r
  Znid_certZnid_keyZpkcs12_iterZmac_iterZmac_algZ
keycertalgr  Zossl_casÚcaZca_aliasZossl_caZca_name_bufr‹   r  Zname_bufÚ	ossl_certrí   r  rX   r]   r]   r^   Ú(serialize_key_and_certificates_to_pkcs12Ê  sö   
ÿ
ÿÿÿü	


ÿ

ÿÿ
€

ÿÿú€


öùÿ
þù€ç#
z0Backend.serialize_key_and_certificates_to_pkcs12c                 C   r²   r³   )ri   rf   ZCryptography_HAS_POLY1305rt   r]   r]   r^   Úpoly1305_supportedg	  s   zBackend.poly1305_supportedc                 C   s*   t  d|¡ t|ƒtkrtdƒ‚t| |ƒS )Nrš   zA poly1305 key is 32 bytes long)r   rz  r’   r   r¿   r   )ru   rš   r]   r]   r^   Úcreate_poly1305_ctxl	  s   
zBackend.create_poly1305_ctxc                 C   rÃ  r„   rÄ  rt   r]   r]   r^   Úpkcs7_supporteds	  r™   zBackend.pkcs7_supportedc                 C   sn   t  d|¡ |  |¡}| j |j| jj| jj| jj¡}|| jjkr)|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S ©Nr  zUnable to parse PKCS7 data)r   rö  r  rf   ZPEM_read_bio_PKCS7rX   rd   r€   r×   r¿   rè   Ú
PKCS7_freeÚ_load_pkcs7_certificates©ru   r  rX   Úp7r]   r]   r^   Úload_pem_pkcs7_certificatesv	  s   
ÿ
z#Backend.load_pem_pkcs7_certificatesc                 C   sb   t  d|¡ |  |¡}| j |j| jj¡}|| jjkr#|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S r*  )r   rö  r  rf   Zd2i_PKCS7_biorX   rd   r€   r×   r¿   rè   r+  r,  r-  r]   r]   r^   Úload_der_pkcs7_certificates…	  s   

z#Backend.load_der_pkcs7_certificatesc           
      C   sÊ   | j  |j¡}|  || j jk¡ || j jkrtd |¡tj	ƒ‚|j
jj}| j  |¡}g }t|ƒD ]2}| j  ||¡}|  || jjk¡ | j  |¡}|  |dk¡ | j || j j¡}|  |¡}	| |	¡ q0|S )NzNOnly basic signed structures are currently supported. NID for this data was {}ra   )rf   ZOBJ_obj2nidrº   r}   r…  ZNID_pkcs7_signedr   rx   r   ZUNSUPPORTED_SERIALIZATIONrô   Úsignr\  r  r  r  rd   r€   ZX509_up_refrè   ra  rf  rs   )
ru   r.  r¬  r  rà   Úcertsr  r   r‹   r\  r]   r]   r^   r,  ’	  s(   ý

z Backend._load_pkcs7_certificatesr2  c           
      C   s"  t |ƒ}|rtdd„ |D ƒƒstdƒ‚|tjjtjjfvr!tdƒ‚| j ¡ }| j	 
|| jj¡}g }|D ]}|  |¡}| |¡ | j ||¡}|  |dk¡ q3| j | j	j| j	j|| j	j| jj¡}|  ¡ }	|tjju rv| j |	|| j	jd¡}n|tjju s~J ‚| j |	|¡}|  |dk¡ |  |	¡S )Nc                 s   s    | ]	}t |tjƒV  qd S r„   )rª   r   ÚCertificater  r]   r]   r^   r  ²	  s   € 
ÿz7Backend.pkcs7_serialize_certificates.<locals>.<genexpr>z.certs must be a list of certs with length >= 1z/encoding must DER or PEM from the Encoding enumra   r   )ÚlistÚallrZ  r'   r_  r¹  r`  rf   r!  rd   rè   r  rb  rs   r"  r}   Ú
PKCS7_signr€   ÚPKCS7_PARTIALr  ÚPEM_write_bio_PKCS7_streamÚi2d_PKCS7_bior	  )
ru   r2  r­  Zcerts_skÚ
ossl_certsr\  r%  r‹   r.  Úbio_outr]   r]   r^   Úpkcs7_serialize_certificates¬	  sD   ÿþ


ûÿ
z$Backend.pkcs7_serialize_certificatesÚbuilderÚoptionsc                 C   s´  |j d usJ ‚|  |j ¡}| jj}d}t|jƒdkr| jj}n.| j ¡ }| j 	|| jj
¡}g }|jD ]}	|  |	¡}
| |
¡ | j ||
¡}|  |dk¡ q2tjj|v r_|| jjO }|| jjO }| j | jj| jj|| jj|¡}|  || jjk¡ | j 	|| jj¡}d}tjj|v r|| jjO }ntjj|v rœ|| jjO }tjj|v r¨|| jjO }|jD ]#\}}}|  |¡}
|  |¡}| j ||
|j||¡}|  || jjk¡ q«|D ]}|tjju rà|| jj O }qÑ|tjj!u rì|| jj"O }qÑ|  #¡ }|t$j%j&u r| j '|||j(|¡}nK|t$j%j)u r%| j *||j(|¡}|  |dk¡ | j +|||j(|¡}n)|t$j%j,u s.J ‚| j *||j(|¡}|  |dk¡ | jj-rG|  .¡  | j /||¡}|  |dk¡ |  0|¡S )Nr   ra   )1Ú_datar  rf   r7  r’   Z_additional_certsrd   r€   r!  rè   r  rb  rs   r"  r}   rP   ÚPKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDr6  r+  ZNoCapabilitiesZPKCS7_NOSMIMECAPZNoAttributesZPKCS7_NOATTRZNoCertsZPKCS7_NOCERTSZ_signersr¨   ZPKCS7_sign_add_signerrq  ÚTextZ
PKCS7_TEXTÚBinaryZPKCS7_BINARYr  r'   r_  ZSMIMEZSMIME_write_PKCS7rX   r¹  ZPKCS7_finalr8  r`  r  r×   r9  r	  )ru   r=  r­  r>  rX   Z
init_flagsZfinal_flagsr2  r:  r\  r%  r‹   r.  Zsigner_flagsr  Zprivate_keyZhash_algorithmÚmdZp7signerinfoÚoptionr;  r]   r]   r^   Ú
pkcs7_signÛ	  sŠ   




û

û€
ÿ
ÿ

zBackend.pkcs7_signr„   )rw   N)ûrZ   r[   r\   Ú__doc__r¡   r  r:   r¹   r&   r)  r*  r+  r,  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r«   r+   Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1r¦  Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrv   Ústrrz   r‚   ÚtypingÚOptionalÚListr%   Z_OpenSSLErrorr}   rh   r…   rŒ   Ú
contextlibr   r   rp   r–   ry   rÛ   r˜   ÚbytesZHashAlgorithmr   rœ   r¦   r¨   r¬   r±   r´   rµ   ZHashContextr·   r9   rL   r¾   rÂ   rk   r   rÉ   rË   rÌ   rÕ   r×   Z_OpenSSLErrorWithTextrÙ   rß   rä   r.   ZRSAPrivateKeyrî   rð   ZRSAPrivateNumbersrû   ZRSAPublicNumbersZRSAPublicKeyrü   rÿ   rë   r  r  r	  r6   r%  r7   r(  r-  r(   r0  r*   ZDSAParametersr3  ZDSAPrivateKeyr6  r8  r=  ZDSAPrivateNumbersrA  ZDSAPublicNumbersZDSAPublicKeyrC  ZDSAParameterNumbersrD  r5  rE  rF  rI  r8   r
   rJ  rL  rU  r)   ZDHParametersrV  r  rW  r'  r[  r   r3  ÚAnyrb  rf  ZCertificateSigningRequestri  rj  ZCertificateRevocationListrn  ro  r5   rr  rt  rw  rK  ÚNoReturnrR  ZEllipticCurverˆ  ZEllipticCurveSignatureAlgorithmrŠ  ZEllipticCurvePrivateKeyrŽ  ZEllipticCurvePrivateNumbersr•  ZEllipticCurvePublicNumbersZEllipticCurvePublicKeyr–  rŸ  r¤  r‹  r¥  r§  r¨  rŒ  r„  r›  r   r“  r'   r_  r²  r³  r¾  rº  r»  rÁ  rÂ  rÅ  rÊ  rË  ZDHPrivateKeyrÌ  rÍ  ZDHPrivateNumbersrÓ  ZDHPublicNumbersZDHPublicKeyrÔ  ZDHParameterNumbersrÕ  rÖ  r×  r/   ZX25519PublicKeyrÚ  ZX25519PrivateKeyrß  rá  rã  ræ  r0   ZX448PublicKeyrì  ZX448PrivateKeyrï  rð  rò  rõ  r,   ZEd25519PublicKeyrù  ZEd25519PrivateKeyrú  rû  rü  r-   ZEd448PublicKeyrþ  ZEd448PrivateKeyrÿ  r   r  r	  ÚIteratorr
  rÝ  r  r  ÚTupler  rT   r  rU   rV   r&  r'  r   r(  r)  r/  r0  r,  r<  rP   ZPKCS7SignatureBuilderr@  rE  r]   r]   r]   r^   r_   ‡   s~   
ôüýþý
ü
	ÿÿ
þÿ
þ	ÿ
þ	4ÿÿ
þÿÿ
þþýüûú
ù

þÿÿ
þÿÿ
þ	ÿ
þ$ÿ
þ@:ÿ
þÿ
þÿ
þÿ
þÿ
þÿÿ
þ
*ÿÿ
þÿ
þÿ
þþý
üÿ
þ5/þý
üÿ
þÿ
þÿ
þÿÿ
þÿÿ
þ'ÿÿ
þ

þýü
øzþý
ù7ÿÿ
þÿ
þÿÿ
þÿ
þ0ÿ
þÿ
þÿÿÿÿ
þÿ
þ$ÿþÿþþýüûúùø#ÿÿ

þÿþÿÿþMþý
üûúù ÿ
þÿ
þ
þý/þý
üûr_   c                   @   s0   e Zd Zdefdd„Zdededefdd„Zd	S )
rÃ   Úfmtc                 C   s
   || _ d S r„   )Ú_fmt)ru   rQ  r]   r]   r^   rv   ?
  r™   zGetCipherByName.__init__r#  r¸   rƒ   c                 C   sd   | j j||d ¡ }|j | d¡¡}||jjkr,|jjr,|j 	|jj| d¡|jj¡}| 
¡  |S )N)r¸   rƒ   r   )rR  rx   Úlowerrf   r¿  r£   rd   r€   ZCryptography_HAS_300_EVP_CIPHERZEVP_CIPHER_fetchr×   )ru   r#  r¸   rƒ   r  r½   r]   r]   r^   Ú__call__B
  s   ÿ
ÿþýzGetCipherByName.__call__N)	rZ   r[   r\   rG  rv   r_   r9   rL   rT  r]   r]   r]   r^   rÃ   >
  s    rÃ   r#  r¸   c                 C   s"   d  |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsrÇ  r   )rx   ræ   rf   r¿  r£   )r#  r¸   rƒ   r  r]   r]   r^   rÆ   W
  s   rÆ   )|ÚcollectionsrK  rÄ   rH  rm   r   Zcryptographyr   r   Zcryptography.exceptionsr   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr
   Z'cryptography.hazmat.backends.openssl.dhr   r   r   r   Z(cryptography.hazmat.backends.openssl.dsar   r   r   Z'cryptography.hazmat.backends.openssl.ecr   r   Z,cryptography.hazmat.backends.openssl.ed25519r   r   Z*cryptography.hazmat.backends.openssl.ed448r   r   r   Z+cryptography.hazmat.backends.openssl.hashesr   Z)cryptography.hazmat.backends.openssl.hmacr   Z-cryptography.hazmat.backends.openssl.poly1305r   r   Z(cryptography.hazmat.backends.openssl.rsar   r    Z+cryptography.hazmat.backends.openssl.x25519r!   r"   Z)cryptography.hazmat.backends.openssl.x448r#   r$   Z"cryptography.hazmat.bindings._rustre  Z$cryptography.hazmat.bindings.opensslr%   Zcryptography.hazmat.primitivesr&   r'   Z*cryptography.hazmat.primitives._asymmetricr(   Z)cryptography.hazmat.primitives.asymmetricr)   r*   r+   r,   r-   r.   r/   r0   Z1cryptography.hazmat.primitives.asymmetric.paddingr1   r2   r3   r4   Z/cryptography.hazmat.primitives.asymmetric.typesr5   r6   r7   Z&cryptography.hazmat.primitives.ciphersr8   r9   Z1cryptography.hazmat.primitives.ciphers.algorithmsr:   r;   r<   r=   r>   r?   r@   rA   rB   rC   rD   rE   Z,cryptography.hazmat.primitives.ciphers.modesrF   rG   rH   rI   rJ   rK   rL   rM   rN   Z"cryptography.hazmat.primitives.kdfrO   Z,cryptography.hazmat.primitives.serializationrP   rQ   Z3cryptography.hazmat.primitives.serialization.pkcs12rR   rS   rT   rU   rV   Ú
namedtuplerW   rY   r_   rÃ   rÆ   r#  r]   r]   r]   r^   Ú<module>   sx   (
8,	                   J
