o
    gàeeŸ ã                   @   s¶  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZmZmZmZmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZ d dl m!Z! d dl"m#Z# d d	l$m%Z% d d
l&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ d dl0m1Z1m2Z2m3Z3m4Z4 d dl5m6Z6m7Z7m8Z8 d dl9m:Z:m;Z; d dl<m=Z=m>Z> d dl?m@Z@mAZAmBZB d dlCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZL d dlMmNZN d dlOmPZP d dlQmRZRmSZS d dlTmUZUmVZV d dlWmXZXmYZY d dlZm[Z[m\Z\ d dl]m^Z^m_Z_ d dl`maZambZbmcZcmdZd d dlemfZf d dlgmhZhmiZi d dljmkZkmlZlmmZmmnZnmoZompZp d dlqmrZrmsZsmtZtmuZu d dlvmwZwmxZxmyZymzZzm{Z{m|Z|m}Z}m~Z~mZ d dl€mZm‚Z‚mƒZƒm„Z„m…Z…m†Z†m‡Z‡mˆZˆ d dl‰mŠZŠ d d l‹mŒZŒmZ d d!lŽmZ e  d"d#d$g¡Z‘G d%d&„ d&e’ƒZ“e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e ”e¡e •ef –¡ j—j˜e¡G d'd(„ d(e’ƒƒƒƒƒƒƒƒƒƒƒƒƒƒZ™G d)d*„ d*e’ƒZšd+d,„ Z›e™ƒ ZœdS )-é    N)Úcontextmanager)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)ÚINTEGERÚNULLÚSEQUENCEÚ
encode_derÚencode_der_integer)ÚCMACBackendÚCipherBackendÚDERSerializationBackendÚ	DHBackendÚ
DSABackendÚEllipticCurveBackendÚHMACBackendÚHashBackendÚPBKDF2HMACBackendÚPEMSerializationBackendÚ
RSABackendÚScryptBackendÚX509Backend)Úaead)Ú_CipherContext©Ú_CMACContext)	Ú_CRL_ENTRY_REASON_ENUM_TO_CODEÚ_CRL_EXTENSION_HANDLERSÚ_EXTENSION_HANDLERS_BASEÚ_EXTENSION_HANDLERS_SCTÚ"_OCSP_BASICRESP_EXTENSION_HANDLERSÚ_OCSP_REQ_EXTENSION_HANDLERSÚ'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCTÚ_REVOKED_EXTENSION_HANDLERSÚ_X509ExtensionParser)Ú_DHParametersÚ_DHPrivateKeyÚ_DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey)	Ú$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERSÚ_CRL_EXTENSION_ENCODE_HANDLERSÚ_EXTENSION_ENCODE_HANDLERSÚ)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERSÚ'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERSÚ_encode_asn1_int_gcÚ_encode_asn1_str_gcÚ_encode_name_gcÚ_txt2obj_gc©Ú_HashContext©Ú_HMACContext)Ú_OCSPRequestÚ_OCSPResponse)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)Ú_CertificateÚ_CertificateRevocationListÚ_CertificateSigningRequestÚ_RevokedCertificate)Úbinding)ÚhashesÚserialization)ÚdhÚdsaÚecÚed25519Úed448Úrsa)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)	ÚAESÚARC4ÚBlowfishÚCAST5ÚCamelliaÚChaCha20ÚIDEAÚSEEDÚ	TripleDES)ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚOFBÚXTS)Úscrypt)Úpkcs7Ússh)ÚocspÚ
_MemoryBIOÚbioÚchar_ptrc                   @   s   e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú__qualname__© rx   rx   úN/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.pyrt       s    rt   c                   @   sj  e Zd ZdZdZh d£ZeefZe	j
e	je	je	je	je	je	je	je	je	je	je	je	jfZdZdZdd> ZdZde> Zdd„ Zd(d
d„Zdd„ Zdd„ Z e!j"dd„ ƒZ#dd„ Z$dd„ Z%dd„ Z&dd„ Z'dd„ Z(dd„ Z)dd„ Z*d d!„ Z+d"d#„ Z,d$d%„ Z-d&d'„ Z.d(d)„ Z/d*d+„ Z0d,d-„ Z1d.d/„ Z2d0d1„ Z3d2d3„ Z4d4d5„ Z5d6d7„ Z6d8d9„ Z7d:d;„ Z8d<d=„ Z9d(d>d?„Z:d@dA„ Z;dBdC„ Z<dDdE„ Z=dFdG„ Z>dHdI„ Z?dJdK„ Z@dLdM„ ZAdNdO„ ZBdPdQ„ ZCdRdS„ ZDdTdU„ ZEdVdW„ ZFdXdY„ ZGdZd[„ ZHd\d]„ ZId^d_„ ZJd`da„ ZKdbdc„ ZLddde„ ZMdfdg„ ZNdhdi„ ZOdjdk„ ZPdldm„ ZQdndo„ ZRdpdq„ ZSdrds„ ZTdtdu„ ZUdvdw„ ZVdxdy„ ZWdzd{„ ZXd|d}„ ZYd~d„ ZZd€d„ Z[d‚dƒ„ Z\d„d…„ Z]d†d‡„ Z^dˆd‰„ Z_dŠd‹„ Z`dŒd„ ZadŽd„ Zbdd‘„ Zcd’d“„ Zdd”d•„ Zed–d—„ Zfd˜d™„ Zgdšd›„ Zhdœd„ ZidždŸ„ Zjd d¡„ Zkd¢d£„ Zld¤d¥„ Zmd¦d§„ Znd¨d©„ Zodªd«„ Zpd¬d­„ Zqd®d¯„ Zrd°d±„ Zsd²d³„ Ztd´dµ„ Zud¶d·„ Zvd¸d¹„ Zwdºd»„ Zxd¼d½„ Zyd¾d¿„ ZzdÀdÁ„ Z{dÂdÃ„ Z|dÄdÅ„ Z}dÆdÇ„ Z~e"dÈdÉ„ ƒZdÊdË„ Z€dÌdÍ„ ZdÎdÏ„ Z‚dÐdÑ„ ZƒdÒdÓ„ Z„dÔdÕ„ Z…dÖd×„ Z†dØdÙ„ Z‡dÚdÛ„ ZˆdÜdÝ„ Z‰dÞdß„ ZŠdàdá„ Z‹dâdã„ ZŒdädå„ Zd(dædç„ZŽdèdé„ Zdêdë„ Zdìdí„ Z‘dîdï„ Z’dðdñ„ Z“dòdó„ Z”dôdõ„ Z•död÷„ Z–dødù„ Z—dúdû„ Z˜düdý„ Z™dþdÿ„ Zšd d„ Z›dd„ Zœdd„ Zdd„ Zždd	„ ZŸd
d„ Z dd„ Z¡dd„ Z¢dd„ Z£e!j"dd„ ƒZ¤dd„ Z¥e!j"dd„ ƒZ¦dd„ Z§dd„ Z¨dd„ Z©dd„ Zªd d!„ Z«d"d#„ Z¬d$d%„ Z­d&d'„ Z®d	S ()  ÚBackendz)
    OpenSSL API binding interfaces.
    Úopenssl>   ó   aes-128-ccmó   aes-128-gcmó   aes-192-ccmó   aes-192-gcmó   aes-256-ccmó   aes-256-gcmé   i  é   c                 C   s–   t  ¡ | _| jj| _| jj| _|  ¡ | _i | _	|  
¡  |  ¡  |  ¡  | jr1| jjr1t dt¡ n|  ¡  | jjg| _| jjrI| j | jj¡ d S d S )Nz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)rO   ÚBindingÚ_bindingÚffiÚ_ffiÚlibÚ_libÚ_is_fips_enabledÚ_fips_enabledÚ_cipher_registryÚ_register_default_ciphersÚ_register_x509_ext_parsersÚ_register_x509_encodersÚ"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEÚwarningsÚwarnÚUserWarningÚactivate_osrandom_engineÚEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendÚEVP_PKEY_DHX©Úselfrx   rx   ry   Ú__init__Ü   s$   



þÿzBackend.__init__Nc                 C   s   t j| j||dS )N)Úerrors)rO   Ú_openssl_assertr‰   )r›   Úokr   rx   rx   ry   Úopenssl_assertñ   s   zBackend.openssl_assertc                 C   s2   t | jddd„ ƒ}|ƒ }|dkr| j ¡  t|ƒS )NÚ	FIPS_modec                   S   ó   dS ©Nr   rx   rx   rx   rx   ry   Ú<lambda>õ   s    z*Backend._is_fips_enabled.<locals>.<lambda>r   )Úgetattrr‰   ÚERR_clear_errorÚbool)r›   Ú	fips_modeÚmoderx   rx   ry   rŠ   ô   s
   
zBackend._is_fips_enabledc                 C   sn   | j jr3| j  ¡ }|| jjkr5| j  |¡ | j  | jj¡}|  |dk¡ | j  |¡}|  |dk¡ d S d S d S ©Nrƒ   )	r‰   r   ÚENGINE_get_default_RANDr‡   r   ÚENGINE_unregister_RANDÚRAND_set_rand_methodr    ÚENGINE_finish©r›   ÚeÚresrx   rx   ry   Úactivate_builtin_randomü   s   
özBackend.activate_builtin_randomc              
   c   s¶    | j  | j j¡}|  || jjk¡ | j  |¡}|  |dk¡ z |V  W | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ d S | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ w rª   )	r‰   ÚENGINE_by_idÚCryptography_osrandom_engine_idr    r‡   r   ÚENGINE_initÚENGINE_freer®   r¯   rx   rx   ry   Ú_get_osurandom_engine	  s   €üzBackend._get_osurandom_enginec                 C   sx   | j jr:|  ¡  |  ¡ }| j  |¡}|  |dk¡ W d   ƒ n1 s$w   Y  | j  | jj¡}|  |dk¡ d S d S rª   )	r‰   r   r²   r·   ÚENGINE_set_default_RANDr    r­   r‡   r   r¯   rx   rx   ry   r”     s   
ý÷z Backend.activate_osrandom_enginec              	   C   st   | j  dd¡}|  ¡ }| j |dt|ƒ|| j jd¡}|  |dk¡ W d   ƒ n1 s,w   Y  | j  |¡ 	d¡S )Núchar[]é@   s   get_implementationr   Úascii)
r‡   Únewr·   r‰   ÚENGINE_ctrl_cmdÚlenr   r    ÚstringÚdecode)r›   Úbufr°   r±   rx   rx   ry   Úosrandom_engine_implementation)  s   
ÿüz&Backend.osrandom_engine_implementationc                 C   s   | j  | j | jj¡¡ d¡S )zÀ
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r»   )r‡   r¿   r‰   ÚOpenSSL_versionÚOPENSSL_VERSIONrÀ   rš   rx   rx   ry   Úopenssl_version_text2  s
   ÿþzBackend.openssl_version_textc                 C   s
   | j  ¡ S ©N)r‰   ÚOpenSSL_version_numrš   rx   rx   ry   Úopenssl_version_number=  ó   
zBackend.openssl_version_numberc                 C   s   t | ||ƒS rÆ   r?   )r›   ÚkeyÚ	algorithmrx   rx   ry   Úcreate_hmac_ctx@  ó   zBackend.create_hmac_ctxc                 C   sL   |j dks
|j dkrd |j |jd ¡ d¡}n|j  d¡}| j |¡}|S )NÚblake2bÚblake2sz{}{}é   r»   )ÚnameÚformatÚdigest_sizeÚencoder‰   ÚEVP_get_digestbyname)r›   rË   ÚalgÚevp_mdrx   rx   ry   Ú_evp_md_from_algorithmC  s   ÿþzBackend._evp_md_from_algorithmc                 C   s    |   |¡}|  || jjk¡ |S rÆ   )rØ   r    r‡   r   ©r›   rË   r×   rx   rx   ry   Ú_evp_md_non_null_from_algorithmN  s   
z'Backend._evp_md_non_null_from_algorithmc                 C   s,   | j rt|| jƒsdS |  |¡}|| jjkS ©NF)r‹   Ú
isinstanceÚ_fips_hashesrØ   r‡   r   rÙ   rx   rx   ry   Úhash_supportedS  s   
zBackend.hash_supportedc                 C   ó
   |   |¡S rÆ   ©rÞ   ©r›   rË   rx   rx   ry   Úhmac_supportedZ  rÉ   zBackend.hmac_supportedc                 C   ó
   t | |ƒS rÆ   r=   rá   rx   rx   ry   Úcreate_hash_ctx]  rÉ   zBackend.create_hash_ctxc                 C   s^   | j rt|| jƒsdS z| jt|ƒt|ƒf }W n
 ty"   Y dS w || ||ƒ}| jj|kS rÛ   )r‹   rÜ   Ú_fips_ciphersrŒ   ÚtypeÚKeyErrorr‡   r   )r›   Úcipherr©   ÚadapterÚ
evp_cipherrx   rx   ry   Úcipher_supported`  s   ÿzBackend.cipher_supportedc                 C   s0   ||f| j v rtd ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)rŒ   Ú
ValueErrorrÒ   )r›   Ú
cipher_clsÚmode_clsré   rx   rx   ry   Úregister_cipher_adapterj  s   ÿÿzBackend.register_cipher_adapterc                 C   sV  t ttttttfD ]}|  t|t	dƒ¡ q	t ttttfD ]}|  t
|t	dƒ¡ qt tttfD ]}|  t|t	dƒ¡ q.|  ttt	dƒ¡ t tttfD ]}|  t|t	dƒ¡ qIt tttfD ]}|  t|t	dƒ¡ q[t ttgt tttg¡D ]\}}|  ||t	dƒ¡ qs|  ttd ƒt	dƒ¡ |  ttd ƒt	dƒ¡ |  ttd ƒt	d	ƒ¡ |  ttt¡ d S )
Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Úrc4Úrc2Úchacha20)re   rh   ri   rk   rf   rg   rj   rï   r\   ÚGetCipherByNamer`   rd   r^   rc   Ú	itertoolsÚproductr_   rb   r]   ræ   rt   ra   rl   Ú_get_xts_cipher)r›   rî   rí   rx   rx   ry   r   s  sT   ýý
ÿ
ÿ
ÿ
ÿ
þýÿz!Backend._register_default_ciphersc                 C   sæ   t  ¡ }t ¡ }| jjr| t¡ | t¡ t| | jj	| jj
|d| _t| | jj| jj|d| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jj|d| _ d S )N)Ú	ext_countÚget_extÚhandlers)!r   Úcopyr$   r‰   ÚCryptography_HAS_SCTÚupdater    r#   r%   ÚX509_get_ext_countÚX509_get_extÚ_certificate_extension_parserÚsk_X509_EXTENSION_numÚsk_X509_EXTENSION_valueÚ_csr_extension_parserÚX509_REVOKED_get_ext_countÚX509_REVOKED_get_extÚ_revoked_cert_extension_parserÚX509_CRL_get_ext_countÚX509_CRL_get_extr   Ú_crl_extension_parserÚOCSP_REQUEST_get_ext_countÚOCSP_REQUEST_get_extr"   Ú_ocsp_req_ext_parserÚOCSP_BASICRESP_get_ext_countÚOCSP_BASICRESP_get_extr!   Ú_ocsp_basicresp_ext_parserÚOCSP_SINGLERESP_get_ext_countÚOCSP_SINGLERESP_get_extÚ_ocsp_singleresp_ext_parser)r›   Úext_handlersÚsingleresp_handlersrx   rx   ry   rŽ      s^   

üüüüüüüz"Backend._register_x509_ext_parsersc                 C   s6   t  ¡ | _t ¡ | _t ¡ | _t ¡ | _t	 ¡ | _
d S rÆ   )r6   rú   Ú_extension_encode_handlersr5   Ú_crl_extension_encode_handlersr4   Ú$_crl_entry_extension_encode_handlersr8   Ú'_ocsp_request_extension_encode_handlersr7   Ú)_ocsp_basicresp_extension_encode_handlersrš   rx   rx   ry   r   Õ  s   
ÿÿÿÿzBackend._register_x509_encodersc                 C   ó   t | ||t jƒS rÆ   )r   Ú_ENCRYPT©r›   rè   r©   rx   rx   ry   Úcreate_symmetric_encryption_ctxä  ó   z'Backend.create_symmetric_encryption_ctxc                 C   r  rÆ   )r   Ú_DECRYPTr  rx   rx   ry   Úcreate_symmetric_decryption_ctxç  r  z'Backend.create_symmetric_decryption_ctxc                 C   rß   rÆ   )râ   rá   rx   rx   ry   Úpbkdf2_hmac_supportedê  rÉ   zBackend.pbkdf2_hmac_supportedc           
   
   C   sh   | j  d|¡}|  |¡}| j  |¡}| j |t|ƒ|t|ƒ||||¡}	|  |	dk¡ | j  |¡d d … S )Núunsigned char[]rƒ   )	r‡   r¼   rÚ   Úfrom_bufferr‰   ÚPKCS5_PBKDF2_HMACr¾   r    Úbuffer)
r›   rË   ÚlengthÚsaltÚ
iterationsÚkey_materialrÁ   r×   Úkey_material_ptrr±   rx   rx   ry   Úderive_pbkdf2_hmací  s   
ø
zBackend.derive_pbkdf2_hmacc                 C   ó   t  | j¡S rÆ   )rO   Ú_consume_errorsr‰   rš   rx   rx   ry   r,     rÍ   zBackend._consume_errorsc                 C   r+  rÆ   )rO   Ú_consume_errors_with_textr‰   rš   rx   rx   ry   r-    rÍ   z!Backend._consume_errors_with_textc                 C   sx   || j jksJ ‚| j |¡}| j  d|¡}| j ||¡}|  |dk¡ t | j  	|¡d |… d¡}| j 
|¡r:| }|S )Nr!  r   Úbig)r‡   r   r‰   ÚBN_num_bytesr¼   Ú	BN_bn2binr    ÚintÚ
from_bytesr$  ÚBN_is_negative)r›   ÚbnÚbn_num_bytesÚbin_ptrÚbin_lenÚvalrx   rx   ry   Ú
_bn_to_int  s   zBackend._bn_to_intc                 C   sn   |du s|| j jksJ ‚|du r| j j}| t| ¡ d d ƒd¡}| j |t|ƒ|¡}|  || j jk¡ |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @rƒ   r.  )	r‡   r   Úto_bytesr1  Ú
bit_lengthr‰   Ú	BN_bin2bnr¾   r    )r›   Únumr4  ÚbinaryÚbn_ptrrx   rx   ry   Ú
_int_to_bn  s   zBackend._int_to_bnc                 C   s   t  ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS rª   )rW   Ú_verify_rsa_parametersr‰   ÚRSA_newr    r‡   r   ÚgcÚRSA_freer@  ÚBN_freeÚRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyrE   )r›   Úpublic_exponentÚkey_sizeÚ	rsa_cdatar4  r±   Úevp_pkeyrx   rx   ry   Úgenerate_rsa_private_key$  s   

ÿ
z Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )Né   rƒ   r   i   rx   )r›   rH  rI  rx   rx   ry   Ú!generate_rsa_parameters_supported6  s
   
ÿýz)Backend.generate_rsa_parameters_supportedc              
   C   s2  t  |j|j|j|j|j|j|jj	|jj
¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |jj	¡}	|  |jj
¡}
| j |||¡}|  |dk¡ | j ||
|	|¡}|  |dk¡ | j ||||¡}|  |dk¡ |  |¡}t| ||ƒS rª   )rW   Ú_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersr°   Únr‰   rB  r    r‡   r   rC  rD  r@  ÚRSA_set0_factorsÚRSA_set0_keyÚRSA_set0_crt_paramsrG  rE   )r›   ÚnumbersrJ  rP  rQ  rR  rS  rT  rU  r°   rW  r±   rK  rx   rx   ry   Úload_rsa_private_numbers=  s:   ø


z Backend.load_rsa_private_numbersc                 C   s   t  |j|j¡ | j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS rª   )rW   Ú_check_public_key_componentsr°   rW  r‰   rB  r    r‡   r   rC  rD  r@  rY  rG  rF   )r›   r[  rJ  r°   rW  r±   rK  rx   rx   ry   Úload_rsa_public_numbers]  s   

zBackend.load_rsa_public_numbersc                 C   s2   | j  ¡ }|  || jjk¡ | j || j j¡}|S rÆ   )r‰   ÚEVP_PKEY_newr    r‡   r   rC  ÚEVP_PKEY_free©r›   rK  rx   rx   ry   Ú_create_evp_pkey_gcj  s   
zBackend._create_evp_pkey_gcc                 C   ó(   |   ¡ }| j ||¡}|  |dk¡ |S rª   )rb  r‰   ÚEVP_PKEY_set1_RSAr    )r›   rJ  rK  r±   rx   rx   ry   rG  p  ó   zBackend._rsa_cdata_to_evp_pkeyc                 C   sH   | j  |¡}| j |t|ƒ¡}|  || j jk¡ t| j  || jj	¡|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
r‡   r"  r‰   ÚBIO_new_mem_bufr¾   r    r   rq   rC  ÚBIO_free)r›   ÚdataÚdata_ptrrr   rx   rx   ry   Ú_bytes_to_biov  s   zBackend._bytes_to_bioc                 C   sP   | j  ¡ }|  || jjk¡ | j  |¡}|  || jjk¡ | j || j j¡}|S )z.
        Creates an empty memory BIO.
        )r‰   Ú	BIO_s_memr    r‡   r   ÚBIO_newrC  rg  )r›   Ú
bio_methodrr   rx   rx   ry   Ú_create_mem_bio_gcƒ  s   
zBackend._create_mem_bio_gcc                 C   s\   | j  d¡}| j ||¡}|  |dk¡ |  |d | j jk¡ | j  |d |¡dd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)r‡   r¼   r‰   ÚBIO_get_mem_datar    r   r$  )r›   rr   rÁ   Úbuf_lenÚbio_datarx   rx   ry   Ú_read_mem_bioŽ  s   zBackend._read_mem_bioc                 C   ó¢  | j  |¡}|| j jkr*| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krN| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrr| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jv r•| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkr£t| |ƒS |t| j ddƒkr±t| |ƒS |t| j ddƒkr¿t| |ƒS |t| j ddƒkrÍt| |ƒS tdƒ‚)zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ÚEVP_PKEY_ED25519NÚEVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.)r‰   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAr    r‡   r   rC  rD  rE   ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer+   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer-   r–   ÚEVP_PKEY_get1_DHÚDH_freer'   r¥   r/   rI   rG   r2   r   ©r›   rK  Úkey_typerJ  Ú	dsa_cdataÚec_cdataÚdh_cdatarx   rx   ry   Ú_evp_pkey_to_private_key™  ó<   




z Backend._evp_pkey_to_private_keyc                 C   rs  )zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        rt  Nru  rv  rw  rx  )r‰   ry  rz  r{  r    r‡   r   rC  rD  rF   r|  r}  r~  r,   r  r€  r  r.   r–   r‚  rƒ  r(   r¥   r0   rJ   rH   r3   r   r„  rx   rx   ry   Ú_evp_pkey_to_public_keyÄ  rŠ  zBackend._evp_pkey_to_public_keyc                 C   s2   | j jrt|tjtjtjtjtjfƒS t|tjƒS rÆ   )	r‰   ÚCryptography_HAS_RSA_OAEP_MDrÜ   rP   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512rá   rx   rx   ry   Ú_oaep_hash_supportedï  s   ûþzBackend._oaep_hash_supportedc                 C   sŠ   t |tƒrdS t |tƒrt |jtƒr|  |jj¡S t |tƒrCt |jtƒrC|  |jj¡oB|  |j¡oB|j	d u pBt
|j	ƒdkpB| jjdkS dS )NTr   rƒ   F)rÜ   rZ   r[   Ú_mgfrX   rÞ   Ú
_algorithmrY   r’  Ú_labelr¾   r‰   ÚCryptography_HAS_RSA_OAEP_LABEL)r›   Úpaddingrx   rx   ry   Úrsa_padding_supportedþ  s   

ÿ
û	zBackend.rsa_padding_supportedc              	   C   s~   |dvrt dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}|  |dk¡ t	| |ƒS )N)i   r‚   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   rƒ   )
rì   r‰   ÚDSA_newr    r‡   r   rC  r~  ÚDSA_generate_parameters_exr*   )r›   rI  Úctxr±   rx   rx   ry   Úgenerate_dsa_parameters  s$   ÿ
ù

zBackend.generate_dsa_parametersc                 C   sT   | j  |j¡}|  || jjk¡ | j || j j¡}| j  |¡ |  	|¡}t
| ||ƒS rÆ   )r‰   ÚDSAparams_dupÚ
_dsa_cdatar    r‡   r   rC  r~  ÚDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr+   )r›   Ú
parametersr›  rK  rx   rx   ry   Úgenerate_dsa_private_key'  s   
z Backend.generate_dsa_private_keyc                 C   ó   |   |¡}|  |¡S rÆ   )rœ  r¢  )r›   rI  r¡  rx   rx   ry   Ú'generate_dsa_private_key_and_parameters0  ó   

z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j  ||||¡}|  |dk¡ | j  |||¡}|  |dk¡ d S rª   )r‰   ÚDSA_set0_pqgr    ÚDSA_set0_key)r›   r†  rP  rQ  ÚgÚpub_keyÚpriv_keyr±   rx   rx   ry   Ú_dsa_cdata_set_values4  s   zBackend._dsa_cdata_set_valuesc           
      C   s¨   t  |¡ |jj}| j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}|  |j¡}|  |jj¡}|  |j¡}|  ||||||¡ |  |¡}	t| ||	ƒS rÆ   )rS   Ú_check_dsa_private_numbersrV  Úparameter_numbersr‰   r™  r    r‡   r   rC  r~  r@  rP  rQ  r¨  ÚyÚxr«  r   r+   )
r›   r[  r­  r†  rP  rQ  r¨  r©  rª  rK  rx   rx   ry   Úload_dsa_private_numbers:  s   


z Backend.load_dsa_private_numbersc           	      C   s¢   t  |j¡ | j ¡ }|  || jjk¡ | j || jj	¡}|  
|jj¡}|  
|jj¡}|  
|jj¡}|  
|j¡}| jj}|  ||||||¡ |  |¡}t| ||ƒS rÆ   )rS   Ú_check_dsa_parametersr­  r‰   r™  r    r‡   r   rC  r~  r@  rP  rQ  r¨  r®  r«  r   r,   )	r›   r[  r†  rP  rQ  r¨  r©  rª  rK  rx   rx   ry   Úload_dsa_public_numbersM  s   

zBackend.load_dsa_public_numbersc                 C   s†   t  |¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|  	|j¡}| j ||||¡}|  |dk¡ t| |ƒS rª   )rS   r±  r‰   r™  r    r‡   r   rC  r~  r@  rP  rQ  r¨  r¦  r*   )r›   r[  r†  rP  rQ  r¨  r±   rx   rx   ry   Úload_dsa_parameter_numbers^  s   


z"Backend.load_dsa_parameter_numbersc                 C   rc  rª   )rb  r‰   ÚEVP_PKEY_set1_DSAr    )r›   r†  rK  r±   rx   rx   ry   r   l  re  zBackend._dsa_cdata_to_evp_pkeyc                 C   rß   rÆ   rà   rá   rx   rx   ry   Údsa_hash_supportedr  rÉ   zBackend.dsa_hash_supportedc                 C   r¢   )NTrx   )r›   rP  rQ  r¨  rx   rx   ry   Údsa_parameters_supportedu  s   z Backend.dsa_parameters_supportedc                 C   s   |   |td|j ƒ¡S )Nó    )rë   re   Ú
block_sizerá   rx   rx   ry   Úcmac_algorithm_supportedx  s   ÿz Backend.cmac_algorithm_supportedc                 C   rã   rÆ   r   rá   rx   rx   ry   Úcreate_cmac_ctx}  rÉ   zBackend.create_cmac_ctxc                 C   s€   t |tjtjfƒr|d urtdƒ‚d S t |tjtj	t
jfƒs"tdƒ‚t |tjƒs,tdƒ‚t |tjƒr<t |tjƒs>tdƒ‚d S d S )Nz8algorithm must be None when signing via ed25519 or ed448z;Key must be an rsa, dsa, ec, ed25519, or ed448 private key.z.Algorithm must be a registered hash algorithm.z2MD5 hash algorithm is only supported with RSA keys)rÜ   rU   ÚEd25519PrivateKeyrV   ÚEd448PrivateKeyrì   rW   ÚRSAPrivateKeyrS   ÚDSAPrivateKeyrT   ÚEllipticCurvePrivateKeyÚ	TypeErrorrP   ÚHashAlgorithmÚMD5©r›   Úprivate_keyrË   rx   rx   ry   Ú_x509_check_signature_params€  s0   ÿÿÿþÿÿÿýz$Backend._x509_check_signature_paramsc              	      s°  t |tjƒs
tdƒ‚ˆ  ||¡ ˆ  ||¡}ˆ j ¡ }ˆ  |ˆ j	j
k¡ ˆ j	 |ˆ jj¡}ˆ j |tjjj¡}ˆ  |dk¡ ˆ j |tˆ |jƒ¡}ˆ  |dk¡ | ¡ }ˆ j ||j¡}ˆ  |dk¡ ˆ j ¡ }ˆ  |ˆ j	j
k¡ ˆ j	 |‡ fdd„¡}ˆ j|jˆ j|ˆ jjdd ˆ j ||¡}ˆ  |dk¡ |jD ]!\}	}
tˆ |	jƒ}ˆ j  ||tj!j"j#j|
t$|
ƒ¡}ˆ  |dk¡ q›ˆ j %||j|¡}|dkrÓˆ  &¡ }t'd|ƒ‚t(ˆ |ƒS )	NúBuilder type mismatch.rƒ   c                    s   ˆ j  | ˆ j ˆ j jd¡¡S )NÚX509_EXTENSION_free)r‰   Úsk_X509_EXTENSION_pop_freer‡   Ú	addressofÚ_original_lib)r¯  rš   rx   ry   r¤   ¹  s    ÿþz)Backend.create_x509_csr.<locals>.<lambda>F©Ú
extensionsrù   Úx509_objÚadd_funcrC  r   úSigning failed))rÜ   r   Ú CertificateSigningRequestBuilderrÀ  rÅ  Ú_evp_md_x509_null_if_eddsar‰   ÚX509_REQ_newr    r‡   r   rC  ÚX509_REQ_freeÚX509_REQ_set_versionÚVersionÚv1ÚvalueÚX509_REQ_set_subject_namer;   Ú_subject_nameÚ
public_keyÚX509_REQ_set_pubkeyÚ	_evp_pkeyÚsk_X509_EXTENSION_new_nullÚ_create_x509_extensionsÚ_extensionsr  Úsk_X509_EXTENSION_insertÚX509_REQ_add_extensionsÚ_attributesr<   Údotted_stringÚX509_REQ_add1_attr_by_OBJrÑ   Ú	_ASN1TypeÚ
UTF8Stringr¾   ÚX509_REQ_signr-  rì   rM   )r›   ÚbuilderrÄ  rË   r×   Úx509_reqr±   rÚ  Úsk_extensionÚattr_oidÚattr_valÚobjr   rx   rš   ry   Úcreate_x509_csr˜  s\   
ÿ

þû
û

zBackend.create_x509_csrc           	      C   sv  t |tjƒs
tdƒ‚|  ||¡ |  ||¡}| j ¡ }| j 	|| jj
¡}| j ||jj¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ | j ||jj¡}|  |dk¡ t| |jƒ}| j ||¡}|  |dk¡ |  | j |¡|j¡ |  | j |¡|j¡ | j|j| j|| jj dd | j !|t| |j"ƒ¡}|  |dk¡ | j #||j|¡}|dkr¶|  $¡ }t%d|ƒ‚t&| |ƒS ©NrÆ  rƒ   TrË  r   rÏ  )'rÜ   r   ÚCertificateBuilderrÀ  rÅ  rÑ  r‰   ÚX509_newr‡   rC  Ú	X509_freeÚX509_set_versionÚ_versionr×  r    ÚX509_set_subject_namer;   rÙ  ÚX509_set_pubkeyÚ_public_keyrÜ  r9   Ú_serial_numberÚX509_set_serialNumberÚ_set_asn1_timeÚX509_getm_notBeforeÚ_not_valid_beforeÚX509_getm_notAfterÚ_not_valid_afterrÞ  rß  r  ÚX509_add_extÚX509_set_issuer_nameÚ_issuer_nameÚ	X509_signr-  rì   rK   )	r›   rè  rÄ  rË   r×   Ú	x509_certr±   Úserial_numberr   rx   rx   ry   Úcreate_x509_certificateà  sR   
ÿÿÿÿû	ÿ

zBackend.create_x509_certificatec                 C   s$   t |tjtjfƒr| jjS |  |¡S rÆ   )rÜ   rU   r»  rV   r¼  r‡   r   rÚ   rÃ  rx   rx   ry   rÑ  "  s
   ÿ
z"Backend._evp_md_x509_null_if_eddsac                 C   sL   |j dkr| d¡ d¡}n| d¡ d¡}| j ||¡}|  |dk¡ d S )Ni  z%Y%m%d%H%M%SZr»   z%y%m%d%H%M%SZrƒ   )ÚyearÚstrftimerÔ   r‰   ÚASN1_TIME_set_stringr    )r›   Ú	asn1_timeÚtimeÚasn1_strr±   rx   rx   ry   rú  +  s
   
zBackend._set_asn1_timec                 C   s>   | j  ¡ }|  || jjk¡ | j || j j¡}|  ||¡ |S rÆ   )r‰   ÚASN1_TIME_newr    r‡   r   rC  ÚASN1_TIME_freerú  )r›   r
  r	  rx   rx   ry   Ú_create_asn1_time3  s
   
zBackend._create_asn1_timec                 C   sr  t |tjƒs
tdƒ‚|  ||¡ |  ||¡}| j ¡ }| j 	|| jj
¡}| j |d¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ | j|j| j|| jjdd |jD ] }	| j |	j¡}
|  |
| jjk¡ | j ||
¡}|  |dk¡ q}| j ||j|¡}|dkr´|   ¡ }t!d|ƒ‚t"| |ƒS rï  )#rÜ   r   Ú CertificateRevocationListBuilderrÀ  rÅ  rÑ  r‰   ÚX509_CRL_newr‡   rC  ÚX509_CRL_freeÚX509_CRL_set_versionr    ÚX509_CRL_set_issuer_namer;   r  r  Ú_last_updateÚX509_CRL_set1_lastUpdateÚ_next_updateÚX509_CRL_set1_nextUpdaterÞ  rß  r  ÚX509_CRL_add_extÚ_revoked_certificatesÚX509_REVOKED_dupÚ_x509_revokedr   ÚX509_CRL_add0_revokedÚX509_CRL_signrÜ  r-  rì   rL   )r›   rè  rÄ  rË   r×   Úx509_crlr±   Úlast_updateÚnext_updateÚrevoked_certÚrevokedr   rx   rx   ry   Úcreate_x509_crl:  sF   
ÿû
	

zBackend.create_x509_crlc           
      C   sd   t |ƒD ]+\}}|  ||¡}|  || jjk¡ |r"| j || jj¡}||||ƒ}	|  |	dk¡ qd S rª   )Ú	enumerateÚ_create_x509_extensionr    r‡   r   rC  r‰   rÇ  )
r›   rÌ  rù   rÍ  rÎ  rC  ÚiÚ	extensionÚx509_extensionr±   rx   rx   ry   rÞ  r  s   ÿ÷zBackend._create_x509_extensionsc                 C   s2   t | |jjƒ}| j | jj||jrd|¡S d|¡S )Nrƒ   r   )r<   Úoidrã  r‰   ÚX509_EXTENSION_create_by_OBJr‡   r   Úcritical)r›   r'  r×  rí  rx   rx   ry   Ú_create_raw_x509_extension€  s   ÿÿz"Backend._create_raw_x509_extensionc                 C   s  t |jtjƒrt| |jjƒ}|  ||¡S t |jtjƒr4ttgdd„ |jD ƒ¢R Ž }t| |ƒ}|  ||¡S t |jtj	ƒrHt| tt
ƒƒ}|  ||¡S z||j }W n ty^   td |j¡ƒ‚w || |jƒ}| j |jj d¡¡}|  || jjk¡ | j ||jr„d|¡S d|¡S )Nc                 S   s   g | ]
}t tt|jƒƒ‘qS rx   )r
   r   r   r×  )Ú.0r¯  rx   rx   ry   Ú
<listcomp>  s    ÿÿz2Backend._create_x509_extension.<locals>.<listcomp>zExtension not supported: {}r»   rƒ   r   )rÜ   r×  r   ÚUnrecognizedExtensionr:   r,  Ú
TLSFeaturer
   r	   ÚPrecertPoisonr   r)  rç   ÚNotImplementedErrorrÒ   r‰   ÚOBJ_txt2nidrã  rÔ   r    Ú	NID_undefÚX509V3_EXT_i2dr+  )r›   rù   r'  r×  Úasn1rÔ   Ú
ext_structÚnidrx   rx   ry   r%  †  sB   ÿþþ

ÿÿÿÿÿzBackend._create_x509_extensionc                 C   sº   t |tjƒs
tdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}t| |jƒ}| j ||¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ | j|j| j|| jjdd t| d |ƒS )NrÆ  rƒ   TrË  )rÜ   r   ÚRevokedCertificateBuilderrÀ  r‰   ÚX509_REVOKED_newr    r‡   r   rC  ÚX509_REVOKED_freer9   rø  ÚX509_REVOKED_set_serialNumberr  Ú_revocation_dateÚX509_REVOKED_set_revocationDaterÞ  rß  r  ÚX509_REVOKED_add_extrN   )r›   rè  Úx509_revokedr  r±   Úrev_daterx   rx   ry   Úcreate_x509_revoked_certificate¨  s*   
ÿûz'Backend.create_x509_revoked_certificatec                 C   s   |   | jj| j||¡S rÆ   )Ú	_load_keyr‰   ÚPEM_read_bio_PrivateKeyr‰  )r›   rh  Úpasswordrx   rx   ry   Úload_pem_private_keyÁ  s   üzBackend.load_pem_private_keyc                 C   sÖ   |   |¡}| j |j| jj| jj| jj¡}|| jjkr)| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj| jj| jj¡}|| jjkre| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rª   )rj  r‰   ÚPEM_read_bio_PUBKEYrr   r‡   r   rC  r`  r‹  r,  Ú	BIO_resetr    ÚPEM_read_bio_RSAPublicKeyrD  rG  rF   Ú_handle_key_loading_error©r›   rh  Úmem_biorK  r±   rJ  rx   rx   ry   Úload_pem_public_keyÉ  s$   
ÿ
ÿ
zBackend.load_pem_public_keyc                 C   s^   |   |¡}| j |j| jj| jj| jj¡}|| jjkr)| j || jj¡}t| |ƒS |  	¡  d S rÆ   )
rj  r‰   ÚPEM_read_bio_DHparamsrr   r‡   r   rC  rƒ  r&   rJ  )r›   rh  rL  rˆ  rx   rx   ry   Úload_pem_parametersâ  s   
ÿ
zBackend.load_pem_parametersc                 C   s:   |   |¡}|  ||¡}|r|  |¡S |  | jj| j||¡S rÆ   )rj  Ú"_evp_pkey_from_der_traditional_keyr‰  rC  r‰   Úd2i_PKCS8PrivateKey_bio)r›   rh  rE  rq  rÊ   rx   rx   ry   Úload_der_private_keyî  s   

üzBackend.load_der_private_keyc                 C   sZ   | j  |j| jj¡}|| jjkr'|  ¡  | j || j j¡}|d ur%tdƒ‚|S |  ¡  d S )Nú4Password was given but private key is not encrypted.)	r‰   Úd2i_PrivateKey_biorr   r‡   r   r,  rC  r`  rÀ  )r›   rq  rE  rÊ   rx   rx   ry   rP    s   ÿz*Backend._evp_pkey_from_der_traditional_keyc                 C   s¾   |   |¡}| j |j| jj¡}|| jjkr#| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj¡}|| jjkrY| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rª   )rj  r‰   Úd2i_PUBKEY_biorr   r‡   r   rC  r`  r‹  r,  rH  r    Úd2i_RSAPublicKey_biorD  rG  rF   rJ  rK  rx   rx   ry   Úload_der_public_key  s    


ÿ
zBackend.load_der_public_keyc                 C   sº   |   |¡}| j |j| jj¡}|| jjkr#| j || jj¡}t| |ƒS | jj	rW|  
¡  | j |j¡}|  |dk¡ | j |j| jj¡}|| jjkrW| j || jj¡}t| |ƒS |  ¡  d S rª   )rj  r‰   Úd2i_DHparams_biorr   r‡   r   rC  rƒ  r&   r—   r,  rH  r    ÚCryptography_d2i_DHxparams_biorJ  )r›   rh  rL  rˆ  r±   rx   rx   ry   Úload_der_parameters+  s    


ÿ
zBackend.load_der_parametersc                 C   ób   |   |¡}| j |j| jj| jj| jj¡}|| jjkr#|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )Nz{Unable to load certificate. See https://cryptography.io/en/latest/faq.html#why-can-t-i-import-my-pem-file for more details.)rj  r‰   ÚPEM_read_bio_X509rr   r‡   r   r,  rì   rC  rò  rK   ©r›   rh  rL  r   rx   rx   ry   Úload_pem_x509_certificate?  ó   
ÿÿ
z!Backend.load_pem_x509_certificatec                 C   óV   |   |¡}| j |j| jj¡}|| jjkr|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load certificate)rj  r‰   Úd2i_X509_biorr   r‡   r   r,  rì   rC  rò  rK   r]  rx   rx   ry   Úload_der_x509_certificateO  ó   

z!Backend.load_der_x509_certificatec                 C   r[  )NzsUnable to load CRL. See https://cryptography.io/en/latest/faq.html#why-can-t-i-import-my-pem-file for more details.)rj  r‰   ÚPEM_read_bio_X509_CRLrr   r‡   r   r,  rì   rC  r  rL   ©r›   rh  rL  r  rx   rx   ry   Úload_pem_x509_crlY  r_  zBackend.load_pem_x509_crlc                 C   r`  )NzUnable to load CRL)rj  r‰   Úd2i_X509_CRL_biorr   r‡   r   r,  rì   rC  r  rL   re  rx   rx   ry   Úload_der_x509_crli  rc  zBackend.load_der_x509_crlc                 C   r[  )NzwUnable to load request. See https://cryptography.io/en/latest/faq.html#why-can-t-i-import-my-pem-file for more details.)rj  r‰   ÚPEM_read_bio_X509_REQrr   r‡   r   r,  rì   rC  rÓ  rM   ©r›   rh  rL  ré  rx   rx   ry   Úload_pem_x509_csrs  r_  zBackend.load_pem_x509_csrc                 C   r`  )NzUnable to load request)rj  r‰   Úd2i_X509_REQ_biorr   r‡   r   r,  rì   rC  rÓ  rM   rj  rx   rx   ry   Úload_der_x509_csrƒ  rc  zBackend.load_der_x509_csrc           	      C   s  |   |¡}| j d¡}|d ur#t d|¡ | j |¡}||_t|ƒ|_||j	| jj
| j | jjd¡|ƒ}|| jj
kra|jdkr]|  ¡  |jdkrLtdƒ‚|jdksSJ ‚td |jd	 ¡ƒ‚|  ¡  |  ¡  | j || jj¡}|d ur{|jdkr{td
ƒ‚|d ur„|jd	ksŠ|d u sŠJ ‚||ƒS )NzCRYPTOGRAPHY_PASSWORD_DATA *rE  ÚCryptography_pem_password_cbr   éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.rƒ   rS  )rj  r‡   r¼   r   Ú_check_bytesliker"  rE  r¾   r%  rr   r   rÉ  r‰   rÊ  Úerrorr,  rÀ  rì   rÒ   ÚmaxsizerJ  rC  r`  Úcalled)	r›   Úopenssl_read_funcÚconvert_funcrh  rE  rL  ÚuserdataÚpassword_ptrrK  rx   rx   ry   rC    sJ   

ÿú	

ÿþÿzBackend._load_keyc                    s’   ˆ   ¡ }|s
tdƒ‚|d  ˆ jjˆ jj¡s2|d  ˆ jjˆ jj¡s2ˆ jjr6|d  ˆ jj	ˆ jj
¡r6tdƒ‚t‡ fdd„|D ƒƒrEtdƒ‚tdƒ‚)Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3   s$    | ]}|  ˆ jjˆ jj¡V  qd S rÆ   )Ú_lib_reason_matchr‰   ÚERR_LIB_EVPÚ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)r-  rr  rš   rx   ry   Ú	<genexpr>Þ  s   € üþ
ÿz4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.)r,  rì   ry  r‰   rz  ÚEVP_R_BAD_DECRYPTÚERR_LIB_PKCS12Ú!PKCS12_R_PKCS12_CIPHERFINAL_ERRORÚCryptography_HAS_PROVIDERSÚERR_LIB_PROVÚPROV_R_BAD_DECRYPTÚany)r›   r   rx   rš   ry   rJ  Â  s:   ÿÿÿþü	÷
þöûÿz!Backend._handle_key_loading_errorc                 C   sp   z|   |¡}W n ty   | jj}Y nw | j |¡}|| jjkr'|  ¡  dS |  || jjk¡ | j 	|¡ dS )NFT)
Ú_elliptic_curve_to_nidr   r‰   r4  ÚEC_GROUP_new_by_curve_namer‡   r   r,  r    ÚEC_GROUP_free)r›   ÚcurveÚ	curve_nidÚgrouprx   rx   ry   Úelliptic_curve_supportedî  s   ÿz Backend.elliptic_curve_supportedc                 C   s   t |tjƒsdS |  |¡S rÛ   )rÜ   rT   ÚECDSArŠ  )r›   Úsignature_algorithmr‡  rx   rx   ry   Ú,elliptic_curve_signature_algorithm_supportedþ  s   
z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   sX   |   |¡r"|  |¡}| j |¡}|  |dk¡ |  |¡}t| ||ƒS td |j	¡t
jƒ‚)z@
        Generate a new private key on the named curve.
        rƒ   z#Backend object does not support {}.)rŠ  Ú_ec_key_new_by_curver‰   ÚEC_KEY_generate_keyr    Ú_ec_cdata_to_evp_pkeyr-   r   rÒ   rÑ   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)r›   r‡  r‡  r±   rK  rx   rx   ry   Ú#generate_elliptic_curve_private_key  s   



þz+Backend.generate_elliptic_curve_private_keyc                 C   sp   |j }|  |j¡}| j |  |j¡| jj¡}| j 	||¡}|  
|dk¡ |  ||j|j¡}|  |¡}t| ||ƒS rª   )rV  rŽ  r‡  r‡   rC  r@  Úprivate_valuer‰   ÚBN_clear_freeÚEC_KEY_set_private_keyr    Ú)_ec_key_set_public_key_affine_coordinatesr¯  r®  r  r-   )r›   r[  Úpublicr‡  r“  r±   rK  rx   rx   ry   Ú#load_elliptic_curve_private_numbers  s   ÿ
ÿ
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |   |j¡}|  ||j|j¡}|  |¡}t| ||ƒS rÆ   )rŽ  r‡  r–  r¯  r®  r  r.   )r›   r[  r‡  rK  rx   rx   ry   Ú"load_elliptic_curve_public_numbers.  s   
ÿ
z*Backend.load_elliptic_curve_public_numbersc           	      C   sâ   |   |¡}| j |¡}|  || jjk¡ | j |¡}|  || jjk¡ | j || jj¡}|  	¡  }| j 
|||t|ƒ|¡}|dkrI|  ¡  tdƒ‚W d   ƒ n1 sSw   Y  | j ||¡}|  |dk¡ |  |¡}t| ||ƒS )Nrƒ   z(Invalid public bytes for the given curve)rŽ  r‰   ÚEC_KEY_get0_groupr    r‡   r   ÚEC_POINT_newrC  ÚEC_POINT_freeÚ_tmp_bn_ctxÚEC_POINT_oct2pointr¾   r,  rì   ÚEC_KEY_set_public_keyr  r.   )	r›   r‡  Úpoint_bytesr‡  r‰  ÚpointÚbn_ctxr±   rK  rx   rx   ry   Ú load_elliptic_curve_public_bytes7  s&   

ÿþü
z(Backend.load_elliptic_curve_public_bytesc              	   C   sX  |   |¡}|  |¡\}}| j |¡}|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}|  ¡ 9}| j |||| jj| jj|¡}	|  |	dk¡ | j |¡}
| j |¡}||||
||ƒ}	|  |	dk¡ W d   ƒ n1 srw   Y  | j ||¡}	|  |	dk¡ |  	|¡}| j || jj
¡}| j ||¡}	|  |	dk¡ |  |¡}t| ||ƒS rª   )rŽ  Ú _ec_key_determine_group_get_funcr‰   r›  r    r‡   r   rC  rœ  r@  r”  r  ÚEC_POINT_mulÚ
BN_CTX_getrŸ  r•  r  r-   )r›   r“  r‡  r‡  Úget_funcr‰  r¡  r×  r¢  r±   Úbn_xÚbn_yÚprivaterK  rx   rx   ry   Ú!derive_elliptic_curve_private_keyK  s2   


ÿö

z)Backend.derive_elliptic_curve_private_keyc                 C   r£  rÆ   )r„  Ú_ec_key_new_by_curve_nid)r›   r‡  rˆ  rx   rx   ry   rŽ  n  r¥  zBackend._ec_key_new_by_curvec                 C   s0   | j  |¡}|  || jjk¡ | j || j j¡S rÆ   )r‰   ÚEC_KEY_new_by_curve_namer    r‡   r   rC  r  )r›   rˆ  r‡  rx   rx   ry   r¬  r  s   z Backend._ec_key_new_by_curve_nidc                 C   r`  )NzUnable to load OCSP request)rj  r‰   Úd2i_OCSP_REQUEST_biorr   r‡   r   r,  rì   rC  ÚOCSP_REQUEST_freerA   )r›   rh  rL  Úrequestrx   rx   ry   Úload_der_ocsp_requestw  rc  zBackend.load_der_ocsp_requestc                 C   r`  )NzUnable to load OCSP response)rj  r‰   Úd2i_OCSP_RESPONSE_biorr   r‡   r   r,  rì   rC  ÚOCSP_RESPONSE_freerB   )r›   rh  rL  Úresponserx   rx   ry   Úload_der_ocsp_response  rc  zBackend.load_der_ocsp_responsec           	      C   s°   | j  ¡ }|  || jjk¡ | j || j j¡}|j\}}}|  |¡}| j  	||j
|j
¡}|  || jjk¡ | j  ||¡}|  || jjk¡ | j|j| j|| j jdd t| |ƒS )NTrË  )r‰   ÚOCSP_REQUEST_newr    r‡   r   rC  r¯  Ú_requestrÚ   ÚOCSP_cert_to_idÚ_x509ÚOCSP_request_add0_idrÞ  rß  r  ÚOCSP_REQUEST_add_extrA   )	r›   rè  Úocsp_reqÚcertÚissuerrË   r×   ÚcertidÚonereqrx   rx   ry   Úcreate_ocsp_request‹  s"   

û
zBackend.create_ocsp_requestc              	   C   sì  |   ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j	j
¡}| j ||j	jj|j	jj¡}|  || jjk¡ | j || jj¡}|j	jd u rMd}nt|j	j }|j	jd u r^| jj}n|  |j	j¡}| jj}	|j	jd urv|  |j	j¡}	|  |j	j¡}
| j |||j	jj|||
|	¡}|  || jjk¡ |  ||¡}|j\}}| jj}|tjju r°|| jjO }|j d urÊ|j D ]}| j !||j¡}|  |dk¡ q¸| j"|j#| j$|| jj%dd | j &||j|j'|| jj|¡}|dkrô|  (¡ }t)d|ƒ‚|S )Nro  rƒ   TrË  zAError while signing. responder_cert must be signed by private_key)*rÅ  r‰   ÚOCSP_BASICRESP_newr    r‡   r   rC  ÚOCSP_BASICRESP_freerÚ   Ú	_responser”  r¸  Ú_certr¹  Ú_issuerÚOCSP_CERTID_freeÚ_revocation_reasonr   Ú_revocation_timer  r  Ú_this_updateÚOCSP_basic_add1_statusÚ_cert_statusr×  rÑ  Ú_responder_idÚOCSP_NOCERTSrp   ÚOCSPResponderEncodingÚHASHÚOCSP_RESPID_KEYÚ_certsÚOCSP_basic_add1_certrÞ  rß  r  ÚOCSP_BASICRESP_add_extÚOCSP_basic_signrÜ  r-  rì   )r›   rè  rÄ  rË   Úbasicr×   r¿  ÚreasonÚrev_timer   Úthis_updater±   Úresponder_certÚresponder_encodingÚflagsr½  r   rx   rx   ry   Ú_create_ocsp_basic_responsež  sŽ   
ÿýÿ
ÿÿù	


ûúýz#Backend._create_ocsp_basic_responsec                 C   sb   |t jju r|  |||¡}n| jj}| j |j|¡}|  	|| jjk¡ | j 
|| jj¡}t| |ƒS rÆ   )rp   ÚOCSPResponseStatusÚ
SUCCESSFULrÝ  r‡   r   r‰   ÚOCSP_response_creater×  r    rC  r³  rB   )r›   Úresponse_statusrè  rÄ  rË   rÖ  Ú	ocsp_resprx   rx   ry   Úcreate_ocsp_responseó  s   ÿÿ
zBackend.create_ocsp_responsec                 C   s   |   |¡o
t|tjƒS rÆ   )rŠ  rÜ   rT   ÚECDH)r›   rË   r‡  rx   rx   ry   Ú+elliptic_curve_exchange_algorithm_supported  s   ÿz3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   rc  rª   )rb  r‰   ÚEVP_PKEY_set1_EC_KEYr    )r›   r‡  rK  r±   rx   rx   ry   r  	  re  zBackend._ec_cdata_to_evp_pkeyc                 C   sN   dddœ}|  |j|j¡}| j | ¡ ¡}|| jjkr%td |j¡tj	ƒ‚|S )z/
        Get the NID for a curve name.
        Ú
prime192v1Ú
prime256v1)Ú	secp192r1Ú	secp256r1z${} is not a supported elliptic curve)
ÚgetrÑ   r‰   Ú
OBJ_sn2nidrÔ   r4  r   rÒ   r   r‘  )r›   r‡  Úcurve_aliasesÚ
curve_namerˆ  rx   rx   ry   r„    s   

þzBackend._elliptic_curve_to_nidc              	   c   sd    | j  ¡ }|  || jjk¡ | j || j j¡}| j  |¡ z|V  W | j  |¡ d S | j  |¡ w rÆ   )	r‰   Ú
BN_CTX_newr    r‡   r   rC  ÚBN_CTX_freeÚBN_CTX_startÚ
BN_CTX_end)r›   r¢  rx   rx   ry   r     s   €
zBackend._tmp_bn_ctxc                 C   s¼   |   || jjk¡ | j d¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ ||krR| jj	rR| jj
}n| jj}|sZJ ‚||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r    r‡   r   r‰   rì  r4  rš  ÚEC_GROUP_method_ofÚEC_METHOD_get_field_typeÚCryptography_HAS_EC2MÚ$EC_POINT_get_affine_coordinates_GF2mÚ#EC_POINT_get_affine_coordinates_GFp)r›   r›  Únid_two_fieldr‰  Úmethodr8  r§  rx   rx   ry   r¤  +  s   
z(Backend._ec_key_determine_group_get_funcc                 C   st   |dk s|dk rt dƒ‚| j |  |¡| jj¡}| j |  |¡| jj¡}| j |||¡}|dkr8|  ¡  t dƒ‚|S )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.rƒ   zInvalid EC key.)rì   r‡   rC  r@  r‰   rE  Ú(EC_KEY_set_public_key_affine_coordinatesr,  )r›   r›  r¯  r®  r±   rx   rx   ry   r–  G  s   ÿz1Backend._ec_key_set_public_key_affine_coordinatesc           
      C   s  t |tjƒs
tdƒ‚t |tjƒstdƒ‚t |tjƒstdƒ‚t |tjƒr'd}nt |tjƒr;|j}t	|ƒdkr:t
dƒ‚nt
dƒ‚|tjju rf|tjju rP| jj}n|tjju r[| jj}nt
dƒ‚|  |||¡S |tjju rì| jryt |tjƒsyt
d	ƒ‚| j |¡}	|tjju r±|	| jjkr| jj}n|	| jjkr›| jj}n|	| jjkr¦| jj}nt
d
ƒ‚|  |||¡S |tjju rè|r½t
dƒ‚|	| jjkrÈ| jj}n|	| jjkrÓ| jj}n|	| jjkrÞ| jj}nt
d
ƒ‚|  ||¡S t
dƒ‚|tjju r|tjju rÿt  !||¡S t
dƒ‚t
dƒ‚)Nú/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instanceó    iÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingúformat is invalid with this key)"rÜ   rQ   ÚEncodingrÀ  ÚPrivateFormatÚKeySerializationEncryptionÚNoEncryptionÚBestAvailableEncryptionrE  r¾   rì   ÚPKCS8ÚPEMr‰   ÚPEM_write_bio_PKCS8PrivateKeyÚDERÚi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioÚTraditionalOpenSSLr‹   ry  rz  ÚPEM_write_bio_RSAPrivateKeyr|  ÚPEM_write_bio_DSAPrivateKeyr  ÚPEM_write_bio_ECPrivateKeyÚi2d_RSAPrivateKey_bioÚi2d_ECPrivateKey_bioÚi2d_DSAPrivateKey_bioÚ_bio_func_outputÚOpenSSHro   Úserialize_ssh_private_key)
r›   ÚencodingrÒ   Úencryption_algorithmrÊ   rK  ÚcdatarE  Ú	write_bior…  rx   rx   ry   Ú_private_key_bytes[  sš   ÿÿÿÿÿÿ

ÿÿÿ


ÿÿÿ


ÿÿzBackend._private_key_bytesc              	   C   s<   |s| j j}n| j d¡}|  ||||t|ƒ| j j| j j¡S )Ns   aes-256-cbc)r‡   r   r‰   ÚEVP_get_cipherbynamer  r¾   )r›   r  rK  rE  rê   rx   rx   ry   r  Ä  s   
ùz"Backend._private_key_bytes_via_bioc                 G   s0   |   ¡ }||g|¢R Ž }|  |dk¡ |  |¡S rª   )rn  r    rr  )r›   r  Úargsrr   r±   rx   rx   ry   r  Õ  s   
zBackend._bio_func_outputc                 C   s  t |tjƒs
tdƒ‚t |tjƒstdƒ‚|tjju r:|tjju r%| jj}n|tjj	u r0| jj
}ntdƒ‚|  ||¡S |tjju rp| j |¡}|| jjkrPtdƒ‚|tjju r[| jj}n|tjj	u rf| jj}ntdƒ‚|  ||¡S |tjju r…|tjju rt |¡S tdƒ‚tdƒ‚)Nrû  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingrý  )rÜ   rQ   rþ  rÀ  ÚPublicFormatÚSubjectPublicKeyInfor  r‰   ÚPEM_write_bio_PUBKEYr  Úi2d_PUBKEY_biorì   r  ÚPKCS1ry  rz  ÚPEM_write_bio_RSAPublicKeyÚi2d_RSAPublicKey_bior  ro   Úserialize_ssh_public_key)r›   r  rÒ   rÊ   rK  r  r  r…  rx   rx   ry   Ú_public_key_bytesÛ  s@   ÿ

ÿ


ÿzBackend._public_key_bytesc                 C   sÌ   |t jju r
tdƒ‚| j d¡}| j || jj|| jj¡ |t jj	u r5|d | jjkr0| jj
}n!| jj}n|t jju rM|d | jjkrH| jj}n	| jj}ntdƒ‚|  ¡ }|||ƒ}|  |dk¡ |  |¡S )Nz!OpenSSH encoding is not supportedz	BIGNUM **r   rû  rƒ   )rQ   rþ  r  rÀ  r‡   r¼   r‰   ÚDH_get0_pqgr   r  ÚPEM_write_bio_DHxparamsÚPEM_write_bio_DHparamsr  ÚCryptography_i2d_DHxparams_bioÚi2d_DHparams_biorn  r    rr  )r›   r  rÒ   r  rQ  r  rr   r±   rx   rx   ry   Ú_parameter_bytes  s"   





zBackend._parameter_bytesc                 C   s†   |t jk rtd t j¡ƒ‚|dvrtdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}| j |||| jj¡}|  |dk¡ t| |ƒS )Nz$DH key_size must be at least {} bits)é   é   zDH generator must be 2 or 5rƒ   )rR   Ú_MIN_MODULUS_SIZErì   rÒ   r‰   ÚDH_newr    r‡   r   rC  rƒ  ÚDH_generate_parameters_exr&   )r›   Ú	generatorrI  Údh_param_cdatar±   rx   rx   ry   Úgenerate_dh_parameters$  s    
ÿÿ
ÿ
zBackend.generate_dh_parametersc                 C   rc  rª   )rb  r‰   ÚEVP_PKEY_set1_DHr    )r›   rˆ  rK  r±   rx   rx   ry   Ú_dh_cdata_to_evp_pkey:  re  zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| ƒ}| j |¡}|  |dk¡ |  |¡}t| ||ƒS rª   )r)   Ú	_dh_cdatar‰   ÚDH_generate_keyr    r2  r'   )r›   r¡  Údh_key_cdatar±   rK  rx   rx   ry   Úgenerate_dh_private_key@  s
   
zBackend.generate_dh_private_keyc                 C   s   |   |  ||¡¡S rÆ   )r6  r0  )r›   r.  rI  rx   rx   ry   Ú&generate_dh_private_key_and_parametersJ  s   
ÿz.Backend.generate_dh_private_key_and_parametersc                 C   s8  |j j}| j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|jd ur3|  	|j¡}n| jj}|  	|j j¡}|  	|j¡}| j ||||¡}	|  |	dk¡ | j |||¡}	|  |	dk¡ | j dd¡}
| j ||
¡}	|  |	dk¡ |
d dkr‘|jdkr|
d | jjA dks‘tdƒ‚|  |¡}t| ||ƒS )Nrƒ   úint[]r   r)  z.DH private numbers did not pass safety checks.)rV  r­  r‰   r,  r    r‡   r   rC  rƒ  r@  rP  r¨  rQ  r®  r¯  ÚDH_set0_pqgÚDH_set0_keyr¼   ÚCryptography_DH_checkÚDH_NOT_SUITABLE_GENERATORrì   r2  r'   )r›   r[  r­  rˆ  rP  r¨  rQ  r©  rª  r±   ÚcodesrK  rx   rx   ry   Úload_dh_private_numbersO  s0   




zBackend.load_dh_private_numbersc           
      C   sÐ   | j  ¡ }|  || jjk¡ | j || j j¡}|j}|  |j	¡}|  |j
¡}|jd ur2|  |j¡}n| jj}|  |j¡}| j  ||||¡}|  |dk¡ | j  ||| jj¡}|  |dk¡ |  |¡}	t| ||	ƒS rª   )r‰   r,  r    r‡   r   rC  rƒ  r­  r@  rP  r¨  rQ  r®  r9  r:  r2  r(   )
r›   r[  rˆ  r­  rP  r¨  rQ  r©  r±   rK  rx   rx   ry   Úload_dh_public_numbers}  s    


zBackend.load_dh_public_numbersc                 C   s   | j  ¡ }|  || jjk¡ | j || j j¡}|  |j¡}|  |j	¡}|j
d ur/|  |j
¡}n| jj}| j  ||||¡}|  |dk¡ t| |ƒS rª   )r‰   r,  r    r‡   r   rC  rƒ  r@  rP  r¨  rQ  r9  r&   )r›   r[  rˆ  rP  r¨  rQ  r±   rx   rx   ry   Úload_dh_parameter_numbers˜  s   


z!Backend.load_dh_parameter_numbersc                 C   s´   | j  ¡ }|  || jjk¡ | j || j j¡}|  |¡}|  |¡}|d ur+|  |¡}n| jj}| j  ||||¡}|  |dk¡ | j 	dd¡}| j  
||¡}|  |dk¡ |d dkS )Nrƒ   r8  r   )r‰   r,  r    r‡   r   rC  rƒ  r@  r9  r¼   r;  )r›   rP  r¨  rQ  rˆ  r±   r=  rx   rx   ry   Údh_parameters_supportedª  s   


zBackend.dh_parameters_supportedc                 C   s   | j jdkS rª   )r‰   r—   rš   rx   rx   ry   Údh_x942_serialization_supportedÀ  rÍ   z'Backend.dh_x942_serialization_supportedc                    sx   t ˆ |ƒ}ˆ j d¡}ˆ j ||¡}ˆ  |d ˆ jjk¡ ˆ j |‡ fdd„¡}ˆ  |dk¡ ˆ j |d |¡d d … S )Nzunsigned char **r   c                    s   ˆ j  | d ¡S r£   )r‰   ÚOPENSSL_free)Úpointerrš   rx   ry   r¤   É  s    z)Backend.x509_name_bytes.<locals>.<lambda>)	r;   r‡   r¼   r‰   Úi2d_X509_NAMEr    r   rC  r$  )r›   rÑ   Ú	x509_nameÚppr±   rx   rš   ry   Úx509_name_bytesÃ  s   
ÿzBackend.x509_name_bytesc                 C   sh   t |ƒdkr
tdƒ‚|  ¡ }| j || jj¡}|  |dk¡ | j ||t |ƒ¡}|  |dk¡ t| |ƒS )Né    z%An X25519 public key is 32 bytes longrƒ   )	r¾   rì   rb  r‰   ÚEVP_PKEY_set_typeÚ
NID_X25519r    ÚEVP_PKEY_set1_tls_encodedpointrH   )r›   rh  rK  r±   rx   rx   ry   Úx25519_load_public_bytesÎ  s   
ÿ
z Backend.x25519_load_public_bytesc                 C   sÀ   t |ƒdkr
tdƒ‚d}|  d¡#}||dd…< ||dd …< |  |¡}| j |j| jj¡}W d   ƒ n1 s7w   Y  |  	|| jjk¡ | j 
|| jj¡}|  	| j |¡| jjk¡ t| |ƒS )NrI  z&An X25519 private key is 32 bytes longs   0. 0+en" é0   r   é   )r¾   rì   Ú_zeroed_bytearrayrj  r‰   rT  rr   r‡   r   r    rC  r`  ry  rv  rG   )r›   rh  Úpkcs8_prefixÚbarr   rK  rx   rx   ry   Úx25519_load_private_bytesÝ  s   
üÿ
z!Backend.x25519_load_private_bytesc                 C   s¨   | j  || jj¡}|  || jjk¡ | j || j j¡}| j  |¡}|  |dk¡ | j d¡}| j  	||¡}|  |dk¡ |  |d | jjk¡ | j |d | j j
¡}|S )Nrƒ   úEVP_PKEY **r   )r‰   ÚEVP_PKEY_CTX_new_idr‡   r   r    rC  ÚEVP_PKEY_CTX_freeÚEVP_PKEY_keygen_initr¼   ÚEVP_PKEY_keygenr`  )r›   r8  Úevp_pkey_ctxr±   Ú	evp_ppkeyrK  rx   rx   ry   Ú_evp_pkey_keygen_gcÿ  s   zBackend._evp_pkey_keygen_gcc                 C   ó   |   | jj¡}t| |ƒS rÆ   )r[  r‰   rK  rG   ra  rx   rx   ry   Úx25519_generate_key	  ó   
zBackend.x25519_generate_keyc                 C   ó   | j rdS | jj S rÛ   )r‹   r‰   ÚCRYPTOGRAPHY_IS_LIBRESSLrš   rx   rx   ry   Úx25519_supported	  ó   
zBackend.x25519_supportedc                 C   s`   t |ƒdkr
tdƒ‚| j | jj| jj|t |ƒ¡}|  || jjk¡ | j || jj	¡}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)r¾   rì   r‰   ÚEVP_PKEY_new_raw_public_keyÚNID_X448r‡   r   r    rC  r`  rJ   ©r›   rh  rK  rx   rx   ry   Úx448_load_public_bytes	  s   ÿ
zBackend.x448_load_public_bytesc                 C   sl   t |ƒdkr
tdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}|  || jjk¡ | j 	|| jj
¡}t| |ƒS )Nrc  z$An X448 private key is 56 bytes long)r¾   rì   r‡   r"  r‰   ÚEVP_PKEY_new_raw_private_keyre  r   r    rC  r`  rI   ©r›   rh  ri  rK  rx   rx   ry   Úx448_load_private_bytes 	  s   ÿ
zBackend.x448_load_private_bytesc                 C   r\  rÆ   )r[  r‰   re  rI   ra  rx   rx   ry   Úx448_generate_key,	  r^  zBackend.x448_generate_keyc                 C   r_  rÛ   )r‹   r‰   Ú"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111rš   rx   rx   ry   Úx448_supported0	  rb  zBackend.x448_supportedc                 C   r_  rÛ   ©r‹   r‰   Ú#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Brš   rx   rx   ry   Úed25519_supported5	  rb  zBackend.ed25519_supportedc                 C   sn   t  d|¡ t|ƒtjkrtdƒ‚| j | jj| j	j
|t|ƒ¡}|  || j	j
k¡ | j	 || jj¡}t| |ƒS )Nrh  z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesr¾   rU   Ú_ED25519_KEY_SIZErì   r‰   rd  ÚNID_ED25519r‡   r   r    rC  r`  r0   rf  rx   rx   ry   Úed25519_load_public_bytes:	  s   ÿ
z!Backend.ed25519_load_public_bytesc                 C   sz   t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j 	| jj
| jj|t |ƒ¡}|  || jjk¡ | j || jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longrh  )r¾   rU   rr  rì   r   rq  r‡   r"  r‰   rh  rs  r   r    rC  r`  r/   ri  rx   rx   ry   Úed25519_load_private_bytesH	  s   ÿ
z"Backend.ed25519_load_private_bytesc                 C   r\  rÆ   )r[  r‰   rs  r/   ra  rx   rx   ry   Úed25519_generate_keyV	  r^  zBackend.ed25519_generate_keyc                 C   r_  rÛ   rn  rš   rx   rx   ry   Úed448_supportedZ	  rb  zBackend.ed448_supportedc                 C   sl   t  d|¡ t|ƒtkrtdƒ‚| j | jj| jj	|t|ƒ¡}|  
|| jj	k¡ | j || jj¡}t| |ƒS )Nrh  z$An Ed448 public key is 57 bytes long)r   rq  r¾   r1   rì   r‰   rd  Ú	NID_ED448r‡   r   r    rC  r`  r3   rf  rx   rx   ry   Úed448_load_public_bytes_	  s   ÿ
zBackend.ed448_load_public_bytesc                 C   sx   t  d|¡ t|ƒtkrtdƒ‚| j |¡}| j | jj	| jj
|t|ƒ¡}|  || jj
k¡ | j || jj¡}t| |ƒS )Nrh  z%An Ed448 private key is 57 bytes long)r   rq  r¾   r1   rì   r‡   r"  r‰   rh  rx  r   r    rC  r`  r2   ri  rx   rx   ry   Úed448_load_private_bytesl	  s   ÿ
z Backend.ed448_load_private_bytesc                 C   r\  rÆ   )r[  r‰   rx  r2   ra  rx   rx   ry   Úed448_generate_keyz	  r^  zBackend.ed448_generate_keyc                 C   s†   | j  d|¡}| j  |¡}| j |t|ƒ|t|ƒ|||tj||¡
}	|	dkr9|  ¡ }
d| | d }t	d 
|¡|
ƒ‚| j  |¡d d … S )Nr!  rƒ   é€   i   zJNot enough memory to derive key. These parameters require {} MB of memory.)r‡   r¼   r"  r‰   ÚEVP_PBE_scryptr¾   rm   Ú
_MEM_LIMITr-  ÚMemoryErrorrÒ   r$  )r›   r(  r&  r%  rW  ÚrrP  rÁ   r)  r±   r   Ú
min_memoryrx   rx   ry   Úderive_scrypt~	  s.   öýzBackend.derive_scryptc                 C   s2   t  |¡}| jr|| jvrdS | j |¡| jjkS rÛ   )r   Ú_aead_cipher_namer‹   Ú
_fips_aeadr‰   r  r‡   r   )r›   rè   Úcipher_namerx   rx   ry   Úaead_cipher_supported™	  s   
zBackend.aead_cipher_supportedc              
   c   s2    t |ƒ}z|V  W |  ||¡ dS |  ||¡ w )zÁ
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)Ú	bytearrayÚ
_zero_data)r›   r%  rR  rx   rx   ry   rP  Ÿ	  s
   €zBackend._zeroed_bytearrayc                 C   s   t |ƒD ]}d||< qd S r£   )Úrange)r›   rh  r%  r&  rx   rx   ry   rˆ  ¬	  s   
ÿzBackend._zero_datac                 c   s~    |du r| j jV  dS t|ƒ}| j  d|d ¡}| j  |||¡ z|V  W |  | j  d|¡|¡ dS |  | j  d|¡|¡ w )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr¹   rƒ   z	uint8_t *)r‡   r   r¾   r¼   Úmemmoverˆ  Úcast)r›   rh  Údata_lenrÁ   rx   rx   ry   Ú_zeroed_null_terminated_buf³	  s   €2z#Backend._zeroed_null_terminated_bufc                 C   sð  |d ur
t  d|¡ |  |¡}| j |j| jj¡}|| jjkr'|  ¡  t	dƒ‚| j 
|| jj¡}| j d¡}| j d¡}| j d¡}|  |¡}| j |||||¡}	W d   ƒ n1 s\w   Y  |	dkrm|  ¡  t	dƒ‚d }
d }g }|d | jjkr‹| j 
|d | jj¡}|  |¡}|d | jjkr£| j 
|d | jj¡}t| |ƒ}
|d | jjkró| j 
|d | jj¡}| j |d ¡}| jjrÇt|ƒ}ntt|ƒƒ}|D ]#}| j ||¡}|  || jjk¡ | j 
|| jj¡}| t| |ƒ¡ qÏ||
|fS )NrE  z!Could not deserialize PKCS12 datarT  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data)r   rq  rj  r‰   Úd2i_PKCS12_biorr   r‡   r   r,  rì   rC  ÚPKCS12_freer¼   r  ÚPKCS12_parser`  r‰  rò  rK   Úsk_X509_freeÚsk_X509_numÚ#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr‰  ÚreversedÚsk_X509_valuer    r˜   )r›   rh  rE  rr   Úp12Úevp_pkey_ptrÚx509_ptrÚsk_x509_ptrÚpassword_bufr±   r½  rÊ   Úadditional_certificatesrK  r   Úsk_x509r=  Úindicesr&  rx   rx   ry   Ú%load_key_and_certificates_from_pkcs12Ê	  sP   

ÿÿ



z-Backend.load_key_and_certificates_from_pkcs12c                 C   s¬  d }|d urt  d|¡ t|tjƒrd}d}d}	d}
nt|tjƒr1| jj}| jj}d}	d}
|j}nt	dƒ‚|d u s?t
|ƒdkrD| jj}n"| j ¡ }| j || jj¡}|D ]}| j ||j¡}t |dk¡ qT|  |¡:}|  |¡%}| j |||r||jn| jj|r„|jn| jj||||	|
d¡
}W d   ƒ n1 s™w   Y  W d   ƒ n1 s¨w   Y  |  || jjk¡ | j || jj¡}|  ¡ }| j ||¡}|  |dk¡ |  |¡S )NrÑ   ro  r   i N  rƒ   zUnsupported key encryption type)r   rq  rÜ   rQ   r  r  r‰   Ú&NID_pbe_WithSHA1And3_Key_TripleDES_CBCrE  rì   r¾   r‡   r   Úsk_X509_new_nullrC  r‘  Úsk_X509_pushr¹  Úbackendr    r  ÚPKCS12_createrÜ  r  rn  Úi2d_PKCS12_biorr  )r›   rÑ   rÊ   r½  Úcasr  rE  Únid_certÚnid_keyÚpkcs12_iterÚmac_iterrœ  Úcar±   rš  Úname_bufr–  rr   rx   rx   ry   Ú(serialize_key_and_certificates_to_pkcs12
  s^   ÿ

öÿ€ÿ
z0Backend.serialize_key_and_certificates_to_pkcs12c                 C   s   | j rdS | jjdkS )NFrƒ   )r‹   r‰   ÚCryptography_HAS_POLY1305rš   rx   rx   ry   Úpoly1305_supported?
  s   zBackend.poly1305_supportedc                 C   s*   t  d|¡ t|ƒtkrtdƒ‚t| |ƒS )NrÊ   zA poly1305 key is 32 bytes long)r   rq  r¾   rC   rì   rD   )r›   rÊ   rx   rx   ry   Úcreate_poly1305_ctxD
  s   
zBackend.create_poly1305_ctxc                 C   sn   t  d|¡ |  |¡}| j |j| jj| jj| jj¡}|| jjkr)|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S ©Nrh  zUnable to parse PKCS7 data)r   rq  rj  r‰   ÚPEM_read_bio_PKCS7rr   r‡   r   r,  rì   rC  Ú
PKCS7_freeÚ_load_pkcs7_certificates©r›   rh  rr   Úp7rx   rx   ry   Úload_pem_pkcs7_certificatesK
  s   
ÿ
z#Backend.load_pem_pkcs7_certificatesc                 C   sb   t  d|¡ |  |¡}| j |j| jj¡}|| jjkr#|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S r°  )r   rq  rj  r‰   Úd2i_PKCS7_biorr   r‡   r   r,  rì   rC  r²  r³  r´  rx   rx   ry   Úload_der_pkcs7_certificatesX
  s   

z#Backend.load_der_pkcs7_certificatesc           	      C   sÚ   | j  |j¡}|  || j jk¡ || j jkrtd |¡tj	ƒ‚g }|j
j| jjkr+|S |j
jj}| j  |¡}t|ƒD ]0}| j  ||¡}|  || jjk¡ | j  |¡}|  |dk¡ | j || j j¡}| t| |ƒ¡ q:|S )NzNOnly basic signed structures are currently supported. NID for this data was {}rƒ   )r‰   ÚOBJ_obj2nidræ   r    r4  ÚNID_pkcs7_signedr   rÒ   r   ÚUNSUPPORTED_SERIALIZATIONrR  Úsignr‡   r   r½  r’  r‰  r•  ÚX509_up_refrC  rò  r˜   rK   )	r›   rµ  r8  Úcertsrœ  r=  r&  r   r±   rx   rx   ry   r³  c
  s*   ý
z Backend._load_pkcs7_certificatesc                 C   st  |   |j¡}| jj}d}t|jƒdkr| jj}n#| j ¡ }| j 	|| jj
¡}|jD ]}| j ||j¡}	|  |	dk¡ q)tjj|v rM|| jjO }|| jjO }| j | jj| jj|| jj|¡}
|  |
| jjk¡ | j 	|
| jj¡}
d}tjj|v r~|| jjO }ntjj|v rŠ|| jjO }tjj|v r–|| jjO }|jD ]\}}}|  |¡}| j |
|j|j||¡}|  || jjk¡ q™|D ]}|tjju rÊ|| jjO }q»|tjj u rÖ|| jj!O }q»|  "¡ }|t#j$j%u rì| j &||
|j'|¡}	nB|t#j$j(u r| j )|
|j'|¡}	|  |	dk¡ | j *||
|j'|¡}	n |t#j$j+u sJ ‚| j )|
|j'|¡}	|  |	dk¡ | j ,||
¡}	|  |	dk¡ |  -|¡S )Nr   rƒ   ).rj  Ú_datar‰   ÚPKCS7_PARTIALr¾   Ú_additional_certsr‡   r   r   rC  r‘  r¡  r¹  r    rn   ÚPKCS7OptionsÚDetachedSignatureÚPKCS7_DETACHEDÚ
PKCS7_signr²  ÚNoCapabilitiesÚPKCS7_NOSMIMECAPÚNoAttributesÚPKCS7_NOATTRÚNoCertsÚPKCS7_NOCERTSÚ_signersrÚ   ÚPKCS7_sign_add_signerrÜ  ÚTextÚ
PKCS7_TEXTÚBinaryÚPKCS7_BINARYrn  rQ   rþ  ÚSMIMEÚSMIME_write_PKCS7rr   r  ÚPKCS7_finalÚPEM_write_bio_PKCS7_streamr  Úi2d_PKCS7_biorr  )r›   rè  r  Úoptionsrr   Ú
init_flagsÚfinal_flagsr¾  r½  r±   rµ  Úsigner_flagsÚcertificaterÄ  Úhash_algorithmÚmdÚp7signerinfoÚoptionÚbio_outrx   rx   ry   Ú
pkcs7_sign
  st   


û
ÿ€
ÿ
ÿ
zBackend.pkcs7_signrÆ   )¯ru   rv   rw   Ú__doc__rÑ   r„  r\   rd   rå   rP   r  rŽ  r  r  r‘  Ú
SHA512_224Ú
SHA512_256ÚSHA3_224ÚSHA3_256ÚSHA3_384ÚSHA3_512ÚSHAKE128ÚSHAKE256rÝ   Ú_fips_rsa_min_key_sizeÚ_fips_rsa_min_public_exponentÚ_fips_dsa_min_modulusÚ_fips_dh_min_key_sizeÚ_fips_dh_min_modulusrœ   r    rŠ   r²   Ú
contextlibr   r·   r”   rÂ   rÅ   rÈ   rÌ   rØ   rÚ   rÞ   râ   rä   rë   rï   r   rŽ   r   r  r  r   r*  r,  r-  r9  r@  rL  rN  r\  r^  rb  rG  rj  rn  rr  r‰  r‹  r’  r˜  rœ  r¢  r¤  r«  r°  r²  r³  r   rµ  r¶  r¹  rº  rÅ  rî  r  rÑ  rú  r  r#  rÞ  r,  r%  rB  rF  rM  rO  rR  rP  rW  rZ  r^  rb  rf  rh  rk  rm  rC  rJ  rŠ  r  r’  r˜  r™  r£  r«  rŽ  r¬  r±  rµ  rÁ  rÝ  rã  rå  r  r„  r  r¤  r–  r  r  r  r"  r(  r0  r2  r6  r7  r>  r?  r@  rA  rB  rH  rM  rS  r[  r]  ra  rg  rj  rk  rm  rp  rt  ru  rv  rw  ry  rz  r{  r‚  r†  rP  rˆ  r  rž  r¬  r®  r¯  r¶  r¸  r³  rá  rx   rx   rx   ry   rz   ¤   sX   ó
	
	-5 ++	HB	8"


5,		#

U

i0
."7>rz   c                   @   s   e Zd Zdd„ Zdd„ ZdS )ró   c                 C   s
   || _ d S rÆ   )Ú_fmt)r›   Úfmtrx   rx   ry   rœ   Ð
  rÉ   zGetCipherByName.__init__c                 C   s&   | j j||d ¡ }|j | d¡¡S )N)rè   r©   r»   )rñ  rÒ   Úlowerr‰   r  rÔ   )r›   r¢  rè   r©   r…  rx   rx   ry   Ú__call__Ó
  s   zGetCipherByName.__call__N)ru   rv   rw   rœ   rô  rx   rx   rx   ry   ró   Ï
  s    ró   c                 C   s"   d  |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsr)  r»   )rÒ   rI  r‰   r  rÔ   )r¢  rè   r©   r…  rx   rx   ry   rö   Ø
  s   rö   )Úcollectionsrð  rô   Útypingr‘   r   Úcryptographyr   r   Úcryptography.exceptionsr   r   Úcryptography.hazmat._derr   r   r	   r
   r   Ú'cryptography.hazmat.backends.interfacesr   r   r   r   r   r   r   r   r   r   r   r   r   Ú$cryptography.hazmat.backends.opensslr   Ú,cryptography.hazmat.backends.openssl.ciphersr   Ú)cryptography.hazmat.backends.openssl.cmacr   Ú0cryptography.hazmat.backends.openssl.decode_asn1r   r   r   r    r!   r"   r#   r$   r%   Ú'cryptography.hazmat.backends.openssl.dhr&   r'   r(   r)   Ú(cryptography.hazmat.backends.openssl.dsar*   r+   r,   Ú'cryptography.hazmat.backends.openssl.ecr-   r.   Ú,cryptography.hazmat.backends.openssl.ed25519r/   r0   Ú*cryptography.hazmat.backends.openssl.ed448r1   r2   r3   Ú0cryptography.hazmat.backends.openssl.encode_asn1r4   r5   r6   r7   r8   r9   r:   r;   r<   Ú+cryptography.hazmat.backends.openssl.hashesr>   Ú)cryptography.hazmat.backends.openssl.hmacr@   Ú)cryptography.hazmat.backends.openssl.ocsprA   rB   Ú-cryptography.hazmat.backends.openssl.poly1305rC   rD   Ú(cryptography.hazmat.backends.openssl.rsarE   rF   Ú+cryptography.hazmat.backends.openssl.x25519rG   rH   Ú)cryptography.hazmat.backends.openssl.x448rI   rJ   Ú)cryptography.hazmat.backends.openssl.x509rK   rL   rM   rN   Ú$cryptography.hazmat.bindings.opensslrO   Úcryptography.hazmat.primitivesrP   rQ   Ú)cryptography.hazmat.primitives.asymmetricrR   rS   rT   rU   rV   rW   Ú1cryptography.hazmat.primitives.asymmetric.paddingrX   rY   rZ   r[   Ú1cryptography.hazmat.primitives.ciphers.algorithmsr\   r]   r^   r_   r`   ra   rb   rc   rd   Ú,cryptography.hazmat.primitives.ciphers.modesre   rf   rg   rh   ri   rj   rk   rl   Ú"cryptography.hazmat.primitives.kdfrm   Ú,cryptography.hazmat.primitives.serializationrn   ro   Úcryptography.x509rp   Ú
namedtuplerq   Úobjectrt   Úregister_interfaceÚregister_interface_ifr„   rˆ   ÚCryptography_HAS_SCRYPTrz   ró   rö   r¢  rx   rx   rx   ry   Ú<module>   sœ   <,, ,(
ÿ*                    0	
