U
    çe¨]Ï{ ã                   @   sž  d dl mZmZmZ d dlZd dlZd dlZd dlZd dlmZ d dl	Z	d dl
mZ d dlmZmZ d dlmZmZ d dlmZmZmZmZmZ d dlmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z% d d	l&m'Z' d d
l(m)Z) d dl*m+Z+ d dl,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2 d dl3m4Z4m5Z5m6Z6 d dl7m8Z8m9Z9 d dl:m;Z;m<Z< d dl=m>Z>m?Z?m@Z@ d dlAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJ d dlKmLZL d dlMmNZN d dlOmPZPmQZQ d dlRmSZSmTZT d dlUmVZVmWZW d dlXmYZYmZZZ d dl[m\Z\m]Z] d dl^m_Z_m`Z`maZambZb d dlcmdZd d dlemfZfmgZg d dlhmiZimjZjmkZkmlZlmmZm d dlnmoZompZpmqZqmrZr d dlsmtZtmuZumvZvmwZwmxZxmyZymzZzm{Z{m|Z| d d l}m~Z~mZm€Z€mZm‚Z‚mƒZƒm„Z„m…Z… d d!l†m‡Z‡ d d"lˆm‰Z‰ d d#lŠm‹Z‹ e Œd$d%d&g¡Ze Že¡e Že¡e Že¡e Že¡e Že¡e Že¡e Že ¡e Že¡e Že!¡e Že#¡e Že"¡e Že%¡e ed ¡ j‘j’e$¡G d'd(„ d(e“ƒƒƒƒƒƒƒƒƒƒƒƒƒƒZ”G d)d*„ d*e“ƒZ•d+d,„ Z–e”ƒ Z—dS )-é    )Úabsolute_importÚdivisionÚprint_functionN)Úcontextmanager©Úrange)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)ÚINTEGERÚNULLÚSEQUENCEÚ
encode_derÚencode_der_integer)ÚCMACBackendÚCipherBackendÚDERSerializationBackendÚ	DHBackendÚ
DSABackendÚEllipticCurveBackendÚHMACBackendÚHashBackendÚPBKDF2HMACBackendÚPEMSerializationBackendÚ
RSABackendÚScryptBackendÚX509Backend)Úaead)Ú_CipherContext©Ú_CMACContext)Ú_CRL_ENTRY_REASON_ENUM_TO_CODE)Ú_DHParametersÚ_DHPrivateKeyÚ_DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey)	Ú$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERSÚ_CRL_EXTENSION_ENCODE_HANDLERSÚ_EXTENSION_ENCODE_HANDLERSÚ)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERSÚ'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERSÚ_encode_asn1_int_gcÚ_encode_asn1_str_gcÚ_encode_name_gcÚ_txt2obj_gc©Ú_HashContext©Ú_HMACContext)Ú_OCSPRequestÚ_OCSPResponse)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)Ú_CertificateÚ_CertificateRevocationListÚ_CertificateSigningRequestÚ_RevokedCertificate)Úbinding)ÚhashesÚserialization)ÚdsaÚecÚed25519Úed448Úrsa)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)	ÚAESÚARC4ÚBlowfishÚCAST5ÚCamelliaÚChaCha20ÚIDEAÚSEEDÚ	TripleDES)ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚOFBÚXTS)Úscrypt)Ússh)ÚocspÚ
_MemoryBIOÚbioZchar_ptrc                   @   sv  e Zd ZdZdZdd„ Zdd„ Zdd„ Zej	d	d
„ ƒZ
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#d$„ Zd%d&„ Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Zd/d0„ Zdd2d3„Zd4d5„ Zd6d7„ Z d8d9„ Z!d:d;„ Z"d<d=„ Z#d>d?„ Z$d@dA„ Z%dBdC„ Z&dDdE„ Z'dFdG„ Z(dHdI„ Z)dJdK„ Z*dLdM„ Z+dNdO„ Z,dPdQ„ Z-dRdS„ Z.dTdU„ Z/dVdW„ Z0dXdY„ Z1dZd[„ Z2d\d]„ Z3d^d_„ Z4d`da„ Z5dbdc„ Z6ddde„ Z7dfdg„ Z8dhdi„ Z9djdk„ Z:dldm„ Z;dndo„ Z<dpdq„ Z=drds„ Z>dtdu„ Z?dvdw„ Z@dxdy„ ZAdzd{„ ZBd|d}„ ZCd~d„ ZDd€d„ ZEd‚dƒ„ ZFd„d…„ ZGd†d‡„ ZHdˆd‰„ ZIdŠd‹„ ZJdŒd„ ZKdŽd„ ZLdd‘„ ZMd’d“„ ZNd”d•„ ZOd–d—„ ZPd˜d™„ ZQdšd›„ ZRdœd„ ZSdždŸ„ ZTd d¡„ ZUd¢d£„ ZVd¤d¥„ ZWd¦d§„ ZXd¨d©„ ZYdªd«„ ZZd¬d­„ Z[d®d¯„ Z\d°d±„ Z]d²d³„ Z^d´dµ„ Z_d¶d·„ Z`e	d¸d¹„ ƒZadºd»„ Zbd¼d½„ Zcd¾d¿„ ZddÀdÁ„ ZedÂdÃ„ ZfdÄdÅ„ ZgdÆdÇ„ ZhdÈdÉ„ ZidÊdË„ ZjdÌdÍ„ ZkdÎdÏ„ ZldÐdÑ„ ZmdÒdÓ„ ZndÔdÕ„ ZoddÖd×„ZpdØdÙ„ ZqdÚdÛ„ ZrdÜdÝ„ ZsdÞdß„ Ztdàdá„ Zudâdã„ Zvdädå„ Zwdædç„ Zxdèdé„ Zydêdë„ Zzdìdí„ Z{dîdï„ Z|dðdñ„ Z}dòdó„ Z~dôdõ„ Zdöd÷„ Z€dødù„ Zdúdû„ Z‚düdý„ Zƒdþdÿ„ Z„d d„ Z…ej	dd„ ƒZ†dd„ Z‡ej	dd„ ƒZˆdd	„ Z‰d
d„ ZŠdd„ Z‹d1S (  ÚBackendz)
    OpenSSL API binding interfaces.
    Zopensslc                 C   s\   t  ¡ | _| jj| _| jj| _i | _|  ¡  |  	¡  | jj
g| _| jjrX| j | jj¡ d S ©N)rL   ÚBindingZ_bindingZffiÚ_ffiÚlibÚ_libÚ_cipher_registryÚ_register_default_ciphersÚactivate_osrandom_engineZEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendZEVP_PKEY_DHX©Úself© r|   úN/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.pyÚ__init__v   s    


zBackend.__init__c                 C   s   t  | j|¡S ro   )rL   Z_openssl_assertrs   )r{   Úokr|   r|   r}   Úopenssl_assert‚   s    zBackend.openssl_assertc                 C   sf   | j jrb| j  ¡ }|| jjkrb| j  |¡ | j  | jj¡}|  |dk¡ | j  |¡}|  |dk¡ d S ©Né   )	rs   ÚCryptography_HAS_ENGINEZENGINE_get_default_RANDrq   r   ZENGINE_unregister_RANDÚRAND_set_rand_methodr€   ÚENGINE_finish©r{   ÚeÚresr|   r|   r}   Úactivate_builtin_random…   s    
zBackend.activate_builtin_randomc              
   c   s‚   | j  | j j¡}|  || jjk¡ | j  |¡}|  |dk¡ z
|V  W 5 | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ X d S r   )	rs   ZENGINE_by_idZCryptography_osrandom_engine_idr€   rq   r   ZENGINE_initZENGINE_freer…   r†   r|   r|   r}   Ú_get_osurandom_engine’   s    
zBackend._get_osurandom_enginec              	   C   s`   | j jr\|  ¡  |  ¡  }| j  |¡}|  |dk¡ W 5 Q R X | j  | jj¡}|  |dk¡ d S r   )	rs   rƒ   r‰   rŠ   ZENGINE_set_default_RANDr€   r„   rq   r   r†   r|   r|   r}   rv   ¦   s    
z Backend.activate_osrandom_enginec              	   C   s`   | j  dd¡}|  ¡ 2}| j |dt|ƒ|| j jd¡}|  |dk¡ W 5 Q R X | j  |¡ 	d¡S )Núchar[]é@   s   get_implementationr   Úascii)
rq   ÚnewrŠ   rs   ZENGINE_ctrl_cmdÚlenr   r€   ÚstringÚdecode)r{   Úbufr‡   rˆ   r|   r|   r}   Úosrandom_engine_implementation²   s    

  þz&Backend.osrandom_engine_implementationc                 C   s   | j  | j | jj¡¡ d¡S )z¿
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.0.1e 11 Feb 2013
        r   )rq   r   rs   ZOpenSSL_versionZOPENSSL_VERSIONr‘   rz   r|   r|   r}   Úopenssl_version_text»   s
    ÿþzBackend.openssl_version_textc                 C   s
   | j  ¡ S ro   )rs   ZOpenSSL_version_numrz   r|   r|   r}   Úopenssl_version_numberÆ   s    zBackend.openssl_version_numberc                 C   s   t | ||ƒS ro   r<   )r{   ÚkeyÚ	algorithmr|   r|   r}   Úcreate_hmac_ctxÉ   s    zBackend.create_hmac_ctxc                 C   sL   |j dks|j dkr0d |j |jd ¡ d¡}n|j  d¡}| j |¡}|S )NZblake2bZblake2sz{}{}é   r   )ÚnameÚformatZdigest_sizeÚencoders   ZEVP_get_digestbyname)r{   r—   ZalgÚevp_mdr|   r|   r}   Ú_evp_md_from_algorithmÌ   s     ÿþzBackend._evp_md_from_algorithmc                 C   s    |   |¡}|  || jjk¡ |S ro   )rž   r€   rq   r   ©r{   r—   r   r|   r|   r}   Ú_evp_md_non_null_from_algorithm×   s    
z'Backend._evp_md_non_null_from_algorithmc                 C   s   |   |¡}|| jjkS ro   )rž   rq   r   rŸ   r|   r|   r}   Úhash_supportedÜ   s    
zBackend.hash_supportedc                 C   s
   |   |¡S ro   ©r¡   ©r{   r—   r|   r|   r}   Úhmac_supportedà   s    zBackend.hmac_supportedc                 C   s
   t | |ƒS ro   r:   r£   r|   r|   r}   Úcreate_hash_ctxã   s    zBackend.create_hash_ctxc                 C   sJ   z| j t|ƒt|ƒf }W n tk
r0   Y dS X || ||ƒ}| jj|kS ©NF)rt   ÚtypeÚKeyErrorrq   r   )r{   ÚcipherÚmodeÚadapterÚ
evp_cipherr|   r|   r}   Úcipher_supportedæ   s    zBackend.cipher_supportedc                 C   s0   ||f| j krtd ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)rt   Ú
ValueErrorr›   )r{   Ú
cipher_clsÚmode_clsr«   r|   r|   r}   Úregister_cipher_adapterî   s     ÿzBackend.register_cipher_adapterc                 C   s@  t ttttttfD ]}|  t|t	dƒ¡ qt ttttfD ]}|  t
|t	dƒ¡ q8t tttfD ]}|  t|t	dƒ¡ q\|  ttt	dƒ¡ t tttfD ]}|  t|t	dƒ¡ q’t tttfD ]}|  t|t	dƒ¡ q¶t ttgt tttg¡D ]\}}|  ||t	dƒ¡ qæ|  ttd ƒt	dƒ¡ |  ttd ƒt	dƒ¡ |  ttt¡ d S )	Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zchacha20)ra   rd   re   rg   rb   rc   rf   r±   rX   ÚGetCipherByNamer\   r`   rZ   r_   Ú	itertoolsÚproductr[   r^   rY   r§   r]   rh   Ú_get_xts_cipher)r{   r°   r¯   r|   r|   r}   ru   õ   sn    ýýýýýý
þýýýz!Backend._register_default_ciphersc                 C   s   t | ||t jƒS ro   )r   Z_ENCRYPT©r{   r©   rª   r|   r|   r}   Úcreate_symmetric_encryption_ctx.  s    z'Backend.create_symmetric_encryption_ctxc                 C   s   t | ||t jƒS ro   )r   Z_DECRYPTr¶   r|   r|   r}   Úcreate_symmetric_decryption_ctx1  s    z'Backend.create_symmetric_decryption_ctxc                 C   s
   |   |¡S ro   )r¤   r£   r|   r|   r}   Úpbkdf2_hmac_supported4  s    zBackend.pbkdf2_hmac_supportedc           
   
   C   sh   | j  d|¡}|  |¡}| j  |¡}| j |t|ƒ|t|ƒ||||¡}	|  |	dk¡ | j  |¡d d … S )Núunsigned char[]r‚   )	rq   rŽ   r    Úfrom_bufferrs   ZPKCS5_PBKDF2_HMACr   r€   Úbuffer)
r{   r—   ÚlengthÚsaltZ
iterationsÚkey_materialr’   r   Úkey_material_ptrrˆ   r|   r|   r}   Úderive_pbkdf2_hmac7  s    
ø
zBackend.derive_pbkdf2_hmacc                 C   s   t  | j¡S ro   )rL   Ú_consume_errorsrs   rz   r|   r|   r}   rÂ   I  s    zBackend._consume_errorsc                 C   sÂ   || j jkst‚tjs~| j |¡}| j  d|¡}| j ||¡}|  	|dk¡ t
 | j  |¡d |… d¡}| j |¡rz| }|S | j |¡}|  	|| j jk¡ | j  |¡}| j |¡ t
|dƒS d S )Nrº   r   Úbigé   )rq   r   ÚAssertionErrorÚsixÚPY2rs   ZBN_num_bytesrŽ   Z	BN_bn2binr€   ÚintÚ
from_bytesr¼   ZBN_is_negativeZ	BN_bn2hexr   ÚOPENSSL_free)r{   ÚbnZbn_num_bytesZbin_ptrZbin_lenÚvalZ	hex_cdataZhex_strr|   r|   r}   Ú
_bn_to_intL  s    zBackend._bn_to_intNc                 C   sâ   |dks|| j jkst‚|dkr(| j j}tjst| t| ¡ d d ƒd¡}| j 	|t
|ƒ|¡}|  || j jk¡ |S t|ƒ d¡dd…  d¡}| j  d¡}||d	< | j ||¡}|  |d	k¡ |  |d	 | j jk¡ |d	 S dS )
a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @r‚   rÃ   ÚLé   r   ú	BIGNUM **r   )rq   r   rÅ   rÆ   rÇ   Úto_bytesrÈ   Ú
bit_lengthrs   Z	BN_bin2bnr   r€   ÚhexÚrstriprœ   rŽ   Z	BN_hex2bn)r{   ÚnumrË   ÚbinaryZbn_ptrZhex_numrˆ   r|   r|   r}   Ú
_int_to_bnb  s    zBackend._int_to_bnc                 C   s   t  ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS r   )rS   Z_verify_rsa_parametersrs   ÚRSA_newr€   rq   r   ÚgcÚRSA_freer×   ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyrB   )r{   Úpublic_exponentÚkey_sizeÚ	rsa_cdatarË   rˆ   Úevp_pkeyr|   r|   r}   Úgenerate_rsa_private_key  s    

   ÿ
z Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )Né   r‚   r   é   r|   )r{   rÝ   rÞ   r|   r|   r}   Ú!generate_rsa_parameters_supported“  s    ÿz)Backend.generate_rsa_parameters_supportedc              
   C   sR  t  |j|j|j|j|j|j|jj	|jj
¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |jj	¡}	|  |jj
¡}
| j |||¡}|  |dk¡ | j ||
|	|¡}|  |dk¡ | j ||||¡}|  |dk¡ | j || jj¡}|  |dk¡ |  |¡}t| ||ƒS r   )rS   Z_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersr‡   Únrs   rØ   r€   rq   r   rÙ   rÚ   r×   ZRSA_set0_factorsÚRSA_set0_keyZRSA_set0_crt_paramsZRSA_blinding_onrÜ   rB   )r{   Únumbersrß   rå   ræ   rç   rè   ré   rê   r‡   rì   rˆ   rà   r|   r|   r}   Úload_rsa_private_numbers—  s>    ø


z Backend.load_rsa_private_numbersc                 C   s   t  |j|j¡ | j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS r   )rS   Z_check_public_key_componentsr‡   rì   rs   rØ   r€   rq   r   rÙ   rÚ   r×   rí   rÜ   rC   )r{   rî   rß   r‡   rì   rˆ   rà   r|   r|   r}   Úload_rsa_public_numbers¹  s    

zBackend.load_rsa_public_numbersc                 C   s2   | j  ¡ }|  || jjk¡ | j || j j¡}|S ro   )rs   ZEVP_PKEY_newr€   rq   r   rÙ   ÚEVP_PKEY_free©r{   rà   r|   r|   r}   Ú_create_evp_pkey_gcÆ  s    
zBackend._create_evp_pkey_gcc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S r   )ró   rs   ZEVP_PKEY_set1_RSAr€   )r{   rß   rà   rˆ   r|   r|   r}   rÜ   Ì  s    zBackend._rsa_cdata_to_evp_pkeyc                 C   sH   | j  |¡}| j |t|ƒ¡}|  || j jk¡ t| j  || jj	¡|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rq   r»   rs   ZBIO_new_mem_bufr   r€   r   rl   rÙ   ÚBIO_free)r{   ÚdataÚdata_ptrrm   r|   r|   r}   Ú_bytes_to_bioÒ  s     ÿzBackend._bytes_to_bioc                 C   sP   | j  ¡ }|  || jjk¡ | j  |¡}|  || jjk¡ | j || j j¡}|S )z.
        Creates an empty memory BIO.
        )rs   Z	BIO_s_memr€   rq   r   ZBIO_newrÙ   rô   )r{   Z
bio_methodrm   r|   r|   r}   Ú_create_mem_bio_gcá  s    
zBackend._create_mem_bio_gcc                 C   s\   | j  d¡}| j ||¡}|  |dk¡ |  |d | j jk¡ | j  |d |¡dd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rq   rŽ   rs   ZBIO_get_mem_datar€   r   r¼   )r{   rm   r’   Zbuf_lenÚbio_datar|   r|   r}   Ú_read_mem_bioì  s    zBackend._read_mem_bioc                 C   s°  | j  |¡}|| j jkrT| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krœ| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrä| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jkr,| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrJt| |ƒS |t| j ddƒkrht| |ƒS |t| j ddƒkr†t| |ƒS |t| j ddƒkr¤t| |ƒS tdƒ‚dS )zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ÚEVP_PKEY_ED25519NÚEVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.)rs   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAr€   rq   r   rÙ   rÚ   rB   ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer(   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer*   rw   ÚEVP_PKEY_get1_DHÚDH_freer$   Úgetattrr,   rF   rD   r/   r
   ©r{   rà   Úkey_typerß   Ú	dsa_cdataÚec_cdataÚdh_cdatar|   r|   r}   Ú_evp_pkey_to_private_key÷  s<    



z Backend._evp_pkey_to_private_keyc                 C   s°  | j  |¡}|| j jkrT| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krœ| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrä| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jkr,| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrJt| |ƒS |t| j ddƒkrht| |ƒS |t| j ddƒkr†t| |ƒS |t| j ddƒkr¤t| |ƒS tdƒ‚dS )zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        rû   Nrü   rý   rþ   rÿ   )rs   r   r  r  r€   rq   r   rÙ   rÚ   rC   r  r  r  r)   r  r  r  r+   rw   r	  r
  r%   r  r-   rG   rE   r0   r
   r  r|   r|   r}   Ú_evp_pkey_to_public_key"  s<    



zBackend._evp_pkey_to_public_keyc                 C   s6   | j jr&t|tjtjtjtjtjfƒS t|tjƒS d S ro   )	rs   ZCryptography_HAS_RSA_OAEP_MDÚ
isinstancerM   ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512r£   r|   r|   r}   Ú_oaep_hash_supportedM  s    ûÿ
zBackend._oaep_hash_supportedc                 C   sŽ   t |tƒrdS t |tƒr2t |jtƒr2|  |jj¡S t |tƒr†t |jtƒr†|  |jj¡o„|  |j¡o„|j	d kp„t
|j	ƒdkp„| jjdkS dS d S )NTr   r‚   F)r  rV   rW   Z_mgfrT   r¡   Ú
_algorithmrU   r  Z_labelr   rs   ZCryptography_HAS_RSA_OAEP_LABEL)r{   Zpaddingr|   r|   r}   Úrsa_padding_supported[  s    

ÿ
û	zBackend.rsa_padding_supportedc              	   C   s~   |dkrt dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}|  |dk¡ t	| |ƒS )N)i   i   i   z+Key size must be 1024 or 2048 or 3072 bits.r   r‚   )
r®   rs   ÚDSA_newr€   rq   r   rÙ   r  ZDSA_generate_parameters_exr'   )r{   rÞ   Úctxrˆ   r|   r|   r}   Úgenerate_dsa_parametersl  s     
     þzBackend.generate_dsa_parametersc                 C   sT   | j  |j¡}|  || jjk¡ | j || j j¡}| j  |¡ |  	|¡}t
| ||ƒS ro   )rs   ZDSAparams_dupZ
_dsa_cdatar€   rq   r   rÙ   r  ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr(   )r{   Ú
parametersr  rà   r|   r|   r}   Úgenerate_dsa_private_key}  s    
z Backend.generate_dsa_private_keyc                 C   s   |   |¡}|  |¡S ro   )r  r  )r{   rÞ   r  r|   r|   r}   Ú'generate_dsa_private_key_and_parameters†  s    
z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j  ||||¡}|  |dk¡ | j  |||¡}|  |dk¡ d S r   )rs   ÚDSA_set0_pqgr€   ZDSA_set0_key)r{   r  rå   ræ   ÚgÚpub_keyÚpriv_keyrˆ   r|   r|   r}   Ú_dsa_cdata_set_valuesŠ  s    zBackend._dsa_cdata_set_valuesc           
      C   s¨   t  |¡ |jj}| j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}|  |j¡}|  |jj¡}|  |j¡}|  ||||||¡ |  |¡}	t| ||	ƒS ro   )rO   Z_check_dsa_private_numbersrë   Úparameter_numbersrs   r  r€   rq   r   rÙ   r  r×   rå   ræ   r  ÚyÚxr"  r  r(   )
r{   rî   r#  r  rå   ræ   r  r   r!  rà   r|   r|   r}   Úload_dsa_private_numbers  s    


z Backend.load_dsa_private_numbersc           	      C   s¢   t  |j¡ | j ¡ }|  || jjk¡ | j || jj	¡}|  
|jj¡}|  
|jj¡}|  
|jj¡}|  
|j¡}| jj}|  ||||||¡ |  |¡}t| ||ƒS ro   )rO   Ú_check_dsa_parametersr#  rs   r  r€   rq   r   rÙ   r  r×   rå   ræ   r  r$  r"  r  r)   )	r{   rî   r  rå   ræ   r  r   r!  rà   r|   r|   r}   Úload_dsa_public_numbers£  s    

zBackend.load_dsa_public_numbersc                 C   s†   t  |¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|  	|j¡}| j ||||¡}|  |dk¡ t| |ƒS r   )rO   r'  rs   r  r€   rq   r   rÙ   r  r×   rå   ræ   r  r  r'   )r{   rî   r  rå   ræ   r  rˆ   r|   r|   r}   Úload_dsa_parameter_numbers´  s    

z"Backend.load_dsa_parameter_numbersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S r   )ró   rs   ZEVP_PKEY_set1_DSAr€   )r{   r  rà   rˆ   r|   r|   r}   r  Â  s    zBackend._dsa_cdata_to_evp_pkeyc                 C   s
   |   |¡S ro   r¢   r£   r|   r|   r}   Údsa_hash_supportedÈ  s    zBackend.dsa_hash_supportedc                 C   s   dS )NTr|   )r{   rå   ræ   r  r|   r|   r}   Údsa_parameters_supportedË  s    z Backend.dsa_parameters_supportedc                 C   s   |   |td|j ƒ¡S )Nó    )r­   ra   Z
block_sizer£   r|   r|   r}   Úcmac_algorithm_supportedÎ  s     ÿz Backend.cmac_algorithm_supportedc                 C   s
   t | |ƒS ro   r    r£   r|   r|   r}   Úcreate_cmac_ctxÓ  s    zBackend.create_cmac_ctxc           
         sÐ  t |tjƒstdƒ‚t |tjtjfƒr8|d k	rntdƒ‚n6t |t	j
ƒsNtdƒ‚n t |t	jƒrnt |tjƒsntdƒ‚ˆ  ||¡}ˆ j ¡ }ˆ  |ˆ jjk¡ ˆ j |ˆ jj¡}ˆ j |tjjj¡}ˆ  |dk¡ ˆ j |tˆ |jƒ¡}ˆ  |dk¡ | ¡ }ˆ j ||j¡}ˆ  |dk¡ ˆ j  ¡ }ˆ  |ˆ jjk¡ ˆ j |‡ fdd„¡}ˆ j!|j"t#|ˆ jj$dd	 ˆ j %||¡}ˆ  |dk¡ ˆ j &||j|¡}|d
krÆˆ  '¡ }	ˆ  |	d
  (ˆ jj)ˆ jj*¡¡ tdƒ‚t+ˆ |ƒS )NúBuilder type mismatch.ú8algorithm must be None when signing via ed25519 or ed448ú.Algorithm must be a registered hash algorithm.z5MD5 is not a supported hash algorithm for EC/DSA CSRsr‚   c                    s   ˆ j  | ˆ j ˆ j jd¡¡S )NÚX509_EXTENSION_free)rs   Zsk_X509_EXTENSION_pop_freerq   Ú	addressofÚ_original_lib)r%  rz   r|   r}   Ú<lambda>  s     ÿÿz)Backend.create_x509_csr.<locals>.<lambda>F©Ú
extensionsÚhandlersÚx509_objÚadd_funcrÙ   r   úDigest too big for RSA key),r  r	   Z CertificateSigningRequestBuilderÚ	TypeErrorrQ   ÚEd25519PrivateKeyrR   ÚEd448PrivateKeyr®   rM   ÚHashAlgorithmÚMD5rS   ÚRSAPrivateKeyÚ_evp_md_x509_null_if_eddsars   ZX509_REQ_newr€   rq   r   rÙ   ÚX509_REQ_freeZX509_REQ_set_versionZVersionZv1ÚvalueZX509_REQ_set_subject_namer8   Ú_subject_nameÚ
public_keyZX509_REQ_set_pubkeyÚ	_evp_pkeyZsk_X509_EXTENSION_new_nullÚ_create_x509_extensionsÚ_extensionsr3   Zsk_X509_EXTENSION_insertZX509_REQ_add_extensionsZX509_REQ_signrÂ   Ú_lib_reason_matchÚERR_LIB_RSAÚ RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEYrJ   )
r{   ÚbuilderÚprivate_keyr—   r   Úx509_reqrˆ   rF  Zsk_extensionÚerrorsr|   rz   r}   Úcreate_x509_csrÖ  s‚    
ÿÿ

ÿ
þÿ
 
ÿ ÿ

þ
û  ÿ
þÿzBackend.create_x509_csrc           	      C   sÞ  t |tjƒstdƒ‚t |tjtjfƒr8|d k	rLtdƒ‚nt |t	j
ƒsLtdƒ‚t |t	jƒrlt |tjƒsltdƒ‚|  ||¡}| j ¡ }| j |tjj¡}| j ||jj¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ | j ||jj¡}|  |dk¡ t| |j ƒ}| j !||¡}|  |dk¡ |  "| j #|¡|j$¡ |  "| j %|¡|j&¡ | j'|j(t)|| jj*dd | j +|t| |j,ƒ¡}|  |dk¡ | j -||j|¡}|dkrÔ|  .¡ }|  |d  /| jj0| jj1¡¡ td	ƒ‚t2| |ƒS )
Nr/  r0  r1  z8MD5 is only (reluctantly) supported for RSA certificatesr‚   Tr6  r   r;  )3r  r	   ZCertificateBuilderr<  rQ   r=  rR   r>  r®   rM   r?  r@  rS   rA  rB  rs   ZX509_newrq   rÙ   ÚbackendÚ	X509_freeZX509_set_versionZ_versionrD  r€   ZX509_set_subject_namer8   rE  ZX509_set_pubkeyZ_public_keyrG  r6   Ú_serial_numberZX509_set_serialNumberÚ_set_asn1_timeZX509_getm_notBeforeZ_not_valid_beforeZX509_getm_notAfterZ_not_valid_afterrH  rI  r3   ZX509_add_extZX509_set_issuer_nameÚ_issuer_nameZ	X509_signrÂ   rJ  rK  rL  rH   )	r{   rM  rN  r—   r   Z	x509_certrˆ   Úserial_numberrP  r|   r|   r}   Úcreate_x509_certificate+  sŽ    
ÿÿ
ÿ
þÿ
 
ÿ ÿ
 ÿ
 ÿû	 
ÿ  ÿ
þÿzBackend.create_x509_certificatec                 C   s(   t |tjtjfƒr| jjS |  |¡S d S ro   )r  rQ   r=  rR   r>  rq   r   r    )r{   rN  r—   r|   r|   r}   rB  „  s
    
ÿz"Backend._evp_md_x509_null_if_eddsac                 C   sL   |j dkr| d¡ d¡}n| d¡ d¡}| j ||¡}|  |dk¡ d S )Ni  z%Y%m%d%H%M%SZr   z%y%m%d%H%M%SZr‚   )ZyearÚstrftimerœ   rs   ZASN1_TIME_set_stringr€   )r{   Ú	asn1_timeÚtimeZasn1_strrˆ   r|   r|   r}   rU  Œ  s
    
zBackend._set_asn1_timec                 C   s>   | j  ¡ }|  || jjk¡ | j || j j¡}|  ||¡ |S ro   )rs   ZASN1_TIME_newr€   rq   r   rÙ   ZASN1_TIME_freerU  )r{   r[  rZ  r|   r|   r}   Ú_create_asn1_time”  s
    
zBackend._create_asn1_timec                 C   sÜ  t |tjƒstdƒ‚t |tjtjfƒr8|d k	rLtdƒ‚nt |t	j
ƒsLtdƒ‚t |t	jƒrlt |tjƒsltdƒ‚|  ||¡}| j ¡ }| j |tjj¡}| j |d¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ | j|j t!|| jj"dd |j#D ]B}	| j $|	j%¡}
|  |
| jj&k¡ | j '||
¡}|  |dk¡ qD| j (||j)|¡}|dkrÒ|  *¡ }|  |d  +| jj,| jj-¡¡ td	ƒ‚t.| |ƒS )
Nr/  r0  r1  z5MD5 is not a supported hash algorithm for EC/DSA CRLsr‚   Tr6  r   r;  )/r  r	   Z CertificateRevocationListBuilderr<  rQ   r=  rR   r>  r®   rM   r?  r@  rS   rA  rB  rs   ZX509_CRL_newrq   rÙ   rR  ÚX509_CRL_freeZX509_CRL_set_versionr€   ZX509_CRL_set_issuer_namer8   rV  r\  Z_last_updateZX509_CRL_set_lastUpdateÚ_next_updateZX509_CRL_set_nextUpdaterH  rI  r2   ZX509_CRL_add_extZ_revoked_certificatesZCryptography_X509_REVOKED_dupZ_x509_revokedr   ZX509_CRL_add0_revokedZX509_CRL_signrG  rÂ   rJ  rK  rL  rI   )r{   rM  rN  r—   r   Úx509_crlrˆ   Zlast_updateÚnext_updateZrevoked_certZrevokedrP  r|   r|   r}   Úcreate_x509_crl›  s~    
ÿÿ
ÿ
þÿ
 
ÿû	
ÿ  ÿ
þÿzBackend.create_x509_crlc           
      C   sd   t |ƒD ]V\}}|  ||¡}|  || jjk¡ |rD| j || jj¡}||||ƒ}	|  |	dk¡ qd S r   )Ú	enumerateÚ_create_x509_extensionr€   rq   r   rÙ   rs   r2  )
r{   r7  r8  r9  r:  rÙ   ÚiÚ	extensionZx509_extensionrˆ   r|   r|   r}   rH  ì  s     ÿ ÿzBackend._create_x509_extensionsc                 C   s.   t | |jjƒ}| j | jj||jr&dnd|¡S )Nr‚   r   )r9   ÚoidÚdotted_stringrs   ZX509_EXTENSION_create_by_OBJrq   r   Úcritical)r{   re  rD  Úobjr|   r|   r}   Ú_create_raw_x509_extensionû  s       ÿz"Backend._create_raw_x509_extensionc                 C   s  t |jtjƒr(t| |jjƒ}|  ||¡S t |jtjƒrfttfdd„ |jD ƒžŽ }t| |ƒ}|  ||¡S t |jtj	ƒrŽt| tt
ƒƒ}|  ||¡S z||j }W n$ tk
rÀ   td |j¡ƒ‚Y nX || |jƒ}| j |jj d¡¡}t || jjk¡ | j ||jr
dnd|¡S d S )Nc                 S   s   g | ]}t tt|jƒƒ‘qS r|   )r   r   r   rD  )Ú.0r%  r|   r|   r}   Ú
<listcomp>  s   ÿz2Backend._create_x509_extension.<locals>.<listcomp>zExtension not supported: {}r   r‚   r   )r  rD  r	   ZUnrecognizedExtensionr7   rj  Z
TLSFeaturer   r   ZPrecertPoisonr   rf  r¨   ÚNotImplementedErrorr›   rs   ZOBJ_txt2nidrg  rœ   rR  r€   Ú	NID_undefZX509V3_EXT_i2drh  )r{   r8  re  rD  Zasn1rœ   Z
ext_structÚnidr|   r|   r}   rc    s@    ÿþþ

ÿ
ÿ  ÿzBackend._create_x509_extensionc                 C   s¸   t |tjƒstdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}t| |jƒ}| j ||¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ | j|jt|| jjdd t| d |ƒS )Nr/  r‚   Tr6  )r  r	   ZRevokedCertificateBuilderr<  rs   ZX509_REVOKED_newr€   rq   r   rÙ   ZX509_REVOKED_freer6   rT  ZX509_REVOKED_set_serialNumberr\  Z_revocation_dateZX509_REVOKED_set_revocationDaterH  rI  r1   ZX509_REVOKED_add_extrK   )r{   rM  Zx509_revokedrW  rˆ   Zrev_dater|   r|   r}   Úcreate_x509_revoked_certificate#  s,    
 ÿûz'Backend.create_x509_revoked_certificatec                 C   s   |   | jj| j||¡S ro   )Ú	_load_keyrs   ZPEM_read_bio_PrivateKeyr  )r{   rõ   Úpasswordr|   r|   r}   Úload_pem_private_key<  s    üzBackend.load_pem_private_keyc                 C   sÖ   |   |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj| jj| jj¡}|| jjkrÊ| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S r   )r÷   rs   ZPEM_read_bio_PUBKEYrm   rq   r   rÙ   rñ   r  rÂ   Ú	BIO_resetr€   ZPEM_read_bio_RSAPublicKeyrÚ   rÜ   rC   Ú_handle_key_loading_error©r{   rõ   Úmem_biorà   rˆ   rß   r|   r|   r}   Úload_pem_public_keyD  s0    
   ÿ
   ÿ
zBackend.load_pem_public_keyc                 C   s^   |   |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}t| |ƒS |  	¡  d S ro   )
r÷   rs   ZPEM_read_bio_DHparamsrm   rq   r   rÙ   r
  r#   ru  )r{   rõ   rw  r  r|   r|   r}   Úload_pem_parameters]  s    
   ÿ
zBackend.load_pem_parametersc                 C   s>   |   |¡}|  ||¡}|r$|  |¡S |  | jj| j||¡S d S ro   )r÷   Ú"_evp_pkey_from_der_traditional_keyr  rq  rs   Zd2i_PKCS8PrivateKey_bio)r{   rõ   rr  rù   r–   r|   r|   r}   Úload_der_private_keyh  s    

üzBackend.load_der_private_keyc                 C   sV   | j  |j| jj¡}|| jjkrF| j || j j¡}|d k	rBtdƒ‚|S |  ¡  d S d S )Nú4Password was given but private key is not encrypted.)	rs   Úd2i_PrivateKey_biorm   rq   r   rÙ   rñ   r<  rÂ   )r{   rù   rr  r–   r|   r|   r}   rz  {  s    ÿz*Backend._evp_pkey_from_der_traditional_keyc                 C   s¾   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj¡}|| jjkr²| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S r   )r÷   rs   Zd2i_PUBKEY_biorm   rq   r   rÙ   rñ   r  rÂ   rt  r€   Zd2i_RSAPublicKey_biorÚ   rÜ   rC   ru  rv  r|   r|   r}   Úload_der_public_key‰  s"    

 ÿ
zBackend.load_der_public_keyc                 C   sº   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}t| |ƒS | jj	r®|  
¡  | j |j¡}|  |dk¡ | j |j| jj¡}|| jjkr®| j || jj¡}t| |ƒS |  ¡  d S r   )r÷   rs   Zd2i_DHparams_biorm   rq   r   rÙ   r
  r#   rx   rÂ   rt  r€   ZCryptography_d2i_DHxparams_bioru  )r{   rõ   rw  r  rˆ   r|   r|   r}   Úload_der_parameters   s(    
 ÿ
 ÿ
zBackend.load_der_parametersc                 C   sb   |   |¡}| j |j| jj| jj| jj¡}|| jjkrF|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzwUnable to load certificate. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)r÷   rs   ZPEM_read_bio_X509rm   rq   r   rÂ   r®   rÙ   rS  rH   ©r{   rõ   rw  r	   r|   r|   r}   Úload_pem_x509_certificate¶  s    
   ÿÿz!Backend.load_pem_x509_certificatec                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load certificate)r÷   rs   Zd2i_X509_biorm   rq   r   rÂ   r®   rÙ   rS  rH   r€  r|   r|   r}   Úload_der_x509_certificateÅ  s    
z!Backend.load_der_x509_certificatec                 C   sb   |   |¡}| j |j| jj| jj| jj¡}|| jjkrF|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzoUnable to load CRL. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)r÷   rs   ZPEM_read_bio_X509_CRLrm   rq   r   rÂ   r®   rÙ   r]  rI   ©r{   rõ   rw  r_  r|   r|   r}   Úload_pem_x509_crlÏ  s    
   ÿÿzBackend.load_pem_x509_crlc                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load CRL)r÷   rs   Zd2i_X509_CRL_biorm   rq   r   rÂ   r®   rÙ   r]  rI   rƒ  r|   r|   r}   Úload_der_x509_crlÞ  s    
zBackend.load_der_x509_crlc                 C   sb   |   |¡}| j |j| jj| jj| jj¡}|| jjkrF|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzsUnable to load request. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)r÷   rs   ZPEM_read_bio_X509_REQrm   rq   r   rÂ   r®   rÙ   rC  rJ   ©r{   rõ   rw  rO  r|   r|   r}   Úload_pem_x509_csrè  s    
   ÿÿzBackend.load_pem_x509_csrc                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load request)r÷   rs   Zd2i_X509_REQ_biorm   rq   r   rÂ   r®   rÙ   rC  rJ   r†  r|   r|   r}   Úload_der_x509_csr÷  s    
zBackend.load_der_x509_csrc           
      C   s(  |   |¡}| j d¡}|d k	rFt d|¡ | j |¡}||_t|ƒ|_||j	| jj
| j | jjd¡|ƒ}|| jj
krÐ|jdkrÈ|  ¡ }	|  |	¡ |jdkr¤tdƒ‚qÐ|jdks²t‚td |jd	 ¡ƒ‚n|  ¡  | j || jj¡}|d k	rü|jdkrütd
ƒ‚|d k	r|jd	ks |d ks t‚||ƒS )NzCRYPTOGRAPHY_PASSWORD_DATA *rr  ZCryptography_pem_password_cbr   éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.r‚   r|  )r÷   rq   rŽ   r   Ú_check_bytesliker»   rr  r   r½   rm   r   r3  rs   r4  ÚerrorrÂ   r€   r<  rÅ   r®   r›   Úmaxsizeru  rÙ   rñ   Zcalled)
r{   Zopenssl_read_funcZconvert_funcrõ   rr  rw  ZuserdataZpassword_ptrrà   rP  r|   r|   r}   rq    sV    

 ÿú	


ÿÿÿÿÿÿþzBackend._load_keyc                    sÞ   ˆ   ¡ }|stdƒ‚nÄ|d  ˆ jjˆ jj¡sF|d  ˆ jjˆ jj¡rPtdƒ‚nŠ|d  ˆ jjˆ jj¡s€|d  ˆ jj	ˆ jj
¡rŽtdtjƒ‚nLt‡ fdd„|D ƒƒr®tdƒ‚n,|d jˆ jjˆ jj	ˆ jjfksÒt‚tdƒ‚d S )NzCould not deserialize key data.r   z Bad decrypt. Incorrect password?z0PEM data is encrypted with an unsupported cipherc                 3   s"   | ]}|  ˆ jjˆ jj¡V  qd S ro   )rJ  rs   ÚERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)rk  rŒ  rz   r|   r}   Ú	<genexpr>N  s
   üþz4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.)rÂ   r®   rJ  rs   rŽ  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZEVP_R_UNKNOWN_PBE_ALGORITHMZERR_LIB_PEMZPEM_R_UNSUPPORTED_ENCRYPTIONr
   r   ZUNSUPPORTED_CIPHERÚanyrr   ZERR_LIB_ASN1rÅ   )r{   rP  r|   rz   r}   ru  2  sL    
 ÿÿþý
 ÿÿ ÿýþû
ý
z!Backend._handle_key_loading_errorc                 C   s    z|   |¡}W n tk
r*   | jj}Y nX | j |¡}|| jjkrz|  ¡ }|  || jjkpr|d  	| jj
| jj¡¡ dS |  || jjk¡ | j |¡ dS d S )Nr   FT)Ú_elliptic_curve_to_nidr
   rs   rn  ZEC_GROUP_new_by_curve_namerq   r   rÂ   r€   rJ  Z
ERR_LIB_ECZEC_R_UNKNOWN_GROUPZEC_GROUP_free)r{   ÚcurveÚ	curve_nidÚgrouprP  r|   r|   r}   Úelliptic_curve_supported_  s$    þþz Backend.elliptic_curve_supportedc                 C   s   t |tjƒsdS |  |¡S r¦   )r  rP   ZECDSAr•  )r{   Zsignature_algorithmr’  r|   r|   r}   Ú,elliptic_curve_signature_algorithm_supportedv  s    z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   s\   |   |¡rD|  |¡}| j |¡}|  |dk¡ |  |¡}t| ||ƒS td |j	¡t
jƒ‚dS )z@
        Generate a new private key on the named curve.
        r‚   z#Backend object does not support {}.N)r•  Ú_ec_key_new_by_curvers   ZEC_KEY_generate_keyr€   Ú_ec_cdata_to_evp_pkeyr*   r
   r›   rš   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)r{   r’  r  rˆ   rà   r|   r|   r}   Ú#generate_elliptic_curve_private_key  s    



þz+Backend.generate_elliptic_curve_private_keyc                 C   sp   |j }|  |j¡}| j |  |j¡| jj¡}| j 	||¡}|  
|dk¡ |  ||j|j¡}|  |¡}t| ||ƒS r   )rë   r—  r’  rq   rÙ   r×   Úprivate_valuers   ÚBN_clear_freeÚEC_KEY_set_private_keyr€   Ú)_ec_key_set_public_key_affine_coordinatesr%  r$  r˜  r*   )r{   rî   Zpublicr  r›  rˆ   rà   r|   r|   r}   Ú#load_elliptic_curve_private_numbers“  s    
 ÿ  ÿ
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |   |j¡}|  ||j|j¡}|  |¡}t| ||ƒS ro   )r—  r’  rž  r%  r$  r˜  r+   )r{   rî   r  rà   r|   r|   r}   Ú"load_elliptic_curve_public_numbers¥  s      ÿ
z*Backend.load_elliptic_curve_public_numbersc           	   	   C   sÎ   |   |¡}| j |¡}|  || jjk¡ | j |¡}|  || jjk¡ | j || jj¡}|  	¡ 6}| j 
|||t|ƒ|¡}|dkr’|  ¡  tdƒ‚W 5 Q R X | j ||¡}|  |dk¡ |  |¡}t| ||ƒS )Nr‚   z(Invalid public bytes for the given curve)r—  rs   ÚEC_KEY_get0_groupr€   rq   r   ÚEC_POINT_newrÙ   ÚEC_POINT_freeÚ_tmp_bn_ctxZEC_POINT_oct2pointr   rÂ   r®   ÚEC_KEY_set_public_keyr˜  r+   )	r{   r’  Zpoint_bytesr  r”  ÚpointÚbn_ctxrˆ   rà   r|   r|   r}   Ú load_elliptic_curve_public_bytes­  s*    

    ÿ
z(Backend.load_elliptic_curve_public_bytesc              	   C   sD  |   |¡}|  |¡\}}| j |¡}|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}|  ¡ h}| j |||| jj| jj|¡}	|  |	dk¡ | j |¡}
| j |¡}||||
||ƒ}	|  |	dk¡ W 5 Q R X | j ||¡}	|  |	dk¡ |  	|¡}| j || jj
¡}| j ||¡}	|  |	dk¡ |  |¡}t| ||ƒS r   )r—  Ú _ec_key_determine_group_get_funcrs   r¢  r€   rq   r   rÙ   r£  r×   rœ  r¤  ZEC_POINT_mulZ
BN_CTX_getr¥  r  r˜  r*   )r{   r›  r’  r  Úget_funcr”  r¦  rD  r§  rˆ   Zbn_xZbn_yZprivaterà   r|   r|   r}   Ú!derive_elliptic_curve_private_keyÁ  s2    


 ÿ

z)Backend.derive_elliptic_curve_private_keyc                 C   s:   |   |¡}| j |¡}|  || jjk¡ | j || jj¡S ro   )r‘  rs   ZEC_KEY_new_by_curve_namer€   rq   r   rÙ   r  )r{   r’  r“  r  r|   r|   r}   r—  ã  s    
zBackend._ec_key_new_by_curvec                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load OCSP request)r÷   rs   Zd2i_OCSP_REQUEST_biorm   rq   r   rÂ   r®   rÙ   ÚOCSP_REQUEST_freer>   )r{   rõ   rw  Zrequestr|   r|   r}   Úload_der_ocsp_requesté  s    
zBackend.load_der_ocsp_requestc                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load OCSP response)r÷   rs   Zd2i_OCSP_RESPONSE_biorm   rq   r   rÂ   r®   rÙ   ÚOCSP_RESPONSE_freer?   )r{   rõ   rw  Zresponser|   r|   r}   Úload_der_ocsp_responseó  s    
zBackend.load_der_ocsp_responsec           	      C   s®   | j  ¡ }|  || jjk¡ | j || j j¡}|j\}}}|  |¡}| j  	||j
|j
¡}|  || jjk¡ | j  ||¡}|  || jjk¡ | j|jt|| j jdd t| |ƒS )NTr6  )rs   ZOCSP_REQUEST_newr€   rq   r   rÙ   r¬  Z_requestr    ÚOCSP_cert_to_idÚ_x509ZOCSP_request_add0_idrH  rI  r5   ZOCSP_REQUEST_add_extr>   )	r{   rM  Zocsp_reqÚcertZissuerr—   r   ÚcertidZonereqr|   r|   r}   Úcreate_ocsp_requestý  s*    

  ÿûzBackend.create_ocsp_requestc              	   C   s  | j  ¡ }|  || jjk¡ | j || j j¡}|  |jj	¡}| j  
||jjj|jjj¡}|  || jjk¡ | j || j j¡}|jjd krŽd}nt|jj }|jjd kr°| jj}n|  |jj¡}| jj}	|jjd k	rà|  |jj¡}	|  |jj¡}
| j  |||jjj|||
|	¡}|  || jjk¡ |  ||¡}|j\}}| j j}|tjjkrV|| j jO }|jd k	rŽ|jD ]$}| j   ||j¡}|  |dk¡ qh| j!|j"t#|| j j$dd | j  %||j|j&|| jj|¡}|dkrþ|  '¡ }|  |d  (| j j)| j j*¡¡ t+dƒ‚|S )Nr‰  r‚   Tr6  r   z,responder_cert must be signed by private_key),rs   ZOCSP_BASICRESP_newr€   rq   r   rÙ   ZOCSP_BASICRESP_freer    Z	_responser  r°  Z_certr±  Z_issuerZOCSP_CERTID_freeZ_revocation_reasonr"   Z_revocation_timer\  r^  Z_this_updateZOCSP_basic_add1_statusZ_cert_statusrD  rB  Z_responder_idZOCSP_NOCERTSrk   ZOCSPResponderEncodingZHASHZOCSP_RESPID_KEYZ_certsZOCSP_basic_add1_certrH  rI  r4   ZOCSP_BASICRESP_add_extZOCSP_basic_signrG  rÂ   rJ  ZERR_LIB_X509ZX509_R_KEY_VALUES_MISMATCHr®   )r{   rM  rN  r—   Úbasicr   r³  ÚreasonZrev_timer`  Zthis_updaterˆ   Zresponder_certZresponder_encodingÚflagsr²  rP  r|   r|   r}   Ú_create_ocsp_basic_response  s’    
ÿ þÿ
ÿÿù	

û    þ
þÿz#Backend._create_ocsp_basic_responsec                 C   sb   |t jjkr|  |||¡}n| jj}| j |j|¡}|  	|| jjk¡ | j 
|| jj¡}t| |ƒS ro   )rk   ZOCSPResponseStatusZ
SUCCESSFULr¸  rq   r   rs   ZOCSP_response_createrD  r€   rÙ   r®  r?   )r{   Zresponse_statusrM  rN  r—   rµ  Z	ocsp_respr|   r|   r}   Úcreate_ocsp_responseb  s      ÿ ÿzBackend.create_ocsp_responsec                 C   s   |   |¡ot|tjƒS ro   )r•  r  rP   ZECDH)r{   r—   r’  r|   r|   r}   Ú+elliptic_curve_exchange_algorithm_supportedr  s    

þz3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S r   )ró   rs   ZEVP_PKEY_set1_EC_KEYr€   )r{   r  rà   rˆ   r|   r|   r}   r˜  x  s    zBackend._ec_cdata_to_evp_pkeyc                 C   sN   dddœ}|  |j|j¡}| j | ¡ ¡}|| jjkrJtd |j¡tj	ƒ‚|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z${} is not a supported elliptic curve)
Úgetrš   rs   Ú
OBJ_sn2nidrœ   rn  r
   r›   r   r™  )r{   r’  Zcurve_aliasesÚ
curve_namer“  r|   r|   r}   r‘  ~  s    þ
þzBackend._elliptic_curve_to_nidc              	   c   sX   | j  ¡ }|  || jjk¡ | j || j j¡}| j  |¡ z
|V  W 5 | j  |¡ X d S ro   )	rs   Z
BN_CTX_newr€   rq   r   rÙ   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)r{   r§  r|   r|   r}   r¤  ’  s    

zBackend._tmp_bn_ctxc                 C   s¼   |   || jjk¡ | j d¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ ||kr¤| jj	r¤| jj
}n| jj}|s´t‚||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r€   rq   r   rs   r¼  rn  r¡  ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFprÅ   )r{   r  Znid_two_fieldr”  Úmethodro  rª  r|   r|   r}   r©    s    
z(Backend._ec_key_determine_group_get_funcc                 C   st   |dk s|dk rt dƒ‚| j |  |¡| jj¡}| j |  |¡| jj¡}| j |||¡}|dkrp|  ¡  t dƒ‚|S )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.r‚   zInvalid EC key.)r®   rq   rÙ   r×   rs   rÛ   Z(EC_KEY_set_public_key_affine_coordinatesrÂ   )r{   r  r%  r$  rˆ   r|   r|   r}   rž  ¹  s    ÿz1Backend._ec_key_set_public_key_affine_coordinatesc                 C   sú  t |tjƒstdƒ‚|tjjkr(tdƒ‚|tjjkr<tdƒ‚|tjjkrPtdƒ‚t |tjƒsdtdƒ‚t |tj	ƒr‚d}d}| j
j}n@t |tjƒrº| j d¡}|j}t|ƒ}|d	krÂtd
ƒ‚ntdƒ‚| j |¡}	|tjjkrX|tjjkrö| jj}
|}n`|tjjkst‚|	| jjkr | jj}
n2|	| jjkr8| jj}
n|	| jjksJt‚| jj}
|}nf|tjjkr¶|tjjkr–t |tj	ƒsŠtdƒ‚|  |	|¡S |tjjks¨t‚| jj}
|}ntdƒ‚|   ¡ }|
|||||| j
j| j
jƒ}|  !|dk¡ |  "|¡S )Nz2format must be an item from the PrivateFormat enumz-X9.62 format is only valid for EC public keysú/raw format is invalid with this key or encodingú/raw encoding is invalid with this key or formatzBEncryption algorithm must be a KeySerializationEncryption instanceó    r   s   aes-256-cbciÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezDEncryption is not supported for DER encoded traditional OpenSSL keysz-encoding must be Encoding.PEM or Encoding.DERr‚   )#r  rN   ZPrivateFormatr<  ÚEncodingÚX962r®   ÚRawZKeySerializationEncryptionZNoEncryptionrq   r   ZBestAvailableEncryptionrs   ÚEVP_get_cipherbynamerr  r   r   ÚPEMZPKCS8ZPEM_write_bio_PKCS8PrivateKeyZTraditionalOpenSSLrÅ   r  ZPEM_write_bio_RSAPrivateKeyr  ZPEM_write_bio_DSAPrivateKeyr  ZPEM_write_bio_ECPrivateKeyÚDERÚ"_private_key_bytes_traditional_derZi2d_PKCS8PrivateKey_biorø   r€   rú   )r{   Úencodingr›   Zencryption_algorithmrà   Úcdatarr  Zpasslenr¬   r  Ú	write_bior–   rm   rˆ   r|   r|   r}   Ú_private_key_bytesÍ  s    ÿÿÿ
ÿÿÿ

 ÿÿù	zBackend._private_key_bytesc                 C   sp   || j jkr| j j}n0|| j jkr,| j j}n|  || j jk¡ | j j}|  ¡ }|||ƒ}|  |dk¡ |  	|¡S r   )
rs   r  Zi2d_RSAPrivateKey_bior  Zi2d_ECPrivateKey_bior€   r  Zi2d_DSAPrivateKey_biorø   rú   )r{   r  rÊ  rË  rm   rˆ   r|   r|   r}   rÈ  ,  s    


z*Backend._private_key_bytes_traditional_derc           	      C   sl  t |tjƒstdƒ‚|tjjtjjfkr0tdƒ‚|tjjkrDtdƒ‚|tjjkrXtdƒ‚|tjj	ksp|tjj	krš|tjj	k	sˆ|tjj	k	rtdƒ‚|  
|¡S |tjjkrÚ|tjjkr¼| jj}n|tjjksÌt‚| jj}|}nh|tjjkr:| j |¡| jjkst‚|tjjkr| jj}n|tjjks,t‚| jj}|}ntdƒ‚|  ¡ }|||ƒ}|  |dk¡ |  |¡S )Nú/encoding must be an item from the Encoding enumz-Point formats are not valid for this key typer¿  rÀ  z1OpenSSH format must be used with OpenSSH encodingz1format must be an item from the PublicFormat enumr‚   )r  rN   rÂ  r<  ÚPublicFormatÚUncompressedPointZCompressedPointr®   rÄ  ÚOpenSSHÚ_openssh_public_key_bytesZSubjectPublicKeyInforÆ  rs   ZPEM_write_bio_PUBKEYrÇ  rÅ   Zi2d_PUBKEY_bioZPKCS1r   r  ZPEM_write_bio_RSAPublicKeyZi2d_RSAPublicKey_biorø   r€   rú   )	r{   rÉ  r›   r–   rà   rÊ  rË  rm   rˆ   r|   r|   r}   Ú_public_key_bytes:  sT    ÿ
ÿ
þ
ÿ
þÿ


ÿ
zBackend._public_key_bytesc                 C   sŠ  t |tjƒr@| ¡ }dt t d¡t |j	¡ t |j
¡ ¡ S t |tjƒrž| ¡ }|j}dt t d¡t |j¡ t |j¡ t |j¡ t |j¡ ¡ S t |tjƒrÜ| tjjtjj¡}dt t d¡t |¡ ¡ S t |tjƒr~| ¡ }z$tjdtjdtjd	it|jƒ }W n t k
r4   t!d
ƒ‚Y nX | tjj"tjj#¡}d| d t t d| ¡t |¡ t |¡ ¡ S t!dƒ‚d S )Ns   ssh-rsa s   ssh-rsas   ssh-dss s   ssh-dsss   ssh-ed25519 s   ssh-ed25519s   nistp256s   nistp384s   nistp521zZOnly SECP256R1, SECP384R1, and SECP521R1 curves are supported by the SSH public key formats   ecdsa-sha2-ó    z3OpenSSH encoding is not supported for this key type)$r  rS   ZRSAPublicKeyrë   Úbase64Z	b64encoderj   Z_ssh_write_stringZ_ssh_write_mpintr‡   rì   rO   ZDSAPublicKeyr#  rå   ræ   r  r$  rQ   ZEd25519PublicKeyZpublic_bytesrN   rÂ  rÄ  rÎ  rP   ZEllipticCurvePublicKeyZ	SECP256R1Z	SECP384R1Z	SECP521R1r§   r’  r¨   r®   rÃ  rÏ  )r{   r–   rë   r#  Z	raw_bytesr½  r¦  r|   r|   r}   rÑ  w  s|    
ÿ
þÿ
ÿ
þ
ý
üÿ
ÿÿÿ   ýüÿ
þÿþÿÿz!Backend._openssh_public_key_bytesc                 C   sÌ   |t jjkrtdƒ‚| j d¡}| j || jj|| jj¡ |t jj	krj|d | jjkr`| jj
}q¢| jj}n8|t jjkrš|d | jjkr| jj}q¢| jj}ntdƒ‚|  ¡ }|||ƒ}|  |dk¡ |  |¡S )Nz!OpenSSH encoding is not supportedrÐ   r   rÍ  r‚   )rN   rÂ  rÐ  r<  rq   rŽ   rs   ZDH_get0_pqgr   rÆ  ZPEM_write_bio_DHxparamsZPEM_write_bio_DHparamsrÇ  ZCryptography_i2d_DHxparams_bioZi2d_DHparams_biorø   r€   rú   )r{   rÉ  r›   rÊ  ræ   rË  rm   rˆ   r|   r|   r}   Ú_parameter_bytes¬  s.    ÿý




zBackend._parameter_bytesc                 C   s|   |dk rt dƒ‚|dkr t dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j |||| jj¡}|  |dk¡ t	| |ƒS )Nrã   z%DH key_size must be at least 512 bits)rÏ   é   zDH generator must be 2 or 5r‚   )
r®   rs   ÚDH_newr€   rq   r   rÙ   r
  ZDH_generate_parameters_exr#   )r{   Ú	generatorrÞ   Zdh_param_cdatarˆ   r|   r|   r}   Úgenerate_dh_parametersÊ  s    
üzBackend.generate_dh_parametersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S r   )ró   rs   ZEVP_PKEY_set1_DHr€   )r{   r  rà   rˆ   r|   r|   r}   Ú_dh_cdata_to_evp_pkeyß  s    zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| ƒ}| j |¡}|  |dk¡ |  |¡}t| ||ƒS r   )r&   Z	_dh_cdatars   ZDH_generate_keyr€   rÚ  r$   )r{   r  Zdh_key_cdatarˆ   rà   r|   r|   r}   Úgenerate_dh_private_keyå  s
    
zBackend.generate_dh_private_keyc                 C   s   |   |  ||¡¡S ro   )rÛ  rÙ  )r{   rØ  rÞ   r|   r|   r}   Ú&generate_dh_private_key_and_parametersï  s    
ÿz.Backend.generate_dh_private_key_and_parametersc                 C   s>  |j j}| j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|jd k	rf|  	|j¡}n| jj}|  	|j j¡}|  	|j¡}| j ||||¡}	|  |	dk¡ | j |||¡}	|  |	dk¡ | j dd¡}
| j ||
¡}	|  |	dk¡ |
d dkr(|jdkr |
d | jjA dks(tdƒ‚|  |¡}t| ||ƒS )Nr‚   úint[]r   rÏ   z.DH private numbers did not pass safety checks.)rë   r#  rs   r×  r€   rq   r   rÙ   r
  r×   rå   r  ræ   r$  r%  ÚDH_set0_pqgÚDH_set0_keyrŽ   ÚCryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr®   rÚ  r$   )r{   rî   r#  r  rå   r  ræ   r   r!  rˆ   Úcodesrà   r|   r|   r}   Úload_dh_private_numbersó  s8    


ÿþÿ
zBackend.load_dh_private_numbersc           
      C   sÐ   | j  ¡ }|  || jjk¡ | j || j j¡}|j}|  |j	¡}|  |j
¡}|jd k	rd|  |j¡}n| jj}|  |j¡}| j  ||||¡}|  |dk¡ | j  ||| jj¡}|  |dk¡ |  |¡}	t| ||	ƒS r   )rs   r×  r€   rq   r   rÙ   r
  r#  r×   rå   r  ræ   r$  rÞ  rß  rÚ  r%   )
r{   rî   r  r#  rå   r  ræ   r   rˆ   rà   r|   r|   r}   Úload_dh_public_numbers#  s     


zBackend.load_dh_public_numbersc                 C   s   | j  ¡ }|  || jjk¡ | j || j j¡}|  |j¡}|  |j	¡}|j
d k	r^|  |j
¡}n| jj}| j  ||||¡}|  |dk¡ t| |ƒS r   )rs   r×  r€   rq   r   rÙ   r
  r×   rå   r  ræ   rÞ  r#   )r{   rî   r  rå   r  ræ   rˆ   r|   r|   r}   Úload_dh_parameter_numbers>  s    

z!Backend.load_dh_parameter_numbersc                 C   s´   | j  ¡ }|  || jjk¡ | j || j j¡}|  |¡}|  |¡}|d k	rV|  |¡}n| jj}| j  ||||¡}|  |dk¡ | j 	dd¡}| j  
||¡}|  |dk¡ |d dkS )Nr‚   rÝ  r   )rs   r×  r€   rq   r   rÙ   r
  r×   rÞ  rŽ   rà  )r{   rå   r  ræ   r  rˆ   rá  r|   r|   r}   Údh_parameters_supportedP  s    


zBackend.dh_parameters_supportedc                 C   s   | j jdkS r   )rs   rx   rz   r|   r|   r}   Údh_x942_serialization_supportedf  s    z'Backend.dh_x942_serialization_supportedc                    sx   t ˆ |ƒ}ˆ j d¡}ˆ j ||¡}ˆ  |d ˆ jjk¡ ˆ j |‡ fdd„¡}ˆ  |dk¡ ˆ j |d |¡d d … S )Nzunsigned char **r   c                    s   ˆ j  | d ¡S ©Nr   )rs   rÊ   )Zpointerrz   r|   r}   r5  o  rÁ  z)Backend.x509_name_bytes.<locals>.<lambda>)	r8   rq   rŽ   rs   Zi2d_X509_NAMEr€   r   rÙ   r¼   )r{   rš   Z	x509_nameZpprˆ   r|   rz   r}   Úx509_name_bytesi  s    
 
ÿzBackend.x509_name_bytesc                 C   sh   t |ƒdkrtdƒ‚|  ¡ }| j || jj¡}t |dk¡ | j ||t |ƒ¡}t |dk¡ t	| |ƒS )Né    z%An X25519 public key is 32 bytes longr‚   )
r   r®   ró   rs   ZEVP_PKEY_set_typeÚ
NID_X25519rR  r€   ZEVP_PKEY_set1_tls_encodedpointrE   )r{   rõ   rà   rˆ   r|   r|   r}   Úx25519_load_public_bytest  s      ÿz Backend.x25519_load_public_bytesc              	   C   s¬   t |ƒdkrtdƒ‚d}|  d¡<}||dd…< ||dd …< |  |¡}tj |j| jj	¡}W 5 Q R X |  
|| jj	k¡ | j || jj¡}|  
| j |¡| jjk¡ t| |ƒS )Nré  z&An X25519 private key is 32 bytes longs   0. 0+en" é0   r   rÄ   )r   r®   Ú_zeroed_bytearrayr÷   rR  rs   r}  rm   rq   r   r€   rÙ   rñ   r   rý   rD   )r{   rõ   Zpkcs8_prefixÚbarm   rà   r|   r|   r}   Úx25519_load_private_bytesƒ  s    
ÿz!Backend.x25519_load_private_bytesc                 C   s¨   | j  || jj¡}|  || jjk¡ | j || j j¡}| j  |¡}|  |dk¡ | j d¡}| j  	||¡}|  |dk¡ |  |d | jjk¡ | j |d | j j
¡}|S )Nr‚   úEVP_PKEY **r   )rs   ZEVP_PKEY_CTX_new_idrq   r   r€   rÙ   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initrŽ   ZEVP_PKEY_keygenrñ   )r{   ro  Zevp_pkey_ctxrˆ   Z	evp_ppkeyrà   r|   r|   r}   Ú_evp_pkey_keygen_gc¥  s    zBackend._evp_pkey_keygen_gcc                 C   s   |   | jj¡}t| |ƒS ro   )rñ  rs   rê  rD   rò   r|   r|   r}   Úx25519_generate_key²  s    zBackend.x25519_generate_keyc                 C   s   | j jS ro   )rs   Z#CRYPTOGRAPHY_OPENSSL_110_OR_GREATERrz   r|   r|   r}   Úx25519_supported¶  s    zBackend.x25519_supportedc                 C   s`   t |ƒdkrtdƒ‚| j | jj| jj|t |ƒ¡}|  || jjk¡ | j || jj	¡}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)r   r®   rs   ÚEVP_PKEY_new_raw_public_keyÚNID_X448rq   r   r€   rÙ   rñ   rG   ©r{   rõ   rà   r|   r|   r}   Úx448_load_public_bytes¹  s       ÿzBackend.x448_load_public_bytesc                 C   sl   t |ƒdkrtdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}|  || jjk¡ | j 	|| jj
¡}t| |ƒS )Nrô  z$An X448 private key is 56 bytes long)r   r®   rq   r»   rs   ÚEVP_PKEY_new_raw_private_keyrö  r   r€   rÙ   rñ   rF   ©r{   rõ   rö   rà   r|   r|   r}   Úx448_load_private_bytesÄ  s       ÿzBackend.x448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS ro   )rñ  rs   rö  rF   rò   r|   r|   r}   Úx448_generate_keyÐ  s    zBackend.x448_generate_keyc                 C   s
   | j j S ro   )rs   Ú"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111rz   r|   r|   r}   Úx448_supportedÔ  s    zBackend.x448_supportedc                 C   s
   | j j S ro   ©rs   Z#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Brz   r|   r|   r}   Úed25519_supported×  s    zBackend.ed25519_supportedc                 C   sn   t  d|¡ t|ƒtjkr"tdƒ‚| j | jj| j	j
|t|ƒ¡}|  || j	j
k¡ | j	 || jj¡}t| |ƒS )Nrõ   z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesr   rQ   Ú_ED25519_KEY_SIZEr®   rs   rõ  ÚNID_ED25519rq   r   r€   rÙ   rñ   r-   r÷  r|   r|   r}   Úed25519_load_public_bytesÚ  s       ÿz!Backend.ed25519_load_public_bytesc                 C   sz   t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j 	| jj
| jj|t |ƒ¡}|  || jjk¡ | j || jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longrõ   )r   rQ   r  r®   r   r‹  rq   r»   rs   rù  r  r   r€   rÙ   rñ   r,   rú  r|   r|   r}   Úed25519_load_private_bytesè  s       ÿz"Backend.ed25519_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS ro   )rñ  rs   r  r,   rò   r|   r|   r}   Úed25519_generate_keyö  s    zBackend.ed25519_generate_keyc                 C   s
   | j j S ro   rÿ  rz   r|   r|   r}   Úed448_supportedú  s    zBackend.ed448_supportedc                 C   sl   t  d|¡ t|ƒtkr tdƒ‚| j | jj| jj	|t|ƒ¡}|  
|| jj	k¡ | j || jj¡}t| |ƒS )Nrõ   z$An Ed448 public key is 57 bytes long)r   r  r   r.   r®   rs   rõ  Ú	NID_ED448rq   r   r€   rÙ   rñ   r0   r÷  r|   r|   r}   Úed448_load_public_bytesý  s       ÿzBackend.ed448_load_public_bytesc                 C   sx   t  d|¡ t|ƒtkr tdƒ‚| j |¡}| j | jj	| jj
|t|ƒ¡}|  || jj
k¡ | j || jj¡}t| |ƒS )Nrõ   z%An Ed448 private key is 57 bytes long)r   r‹  r   r.   r®   rq   r»   rs   rù  r  r   r€   rÙ   rñ   r/   rú  r|   r|   r}   Úed448_load_private_bytes
	  s       ÿz Backend.ed448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS ro   )rñ  rs   r  r/   rò   r|   r|   r}   Úed448_generate_key	  s    zBackend.ed448_generate_keyc                 C   sÂ   | j  d|¡}| j  |¡}| j |t|ƒ|t|ƒ|||tj||¡
}	|	dkr®|  ¡ }
| jj	s|  
|
d  | jj| jj¡pŒ|
d  | jj| jj¡¡ d| | d }td |¡ƒ‚| j  |¡d d … S )Nrº   r‚   r   é€   i   zJNot enough memory to derive key. These parameters require {} MB of memory.)rq   rŽ   r»   rs   ZEVP_PBE_scryptr   ri   Z
_MEM_LIMITrÂ   rý  r€   rJ  rŽ  ZERR_R_MALLOC_FAILUREZEVP_R_MEMORY_LIMIT_EXCEEDEDÚMemoryErrorr›   r¼   )r{   r¿   r¾   r½   rì   Úrrå   r’   rÀ   rˆ   rP  Z
min_memoryr|   r|   r}   Úderive_scrypt	  sD            þþþûÿÿzBackend.derive_scryptc                 C   s   t  |¡}| j |¡| jjkS ro   )r   Z_aead_cipher_namers   rÅ  rq   r   )r{   r©   Úcipher_namer|   r|   r}   Úaead_cipher_supported;	  s    
ÿzBackend.aead_cipher_supportedc              
   c   s&   t |ƒ}z
|V  W 5 |  ||¡ X dS )zÁ
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)Ú	bytearrayÚ
_zero_data)r{   r½   rî  r|   r|   r}   rí  A	  s    
zBackend._zeroed_bytearrayc                 C   s   t |ƒD ]}d||< qd S rç  r   )r{   rõ   r½   rd  r|   r|   r}   r  N	  s    zBackend._zero_datac                 c   sf   |dkr| j jV  nNt|ƒ}| j  d|d ¡}| j  |||¡ z
|V  W 5 |  | j  d|¡|¡ X dS )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr‹   r‚   z	uint8_t *)rq   r   r   rŽ   Zmemmover  Úcast)r{   rõ   Zdata_lenr’   r|   r|   r}   Ú_zeroed_null_terminated_bufU	  s    
z#Backend._zeroed_null_terminated_bufc              	   C   sÊ  |d k	rt  d|¡ |  |¡}| j |j| jj¡}|| jjkrN|  ¡  t	dƒ‚| j 
|| jj¡}| j d¡}| j d¡}| j d¡}|  |¡}| j |||||¡}	W 5 Q R X |	dkrÆ|  ¡  t	dƒ‚d }
d }g }|d | jjkr| j 
|d | jj¡}|  |¡}|d | jjkr6| j 
|d | jj¡}t| |ƒ}
|d | jjkrÀ| j 
|d | jj¡}| j |d ¡}t|ƒD ]H}| j ||¡}| j 
|| jj¡}|  || jjk¡ | t| |ƒ¡ qv||
|fS )Nrr  z!Could not deserialize PKCS12 datarð  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data)r   r‹  r÷   rs   Zd2i_PKCS12_biorm   rq   r   rÂ   r®   rÙ   ZPKCS12_freerŽ   r  ZPKCS12_parserñ   r  rS  rH   Zsk_X509_freeZsk_X509_numr   Zsk_X509_valuer€   ry   )r{   rõ   rr  rm   Zp12Zevp_pkey_ptrZx509_ptrZsk_x509_ptrZpassword_bufrˆ   r²  r–   Zadditional_certificatesrà   r	   Zsk_x509rÕ   rd  r|   r|   r}   Ú%load_key_and_certificates_from_pkcs12l	  sP    
    ÿ

z-Backend.load_key_and_certificates_from_pkcs12c                 C   s   | j jdkS r   )rs   ZCryptography_HAS_POLY1305rz   r|   r|   r}   Úpoly1305_supportedš	  s    zBackend.poly1305_supportedc                 C   s*   t  d|¡ t|ƒtkr tdƒ‚t| |ƒS )Nr–   zA poly1305 key is 32 bytes long)r   r‹  r   r@   r®   rA   )r{   r–   r|   r|   r}   Úcreate_poly1305_ctx	  s    zBackend.create_poly1305_ctx)N)N)ŒÚ__name__Ú
__module__Ú__qualname__Ú__doc__rš   r~   r€   r‰   Ú
contextlibr   rŠ   rv   r“   r”   r•   r˜   rž   r    r¡   r¤   r¥   r­   r±   ru   r·   r¸   r¹   rÁ   rÂ   rÍ   r×   rá   rä   rï   rð   ró   rÜ   r÷   rø   rú   r  r  r  r  r  r  r  r"  r&  r(  r)  r  r*  r+  r-  r.  rQ  rX  rB  rU  r\  ra  rH  rj  rc  rp  rs  rx  ry  r{  rz  r~  r  r  r‚  r„  r…  r‡  rˆ  rq  ru  r•  r–  rš  rŸ  r   r¨  r«  r—  r­  r¯  r´  r¸  r¹  rº  r˜  r‘  r¤  r©  rž  rÌ  rÈ  rÒ  rÑ  rÕ  rÙ  rÚ  rÛ  rÜ  râ  rã  rä  rå  ræ  rè  rë  rï  rñ  rò  ró  rø  rû  rü  rþ  r   r  r  r  r  r	  r
  r  r  r  rí  r  r  r  r  r  r|   r|   r|   r}   rn   a   s  
	9"++	UYQ"


1-	"

P

_=5
0".rn   c                   @   s   e Zd Zdd„ Zdd„ ZdS )r²   c                 C   s
   || _ d S ro   )Ú_fmt)r{   Zfmtr|   r|   r}   r~   ¦	  s    zGetCipherByName.__init__c                 C   s&   | j j||d ¡ }|j | d¡¡S )N)r©   rª   r   )r  r›   Úlowerrs   rÅ  rœ   )r{   rR  r©   rª   r  r|   r|   r}   Ú__call__©	  s    zGetCipherByName.__call__N)r  r  r  r~   r   r|   r|   r|   r}   r²   ¥	  s   r²   c                 C   s"   d  |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsrÏ   r   )r›   rÞ   rs   rÅ  rœ   )rR  r©   rª   r  r|   r|   r}   rµ   ®	  s    rµ   )˜Z
__future__r   r   r   rÔ  Úcollectionsr  r³   r   rÆ   Z	six.movesr   Zcryptographyr   r	   Zcryptography.exceptionsr
   r   Zcryptography.hazmat._derr   r   r   r   r   Z'cryptography.hazmat.backends.interfacesr   r   r   r   r   r   r   r   r   r   r   r   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr!   Z0cryptography.hazmat.backends.openssl.decode_asn1r"   Z'cryptography.hazmat.backends.openssl.dhr#   r$   r%   r&   Z(cryptography.hazmat.backends.openssl.dsar'   r(   r)   Z'cryptography.hazmat.backends.openssl.ecr*   r+   Z,cryptography.hazmat.backends.openssl.ed25519r,   r-   Z*cryptography.hazmat.backends.openssl.ed448r.   r/   r0   Z0cryptography.hazmat.backends.openssl.encode_asn1r1   r2   r3   r4   r5   r6   r7   r8   r9   Z+cryptography.hazmat.backends.openssl.hashesr;   Z)cryptography.hazmat.backends.openssl.hmacr=   Z)cryptography.hazmat.backends.openssl.ocspr>   r?   Z-cryptography.hazmat.backends.openssl.poly1305r@   rA   Z(cryptography.hazmat.backends.openssl.rsarB   rC   Z+cryptography.hazmat.backends.openssl.x25519rD   rE   Z)cryptography.hazmat.backends.openssl.x448rF   rG   Z)cryptography.hazmat.backends.openssl.x509rH   rI   rJ   rK   Z$cryptography.hazmat.bindings.opensslrL   Zcryptography.hazmat.primitivesrM   rN   Z)cryptography.hazmat.primitives.asymmetricrO   rP   rQ   rR   rS   Z1cryptography.hazmat.primitives.asymmetric.paddingrT   rU   rV   rW   Z1cryptography.hazmat.primitives.ciphers.algorithmsrX   rY   rZ   r[   r\   r]   r^   r_   r`   Z,cryptography.hazmat.primitives.ciphers.modesra   rb   rc   rd   re   rf   rg   rh   Z"cryptography.hazmat.primitives.kdfri   Z,cryptography.hazmat.primitives.serializationrj   Zcryptography.x509rk   Ú
namedtuplerl   Zregister_interfaceZregister_interface_ifrp   rr   ZCryptography_HAS_SCRYPTÚobjectrn   r²   rµ   rR  r|   r|   r|   r}   Ú<module>   sš   <,,(
 ÿ*                  G	