U
    ÒZj7‹ ã                   @   s¸  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZmZ d dlmZm Z  d dl!m"Z"m#Z#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5mZ6 d dl7m8Z8 d dl9m:Z:m;Z; d dl<m=Z= d dl>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZF d dlGmHZHmIZImJZJmKZK d dlLmMZMmNZNmOZO d dlPmQZQmRZR d dlSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ d dl`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZi d dljmkZk d dllmmZmmnZn d dlompZpmqZqmrZrmsZsmtZt e  ud d!d"g¡ZvG d#d$„ d$ƒZwG d%d&„ d&ƒZxG d'd(„ d(ƒZyexeTd)œd*d+„Zzexƒ Z{dS ),é    N)Úcontextmanager)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)Úaead)Ú_CipherContext©Ú_CMACContext)Ú_DHParametersÚ_DHPrivateKeyÚ_DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey©Ú_HashContext©Ú_HMACContext)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)r   )Úbinding)ÚhashesÚserialization)ÚAsymmetricPadding)ÚdhÚdsaÚecÚed25519Úed448ÚrsaÚx25519Úx448)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)Ú#CERTIFICATE_ISSUER_PUBLIC_KEY_TYPESÚPRIVATE_KEY_TYPESÚPUBLIC_KEY_TYPES)ÚBlockCipherAlgorithmÚCipherAlgorithm)ÚAESÚAES128ÚAES256ÚARC4ÚCamelliaÚChaCha20ÚSM4Ú	TripleDESÚ_BlowfishInternalÚ_CAST5InternalÚ_IDEAInternalÚ_SEEDInternal)	ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚModeÚOFBÚXTS)Úscrypt)Úpkcs7Ússh)ÚPBESÚPKCS12CertificateÚPKCS12KeyAndCertificatesÚ_ALLOWED_PKCS12_TYPESÚ_PKCS12_CAS_TYPESÚ
_MemoryBIOÚbioZchar_ptrc                   @   s   e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú__qualname__© r]   r]   úo/var/www/html/TRUCKING_PROJECT/venv/lib/python3.8/site-packages/cryptography/hazmat/backends/openssl/backend.pyrY   ƒ   s   rY   c                   @   sf
  e Zd ZdZdZddddddhZefZej	ej
ejejejejejejejejejejfZejejejejfZd	Zd
Zdd	> Zd	Zde> Z dd„ Z!e"dœdd„Z#�dDe$e%j&e%j'e(j)  ddœdd„Z*e$dœdd„Z+ddœdd„Z,ddœdd„Z-e.j/dd„ ƒZ0ddœdd„Z1e"dœdd „Z2e"dœd!d"„Z3e4dœd#d$„Z5e6ej7e8d%œd&d'„Z9ej7d(œd)d*„Z:ej7d(œd+d,„Z;ej7e$d-œd.d/„Z<ej7e$d-œd0d1„Z=e$dœd2d3„Z>ej7e$d-œd4d5„Z?ej7ej@d-œd6d7„ZAeBeCe$d8œd9d:„ZDd;d<„ ZEddœd=d>„ZFeBeCeGd8œd?d@„ZHeBeCeGd8œdAdB„ZIej7e$d-œdCdD„ZJej7e4e6e4e6e6dEœdFdG„ZKe%j'e(j) dœdHdI„ZLe%j'e(jM dœdJdK„ZNe4dœdLdM„ZO�dEe4dNœdOdP„ZPe4e4eQjRdQœdRdS„ZSe4e4e$dQœdTdU„ZTeQjUeQjRdVœdWdX„ZVeQjWeQjXdVœdYdZ„ZYd[d\„ ZZd]d^„ Z[e6d_œd`da„Z\dbdc„ Z]e6dœddde„Z^e_dœdfdg„Z`eadœdhdi„Zbej7e$d-œdjdk„Zcede$dlœdmdn„Zee4efjgdoœdpdq„Zhefjgefjidrœdsdt„Zje4efjidoœdudv„Zkdwdx„ ZlefjmefjidVœdydz„ZnefjoefjpdVœd{d|„ZqefjrefjgdVœd}d~„Zsdd€„ Zte$dœd�d‚„Zuej7e$d-œdƒd„„Zve$dœd…d†„Zwexeyd-œd‡dˆ„Zze6e%j&e6 e_d‰œdŠd‹„Z{e6eadŒœd�dŽ„Z|e6e}j~dŒœd�d�„Ze6e%j&e6 e_d‰œd‘d’„Z€d“d”„ Z�e6eadŒœd•d–„Z‚e6e}j~dŒœd—d˜„Zƒe„j…e%j†d™œdšd›„Z‡e%j†e„j…dœœd�dž„Zˆe„j‰e%j†dŸœd d¡„ZŠe%j†e„j‰d¢œd£d¤„Z‹e„jŒe%j†d¥œd¦d§„Z�e%j†e„jŒd¨œd©dª„ZŽe„jŒe�e$d«œd¬d­„Z�e„j‰e$dŸœd®d¯„Z‘d°d±„ Z’d²d³„ Z“e%j”dœd´dµ„Z•ej–e$d¶œd·d¸„Z—ej˜ej–e$d¹œdºd»„Z™ej–ejšd¶œd¼d½„Z›ejœejšdVœd¾d¿„Z�ejžejŸdVœdÀdÁ„Z ej–e6ejŸdÂœdÃdÄ„Z¡e4ej–ejšdÅœdÆdÇ„Z¢ej–dÈœdÉdÊ„Z£e4dËœdÌdÍ„Z¤ej¥ej–e$dÎœdÏdÐ„Z¦dÑdÒ„ Z§ej–e4d¶œdÓdÔ„Z¨e/dÕdÖ„ ƒZ©d×dØ„ Zªe4e4dÙœdÚdÛ„Z«e¬j­e¬j®e¬j¯e6dÜœdÝdÞ„Z°dßdà„ Z±dádâ„ Z²e¬j­e¬j³e6dãœdädå„Z´e$dœdædç„Zµe4e4e}j~dèœdédê„Z¶dëdì„ Z·e}j~e}j¸drœdídî„Z¹e4e4e}j¸dèœdïdð„Zºe}j»e}j¸dVœdñdò„Z¼e}j½e}j¾dVœdódô„Z¿e}jÀe}j~dVœdõdö„ZÁ�dFe4e4e%j&e4 e$d÷œdødù„ZÂe$dœdúdû„ZÃe6eÄjÅdŒœdüdý„ZÆe6eÄjÇdŒœdþdÿ„ZÈ�d �d„ ZÉeÄjÇdœ�d�d„ZÊe$dœ�d�d„ZËe6eÌjÍdŒœ�d�d„ZÎe6eÌjÏdŒœ�d�d	„ZÐeÌjÏdœ�d
�d„ZÑe$dœ�d�d„ZÒe$dœ�d�d„ZÓe6eÔjÕdŒœ�d�d„ZÖe6eÔj×dŒœ�d�d„ZØeÔj×dœ�d�d„ZÙe$dœ�d�d„ZÚe6eÛjÜdŒœ�d�d„ZÝe6eÛjÞdŒœ�d�d„ZßeÛjÞdœ�d�d„Zàe6e6e4e4e4e4e6�dœ�d�d „Záe$dœ�d!�d"„Zâe.j/e4e%jãeä �d#œ�d$�d%„ƒZåe4d�d#œ�d&�d'„Zæe.j/�d(�d)„ ƒZçe6e%j&e6 e%jèe%j&e_ e%j&e„j… e%j'e„j… f d‰œ�d*�d+„Zée6e%j&e6 eêd‰œ�d,�d-„Zëe%j&e6 e%j&eì e%j&e„j… e%j&e%j'eí  e¬j¯e6�d.œ�d/�d0„Zîe$dœ�d1�d2„Zïe6eð�d3œ�d4�d5„Zñe$dœ�d6�d7„Zòe6e%j'e„j… dŒœ�d8�d9„Zóe6e%j'e„j… dŒœ�d:�d;„Zô�d<�d=„ Zõe%j'e„j… e¬j­�d>œ�d?�d@„Zöe÷jøe¬j­e%j'e÷jù e6�dAœ�dB�dC„ZúdS (G  ÚBackendz)
    OpenSSL API binding interfaces.
    Zopenssls   aes-128-ccms   aes-192-ccms   aes-256-ccms   aes-128-gcms   aes-192-gcms   aes-256-gcmé   i  é   c                 C   sˆ   t  ¡ | _| jj| _| jj| _d| _|  ¡ | _	i | _
|  ¡  | j	rX| jjrXt dt¡ n|  ¡  | jjg| _| jjr„| j | jj¡ d S )NFz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r%   ZBindingÚ_bindingÚffiÚ_ffiÚlibÚ_libÚ_rsa_skip_check_keyÚ_is_fips_enabledÚ_fips_enabledÚ_cipher_registryÚ_register_default_ciphersÚ"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEÚwarningsÚwarnÚUserWarningÚactivate_osrandom_engineZEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendZEVP_PKEY_DHX©Úselfr]   r]   r^   Ú__init__¹   s     



þzBackend.__init__)Úreturnc                 C   s   d  |  ¡ | j¡S )Nz'<OpenSSLBackend(version: {}, FIPS: {})>)ÚformatÚopenssl_version_textri   rt   r]   r]   r^   Ú__repr__Í   s     ÿzBackend.__repr__N)ÚokÚerrorsrw   c                 C   s   t j| j||d�S )N)r|   )r%   Z_openssl_assertrf   )ru   r{   r|   r]   r]   r^   Úopenssl_assertÒ   s    zBackend.openssl_assertc                 C   sH   | j jr| j  | jj¡}nt| j ddd„ ƒƒ }|dkr@| j  ¡  t|ƒS )NZ	FIPS_modec                   S   s   dS ©Nr   r]   r]   r]   r]   r^   Ú<lambda>ß   ó    z*Backend._is_fips_enabled.<locals>.<lambda>r   )rf   ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrd   ÚNULLÚgetattrZERR_clear_errorÚbool)ru   Úmoder]   r]   r^   rh   Ù   s    ÿ
zBackend._is_fips_enabledc                 C   s$   | j  ¡  |  ¡ st‚|  ¡ | _d S ©N)rb   Ú_enable_fipsrh   ÚAssertionErrorri   rt   r]   r]   r^   r†   æ   s    
zBackend._enable_fipsc                 C   sf   | j jrb| j  ¡ }|| jjkrb| j  |¡ | j  | jj¡}|  |dk¡ | j  |¡}|  |dk¡ d S ©Nra   )	rf   rl   ZENGINE_get_default_RANDrd   r�   ZENGINE_unregister_RANDÚRAND_set_rand_methodr}   ÚENGINE_finish©ru   ÚeÚresr]   r]   r^   Úactivate_builtin_randomí   s    
zBackend.activate_builtin_randomc              
   c   s‚   | j  | j j¡}|  || jjk¡ | j  |¡}|  |dk¡ z
|V  W 5 | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ X d S rˆ   )	rf   ZENGINE_by_idZCryptography_osrandom_engine_idr}   rd   r�   ZENGINE_initZENGINE_freerŠ   r‹   r]   r]   r^   Ú_get_osurandom_engineú   s    
zBackend._get_osurandom_enginec              	   C   s`   | j jr\|  ¡  |  ¡ � }| j  |¡}|  |dk¡ W 5 Q R X | j  | jj¡}|  |dk¡ d S rˆ   )	rf   rl   rŽ   r�   ZENGINE_set_default_RANDr}   r‰   rd   r�   r‹   r]   r]   r^   rp     s    
z Backend.activate_osrandom_enginec              	   C   s`   | j  dd¡}|  ¡ �2}| j |dt|ƒ|| j jd¡}|  |dk¡ W 5 Q R X | j  |¡ 	d¡S )Núchar[]é@   s   get_implementationr   Úascii)
rd   Únewr�   rf   ZENGINE_ctrl_cmdÚlenr�   r}   ÚstringÚdecode)ru   ÚbufrŒ   r�   r]   r]   r^   Úosrandom_engine_implementation  s    
     ÿz&Backend.osrandom_engine_implementationc                 C   s   | j  | j | jj¡¡ d¡S )zÀ
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r’   )rd   r•   rf   ZOpenSSL_versionÚOPENSSL_VERSIONr–   rt   r]   r]   r^   ry   #  s
    ÿþzBackend.openssl_version_textc                 C   s
   | j  ¡ S r…   )rf   ZOpenSSL_version_numrt   r]   r]   r^   Úopenssl_version_number.  s    zBackend.openssl_version_number)ÚkeyÚ	algorithmrw   c                 C   s   t | ||ƒS r…   r   )ru   r›   rœ   r]   r]   r^   Úcreate_hmac_ctx1  s    zBackend.create_hmac_ctx)rœ   c                 C   sL   |j dks|j dkr0d |j |jd ¡ d¡}n|j  d¡}| j |¡}|S )NÚblake2bÚblake2sz{}{}é   r’   )Únamerx   Údigest_sizeÚencoderf   ZEVP_get_digestbyname)ru   rœ   ÚalgÚevp_mdr]   r]   r^   Ú_evp_md_from_algorithm6  s     ÿþzBackend._evp_md_from_algorithmc                 C   s    |   |¡}|  || jjk¡ |S r…   )r¦   r}   rd   r�   ©ru   rœ   r¥   r]   r]   r^   Ú_evp_md_non_null_from_algorithmA  s    
z'Backend._evp_md_non_null_from_algorithm)rœ   rw   c                 C   s,   | j rt|| jƒsdS |  |¡}|| jjkS ©NF)ri   Ú
isinstanceÚ_fips_hashesr¦   rd   r�   r§   r]   r]   r^   Úhash_supportedF  s    
zBackend.hash_supportedc                 C   s    | j rt|tjƒrdS |  |¡S r©   ©ri   rª   r&   ÚSHA1r¬   ©ru   rœ   r]   r]   r^   Úsignature_hash_supportedM  s    z Backend.signature_hash_supportedc                 C   s   | j r
dS | jjdkS d S ©NFra   )ri   rf   ZCryptography_HAS_SCRYPTrt   r]   r]   r^   Úscrypt_supportedV  s    zBackend.scrypt_supportedc                 C   s    | j rt|tjƒrdS |  |¡S )NTr­   r¯   r]   r]   r^   Úhmac_supported\  s    zBackend.hmac_supportedc                 C   s
   t | |ƒS r…   r   r¯   r]   r]   r^   Úcreate_hash_ctxc  s    zBackend.create_hash_ctx)Úcipherr„   rw   c                 C   s`   | j rt|| jƒsdS z| jt|ƒt|ƒf }W n tk
rF   Y dS X || ||ƒ}| jj|kS r©   )ri   rª   Ú_fips_ciphersrj   ÚtypeÚKeyErrorrd   r�   )ru   rµ   r„   ÚadapterÚ
evp_cipherr]   r]   r^   Úcipher_supportedh  s    zBackend.cipher_supportedc                 C   s0   ||f| j krtd ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)rj   Ú
ValueErrorrx   )ru   Ú
cipher_clsÚmode_clsr¹   r]   r]   r^   Úregister_cipher_adapterv  s     ÿÿzBackend.register_cipher_adapterc                 C   sŽ  t ttfD ].}ttttttt	fD ]}|  
||tdƒ¡ q q
tttttfD ]}|  
t|tdƒ¡ qHttttfD ]}|  
t|tdƒ¡ ql|  
tttdƒ¡ ttttfD ]}|  
t|tdƒ¡ q¢ttttfD ]}|  
t|tdƒ¡ qÆt ttgttttg¡D ]\}}|  
||tdƒ¡ qö|  
ttd ƒtdƒ¡ |  
ttd ƒtdƒ¡ |  
ttd ƒtd	ƒ¡ |  
t tt¡ tttttfD ]}|  
t|td
ƒ¡ �qpd S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20zsm4-{mode.name})r:   r;   r<   rF   rI   rJ   rM   rG   rH   rK   r¿   ÚGetCipherByNamer>   rA   rB   rE   Ú	itertoolsÚproductrC   rD   r=   r·   rY   r?   rN   Ú_get_xts_cipherr@   )ru   r½   r¾   r]   r]   r^   rk     sz    ÿýý  ÿ  ÿ  ÿ  ÿ
þý  ÿ  ÿz!Backend._register_default_ciphersc                 C   s   t | ||t jƒS r…   )r   Z_ENCRYPT©ru   rµ   r„   r]   r]   r^   Úcreate_symmetric_encryption_ctx³  s    z'Backend.create_symmetric_encryption_ctxc                 C   s   t | ||t jƒS r…   )r   Z_DECRYPTrÄ   r]   r]   r^   Úcreate_symmetric_decryption_ctx¸  s    z'Backend.create_symmetric_decryption_ctxc                 C   s
   |   |¡S r…   )r³   r¯   r]   r]   r^   Úpbkdf2_hmac_supported½  s    zBackend.pbkdf2_hmac_supported)rœ   ÚlengthÚsaltÚ
iterationsÚkey_materialrw   c           
   
   C   sh   | j  d|¡}|  |¡}| j  |¡}| j |t|ƒ|t|ƒ||||¡}	|  |	dk¡ | j  |¡d d … S )Núunsigned char[]ra   )	rd   r“   r¨   Úfrom_bufferrf   ZPKCS5_PBKDF2_HMACr”   r}   Úbuffer)
ru   rœ   rÈ   rÉ   rÊ   rË   r—   r¥   Úkey_material_ptrr�   r]   r]   r^   Úderive_pbkdf2_hmacÀ  s    
ø
zBackend.derive_pbkdf2_hmacc                 C   s   t  | j¡S r…   )r%   Ú_consume_errorsrf   rt   r]   r]   r^   rÑ   Ø  s    zBackend._consume_errorsc                 C   s   t  | j¡S r…   )r%   Ú_consume_errors_with_textrf   rt   r]   r]   r^   rÒ   Û  s    z!Backend._consume_errors_with_textc                 C   sz   || j jkst‚|  | j |¡ ¡ | j |¡}| j  d|¡}| j ||¡}|  |dk¡ t	 
| j  |¡d |… d¡}|S )NrÌ   r   Úbig)rd   r�   r‡   r}   rf   ZBN_is_negativeZBN_num_bytesr“   Z	BN_bn2binÚintÚ
from_bytesrÎ   )ru   ÚbnZbn_num_bytesZbin_ptrZbin_lenÚvalr]   r]   r^   Ú
_bn_to_intà  s    zBackend._bn_to_int)Únumc                 C   sn   |dks|| j jkst‚|dkr(| j j}| t| ¡ d d ƒd¡}| j |t|ƒ|¡}|  	|| j jk¡ |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @ra   rÓ   )
rd   r�   r‡   Úto_bytesrÔ   Ú
bit_lengthrf   Z	BN_bin2bnr”   r}   )ru   rÙ   rÖ   ÚbinaryZbn_ptrr]   r]   r^   Ú
_int_to_bnì  s    zBackend._int_to_bn)Úpublic_exponentÚkey_sizerw   c                 C   s”   t  ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||| jƒS rˆ   )r.   Z_verify_rsa_parametersrf   ÚRSA_newr}   rd   r�   ÚgcÚRSA_freerÝ   ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyr   rg   )ru   rÞ   rß   Ú	rsa_cdatarÖ   r�   Úevp_pkeyr]   r]   r^   Úgenerate_rsa_private_keyý  s(    

   ÿ
   ÿz Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )Né   ra   r   i   r]   )ru   rÞ   rß   r]   r]   r^   Ú!generate_rsa_parameters_supported  s
    
ÿýz)Backend.generate_rsa_parameters_supported)Únumbersrw   c              
   C   s6  t  |j|j|j|j|j|j|jj	|jj
¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |jj	¡}	|  |jj
¡}
| j |||¡}|  |dk¡ | j ||
|	|¡}|  |dk¡ | j ||||¡}|  |dk¡ |  |¡}t| ||| jƒS rˆ   )r.   Z_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersrŒ   Únrf   rà   r}   rd   r�   rá   râ   rÝ   ZRSA_set0_factorsÚRSA_set0_keyZRSA_set0_crt_paramsrä   r   rg   )ru   rê   rå   rë   rì   rí   rî   rï   rð   rŒ   rò   r�   ræ   r]   r]   r^   Úload_rsa_private_numbers  sD    ø


   ÿz Backend.load_rsa_private_numbersc                 C   s�   t  |j|j¡ | j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS rˆ   )r.   Z_check_public_key_componentsrŒ   rò   rf   rà   r}   rd   r�   rá   râ   rÝ   ró   rä   r    )ru   rê   rå   rŒ   rò   r�   ræ   r]   r]   r^   Úload_rsa_public_numbers@  s    

zBackend.load_rsa_public_numbersc                 C   s2   | j  ¡ }|  || jjk¡ | j || j j¡}|S r…   )rf   ZEVP_PKEY_newr}   rd   r�   rá   ÚEVP_PKEY_free©ru   ræ   r]   r]   r^   Ú_create_evp_pkey_gcO  s    
zBackend._create_evp_pkey_gcc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_RSAr}   )ru   rå   ræ   r�   r]   r]   r^   rä   U  s    zBackend._rsa_cdata_to_evp_pkey)Údatac                 C   sH   | j  |¡}| j |t|ƒ¡}|  || j jk¡ t| j  || jj	¡|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rd   rÍ   rf   ZBIO_new_mem_bufr”   r}   r�   rW   rá   ÚBIO_free)ru   rù   Údata_ptrrX   r]   r]   r^   Ú_bytes_to_bio[  s    zBackend._bytes_to_bioc                 C   sP   | j  ¡ }|  || jjk¡ | j  |¡}|  || jjk¡ | j || j j¡}|S )z.
        Creates an empty memory BIO.
        )rf   Z	BIO_s_memr}   rd   r�   ZBIO_newrá   rú   )ru   Z
bio_methodrX   r]   r]   r^   Ú_create_mem_bio_gch  s    
zBackend._create_mem_bio_gcc                 C   s\   | j  d¡}| j ||¡}|  |dk¡ |  |d | j jk¡ | j  |d |¡dd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rd   r“   rf   ZBIO_get_mem_datar}   r�   rÎ   )ru   rX   r—   Zbuf_lenÚbio_datar]   r]   r^   Ú_read_mem_bios  s    zBackend._read_mem_bioc           	      C   sD  | j  |¡}|| j jkrX| j  |¡}|  || jjk¡ | j || j j¡}t	| ||| j
ƒS || j jkrä| j jsä| j jsä| j jsä| j  |¡}|  || jjk¡ | j || j j¡}|  ¡ }| j  ||¡}|  |dk¡ | j|  |¡dd�S || j jk�r.| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jk�rx| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jk�rÀ| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒk�rÞt | |ƒS |t| j ddƒk�rüt!| |ƒS |t| j ddƒk�rt"| |ƒS |t| j ddƒk�r8t#| |ƒS t$dƒ‚dS )	zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ra   N)ÚpasswordÚEVP_PKEY_ED25519ÚEVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.)%rf   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAr}   rd   r�   rá   râ   r   rg   ÚEVP_PKEY_RSA_PSSÚCRYPTOGRAPHY_IS_LIBRESSLÚCRYPTOGRAPHY_IS_BORINGSSLÚ#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Erý   Úi2d_RSAPrivateKey_bioÚload_der_private_keyrÿ   ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer   rq   ÚEVP_PKEY_get1_DHÚDH_freer   r‚   r   r#   r!   r   r   )	ru   ræ   Úkey_typerå   rX   r�   Ú	dsa_cdataÚec_cdataÚdh_cdatar]   r]   r^   Ú_evp_pkey_to_private_key~  sj       ÿ
ÿþýü
 ÿ



z Backend._evp_pkey_to_private_keyc           
      C   sJ  | j  |¡}|| j jkrT| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krÜ| j jsÜ| j jsÜ| j jsÜ| j  |¡}|  || jjk¡ | j || j j¡}|  ¡ }| j  ||¡}|  |dk¡ |  |  |¡¡S || j jk�r&| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jk�r~| j  |¡}|| jjk�r`|  ¡ }td|ƒ‚| j || j j¡}t| ||ƒS || jk�rÆ| j  |¡}	|  |	| jjk¡ | j |	| j j¡}	t| |	|ƒS |t | j ddƒk�rät!| |ƒS |t | j ddƒk�rt"| |ƒS |t | j ddƒk�r t#| |ƒS |t | j ddƒk�r>t$| |ƒS t%dƒ‚dS )	zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        ra   zUnable to load EC keyr  Nr  r  r  r  )&rf   r  r  r  r}   rd   r�   rá   râ   r    r	  r
  r  r  rý   Úi2d_RSAPublicKey_bioÚload_der_public_keyrÿ   r  r  r  r   r  r  rÒ   r¼   r  r   rq   r  r  r   r‚   r   r$   r"   r   r   )
ru   ræ   r  rå   rX   r�   r  r  r|   r  r]   r]   r^   Ú_evp_pkey_to_public_key¾  s^    
ÿþýü




zBackend._evp_pkey_to_public_keyc                 C   s   t |tjtjtjtjtjfƒS r…   )rª   r&   r®   ÚSHA224ÚSHA256ÚSHA384ÚSHA512r¯   r]   r]   r^   Ú_oaep_hash_supportedø  s    ûþzBackend._oaep_hash_supported)Úpaddingrw   c                 C   s†   t |tƒrdS t |tƒrNt |jtƒrN| jr>t |jjtjƒr>dS |  	|jj¡S n4t |t
ƒr~t |jtƒr~|  |jj¡o||  |j¡S dS d S )NTF)rª   r3   r4   Z_mgfr1   ri   Ú
_algorithmr&   r®   r¬   r2   r#  )ru   r$  r]   r]   r^   Úrsa_padding_supported  s     
 ÿÿ
þzBackend.rsa_padding_supported)rß   rw   c              	   C   s~   |dkrt dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}|  |dk¡ t	| |ƒS )N)i   r`   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   ra   )
r¼   rf   ÚDSA_newr}   rd   r�   rá   r  ZDSA_generate_parameters_exr   )ru   rß   Úctxr�   r]   r]   r^   Úgenerate_dsa_parameters  s$    ÿ
ù
zBackend.generate_dsa_parameters)Ú
parametersrw   c                 C   sT   | j  |j¡}|  || jjk¡ | j || j j¡}| j  |¡ |  	|¡}t
| ||ƒS r…   )rf   ZDSAparams_dupZ
_dsa_cdatar}   rd   r�   rá   r  ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr   )ru   r*  r(  ræ   r]   r]   r^   Úgenerate_dsa_private_key/  s    ÿ
z Backend.generate_dsa_private_keyc                 C   s   |   |¡}|  |¡S r…   )r)  r,  )ru   rß   r*  r]   r]   r^   Ú'generate_dsa_private_key_and_parameters<  s    
z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j  ||||¡}|  |dk¡ | j  |||¡}|  |dk¡ d S rˆ   )rf   ÚDSA_set0_pqgr}   ZDSA_set0_key)ru   r  rë   rì   ÚgÚpub_keyÚpriv_keyr�   r]   r]   r^   Ú_dsa_cdata_set_valuesB  s    zBackend._dsa_cdata_set_valuesc           
      C   s¨   t  |¡ |jj}| j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}|  |j¡}|  |jj¡}|  |j¡}|  ||||||¡ |  |¡}	t| ||	ƒS r…   )r*   Z_check_dsa_private_numbersrñ   Úparameter_numbersrf   r'  r}   rd   r�   rá   r  rÝ   rë   rì   r/  ÚyÚxr2  r+  r   )
ru   rê   r3  r  rë   rì   r/  r0  r1  ræ   r]   r]   r^   Úload_dsa_private_numbersH  s    


z Backend.load_dsa_private_numbersc           	      C   s¢   t  |j¡ | j ¡ }|  || jjk¡ | j || jj	¡}|  
|jj¡}|  
|jj¡}|  
|jj¡}|  
|j¡}| jj}|  ||||||¡ |  |¡}t| ||ƒS r…   )r*   Ú_check_dsa_parametersr3  rf   r'  r}   rd   r�   rá   r  rÝ   rë   rì   r/  r4  r2  r+  r   )	ru   rê   r  rë   rì   r/  r0  r1  ræ   r]   r]   r^   Úload_dsa_public_numbers]  s    

zBackend.load_dsa_public_numbersc                 C   s†   t  |¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|  	|j¡}| j ||||¡}|  |dk¡ t| |ƒS rˆ   )r*   r7  rf   r'  r}   rd   r�   rá   r  rÝ   rë   rì   r/  r.  r   )ru   rê   r  rë   rì   r/  r�   r]   r]   r^   Úload_dsa_parameter_numbersp  s    

z"Backend.load_dsa_parameter_numbersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_DSAr}   )ru   r  ræ   r�   r]   r]   r^   r+  €  s    zBackend._dsa_cdata_to_evp_pkeyc                 C   s   | j  S r…   )ri   rt   r]   r]   r^   Údsa_supported†  s    zBackend.dsa_supportedc                 C   s   |   ¡ sdS |  |¡S r©   )r:  r°   r¯   r]   r]   r^   Údsa_hash_supported‰  s    zBackend.dsa_hash_supportedc                 C   s   |   |td|j ƒ¡S )Nó    )r»   rF   Ú
block_sizer¯   r]   r]   r^   Úcmac_algorithm_supportedŽ  s     ÿz Backend.cmac_algorithm_supportedc                 C   s
   t | |ƒS r…   r	   r¯   r]   r]   r^   Úcreate_cmac_ctx“  s    zBackend.create_cmac_ctx)rù   r   rw   c                 C   s   |   | jj| j||¡S r…   )Ú	_load_keyrf   ZPEM_read_bio_PrivateKeyr  )ru   rù   r   r]   r]   r^   Úload_pem_private_key–  s    üzBackend.load_pem_private_key)rù   rw   c                 C   sî   |   |¡}| j d¡}| j |j| jj| j | jjd¡|¡}|| jjkrd| j 	|| jj
¡}|  |¡S |  ¡  | j |j¡}|  |dk¡ | j |j| jj| j | jjd¡|¡}|| jjkrâ| j 	|| jj¡}|  |¡}t| ||ƒS |  ¡  d S )NúCRYPTOGRAPHY_PASSWORD_DATA *ÚCryptography_pem_password_cbra   )rü   rd   r“   rf   ZPEM_read_bio_PUBKEYrX   r�   Ú	addressofÚ_original_librá   rö   r  rÑ   Ú	BIO_resetr}   ZPEM_read_bio_RSAPublicKeyrâ   rä   r    Ú_handle_key_loading_error)ru   rù   Úmem_bioÚuserdataræ   r�   rå   r]   r]   r^   Úload_pem_public_key   s>    
 ÿú
 ÿú
zBackend.load_pem_public_keyc                 C   s^   |   |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}t| |ƒS |  	¡  d S r…   )
rü   rf   ZPEM_read_bio_DHparamsrX   rd   r�   rá   r  r   rG  )ru   rù   rH  r  r]   r]   r^   Úload_pem_parametersÊ  s    
   ÿ
zBackend.load_pem_parametersc                 C   s>   |   |¡}|  ||¡}|r$|  |¡S |  | jj| j||¡S d S r…   )rü   Ú"_evp_pkey_from_der_traditional_keyr  r@  rf   Zd2i_PKCS8PrivateKey_bio)ru   rù   r   rþ   r›   r]   r]   r^   r  Ö  s    

üzBackend.load_der_private_keyc                 C   s^   | j  |j| jj¡}|| jjkrN|  ¡  | j || j j¡}|d k	rJtdƒ‚|S |  ¡  d S d S )Nú4Password was given but private key is not encrypted.)	rf   Úd2i_PrivateKey_biorX   rd   r�   rÑ   rá   rö   Ú	TypeError)ru   rþ   r   r›   r]   r]   r^   rL  ë  s    ÿz*Backend._evp_pkey_from_der_traditional_keyc                 C   s¾   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj¡}|| jjkr²| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rˆ   )rü   rf   Zd2i_PUBKEY_biorX   rd   r�   rá   rö   r  rÑ   rF  r}   Zd2i_RSAPublicKey_biorâ   rä   r    rG  )ru   rù   rH  ræ   r�   rå   r]   r]   r^   r  þ  s"    

 ÿ
zBackend.load_der_public_keyc                 C   sº   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}t| |ƒS | jj	r®|  
¡  | j |j¡}|  |dk¡ | j |j| jj¡}|| jjkr®| j || jj¡}t| |ƒS |  ¡  d S rˆ   )rü   rf   Zd2i_DHparams_biorX   rd   r�   rá   r  r   rr   rÑ   rF  r}   ZCryptography_d2i_DHxparams_biorG  )ru   rù   rH  r  r�   r]   r]   r^   Úload_der_parameters  s"    

 ÿ
zBackend.load_der_parameters)Úcertrw   c                 C   sT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S r…   )Úpublic_bytesr'   ÚEncodingÚDERrü   rf   Zd2i_X509_biorX   rd   r�   r}   rá   Ú	X509_free)ru   rQ  rù   rH  r   r]   r]   r^   Ú
_cert2ossl)  s    
zBackend._cert2ossl)r   rw   c                 C   s4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S rˆ   )rý   rf   Zi2d_X509_bior}   Ú	rust_x509Zload_der_x509_certificaterÿ   )ru   r   rX   r�   r]   r]   r^   Ú
_ossl2cert1  s    zBackend._ossl2cert)Úcsrrw   c                 C   sT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S r…   )rR  r'   rS  rT  rü   rf   Zd2i_X509_REQ_biorX   rd   r�   r}   rá   ZX509_REQ_free)ru   rY  rù   rH  Úx509_reqr]   r]   r^   Ú	_csr2ossl7  s    
zBackend._csr2ossl)rZ  rw   c                 C   s4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S rˆ   )rý   rf   Zi2d_X509_REQ_bior}   rW  Zload_der_x509_csrrÿ   )ru   rZ  rX   r�   r]   r]   r^   Ú	_ossl2csr?  s    zBackend._ossl2csr)Úcrlrw   c                 C   sT   |  tjj¡}|  |¡}| j |j| jj	¡}|  
|| jj	k¡ | j || jj¡}|S r…   )rR  r'   rS  rT  rü   rf   Zd2i_X509_CRL_biorX   rd   r�   r}   rá   ZX509_CRL_free)ru   r]  rù   rH  Úx509_crlr]   r]   r^   Ú	_crl2osslG  s    
zBackend._crl2ossl)r^  rw   c                 C   s4   |   ¡ }| j ||¡}|  |dk¡ t |  |¡¡S rˆ   )rý   rf   Zi2d_X509_CRL_bior}   rW  Zload_der_x509_crlrÿ   )ru   r^  rX   r�   r]   r]   r^   Ú	_ossl2crlO  s    zBackend._ossl2crl)r]  Ú
public_keyrw   c                 C   sJ   t |tttfƒstdƒ‚|  |¡}| j ||j¡}|dkrF|  	¡  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.ra   FT)
rª   r   r    r   rO  r_  rf   ZX509_CRL_verifyÚ	_evp_pkeyrÑ   )ru   r]  ra  r^  r�   r]   r]   r^   Ú_crl_is_signature_validW  s     ýþÿ
zBackend._crl_is_signature_validc                 C   s`   |   |¡}| j |¡}|  || jjk¡ | j || jj¡}| j ||¡}|dkr\|  	¡  dS dS )Nra   FT)
r[  rf   ZX509_REQ_get_pubkeyr}   rd   r�   rá   rö   ZX509_REQ_verifyrÑ   )ru   rY  rZ  Úpkeyr�   r]   r]   r^   Ú_csr_is_signature_validq  s    
zBackend._csr_is_signature_validc                 C   s"   | j  |j|j¡dkrtdƒ‚d S )Nra   zKeys do not correspond)rf   ZEVP_PKEY_cmprb  r¼   )ru   Úkey1Úkey2r]   r]   r^   Ú_check_keys_correspond€  s    zBackend._check_keys_correspondc           	      C   s&  |   |¡}| j d¡}|d k	rFt d|¡ | j |¡}||_t|ƒ|_||j	| jj
| j | jjd¡|ƒ}|| jj
krÆ|jdkr¾|  ¡  |jdkrštdƒ‚qÆ|jdks¨t‚td |jd	 ¡ƒ‚n|  ¡  |  ¡  | j || jj¡}|d k	rú|jdkrútd
ƒ‚|d k	�r|jd	k�s|d k�st‚||ƒS )NrB  r   rC  r   éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.ra   rM  )rü   rd   r“   r   Ú_check_byteslikerÍ   r   r”   rÈ   rX   r�   rD  rf   rE  ÚerrorrÑ   rO  r‡   r¼   rx   ÚmaxsizerG  rá   rö   Zcalled)	ru   Zopenssl_read_funcZconvert_funcrù   r   rH  rI  Zpassword_ptrræ   r]   r]   r^   r@  „  sV    

 ÿú	

ÿÿÿÿÿÿþzBackend._load_keyc                    s¨   ˆ   ¡ }|stdƒ‚nŽ|d  ˆ jjˆ jj¡sf|d  ˆ jjˆ jj¡sfˆ jjrp|d  ˆ jj	ˆ jj
¡rptdƒ‚n4t‡ fdd„|D ƒƒr�tdƒ‚nt |¡}td|ƒ‚d S )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3   s"   | ]}|  ˆ jjˆ jj¡V  qd S r…   )Ú_lib_reason_matchrf   ÚERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)Ú.0rl  rt   r]   r^   Ú	<genexpr>Õ  s
   üþz4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.zÊCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)rÑ   r¼   rn  rf   ro  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZERR_LIB_PROVZPROV_R_BAD_DECRYPTÚanyr%   Z_errors_with_text)ru   r|   Zerrors_with_textr]   rt   r^   rG  ¹  s@    ÿ ÿÿþü	÷
þö
û

ûz!Backend._handle_key_loading_error)Úcurverw   c                 C   sv   z|   |¡}W n tk
r*   | jj}Y nX | j |¡}|| jjkrP|  ¡  dS |  || jjk¡ | j 	|¡ dS d S )NFT)
Ú_elliptic_curve_to_nidr   rf   Ú	NID_undefZEC_GROUP_new_by_curve_namerd   r�   rÑ   r}   ZEC_GROUP_free)ru   rs  Ú	curve_nidÚgroupr]   r]   r^   Úelliptic_curve_supportedè  s    z Backend.elliptic_curve_supported)Úsignature_algorithmrs  rw   c                 C   s   t |tjƒsdS |  |¡S r©   )rª   r+   ZECDSArx  )ru   ry  rs  r]   r]   r^   Ú,elliptic_curve_signature_algorithm_supportedø  s    z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   s\   |   |¡rD|  |¡}| j |¡}|  |dk¡ |  |¡}t| ||ƒS td |j	¡t
jƒ‚dS )z@
        Generate a new private key on the named curve.
        ra   z#Backend object does not support {}.N)rx  Ú_ec_key_new_by_curverf   ZEC_KEY_generate_keyr}   Ú_ec_cdata_to_evp_pkeyr   r   rx   r¡   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)ru   rs  r  r�   ræ   r]   r]   r^   Ú#generate_elliptic_curve_private_key  s    



þz+Backend.generate_elliptic_curve_private_keyc                 C   sz   |j }|  |j¡}| j |  |j¡| jj¡}| j 	||¡}|dkrR|  
¡  tdƒ‚|  ||j|j¡ |  |¡}t| ||ƒS )Nra   úInvalid EC key.)rñ   r{  rs  rd   rá   rÝ   Úprivate_valuerf   ÚBN_clear_freeÚEC_KEY_set_private_keyrÑ   r¼   Ú)_ec_key_set_public_key_affine_coordinatesr5  r4  r|  r   )ru   rê   Úpublicr  r€  r�   ræ   r]   r]   r^   Ú#load_elliptic_curve_private_numbers  s"    
 ÿ  ÿ
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |   |j¡}|  ||j|j¡ |  |¡}t| ||ƒS r…   )r{  rs  rƒ  r5  r4  r|  r   )ru   rê   r  ræ   r]   r]   r^   Ú"load_elliptic_curve_public_numbers0  s      ÿ
z*Backend.load_elliptic_curve_public_numbers)rs  Úpoint_bytesrw   c           	   	   C   sÎ   |   |¡}| j |¡}|  || jjk¡ | j |¡}|  || jjk¡ | j || jj¡}|  	¡ �6}| j 
|||t|ƒ|¡}|dkr’|  ¡  tdƒ‚W 5 Q R X | j ||¡}|  |dk¡ |  |¡}t| ||ƒS )Nra   z(Invalid public bytes for the given curve)r{  rf   ÚEC_KEY_get0_groupr}   rd   r�   ÚEC_POINT_newrá   ÚEC_POINT_freeÚ_tmp_bn_ctxZEC_POINT_oct2pointr”   rÑ   r¼   ÚEC_KEY_set_public_keyr|  r   )	ru   rs  r‡  r  rw  ÚpointÚbn_ctxr�   ræ   r]   r]   r^   Ú load_elliptic_curve_public_bytes;  s*    

    ÿ
z(Backend.load_elliptic_curve_public_bytes)r€  rs  rw   c              	   C   sN  |   |¡}|  |¡\}}| j |¡}|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}|  ¡ �r}| j |||| jj| jj|¡}	|  |	dk¡ | j |¡}
| j |¡}||||
||ƒ}	|	dkrÚ|  ¡  tdƒ‚W 5 Q R X | j ||¡}	|  |	dk¡ |  	|¡}| j || jj
¡}| j ||¡}	|  |	dk¡ |  |¡}t| ||ƒS )Nra   z'Unable to derive key from private_value)r{  Ú _ec_key_determine_group_get_funcrf   r‰  r}   rd   r�   rá   rŠ  rÝ   r�  r‹  ZEC_POINT_mulZ
BN_CTX_getrÑ   r¼   rŒ  r‚  r|  r   )ru   r€  rs  r  Úget_funcrw  r�  ÚvaluerŽ  r�   Zbn_xZbn_yÚprivateræ   r]   r]   r^   Ú!derive_elliptic_curve_private_keyQ  s>    


     ÿ

z)Backend.derive_elliptic_curve_private_key)rs  c                 C   s   |   |¡}|  |¡S r…   )rt  Ú_ec_key_new_by_curve_nid)ru   rs  rv  r]   r]   r^   r{  x  s    
zBackend._ec_key_new_by_curve)rv  c                 C   s0   | j  |¡}|  || jjk¡ | j || j j¡S r…   )rf   ZEC_KEY_new_by_curve_namer}   rd   r�   rá   r  )ru   rv  r  r]   r]   r^   r•  |  s    z Backend._ec_key_new_by_curve_nid)rœ   rs  rw   c                 C   s,   | j rt|| jƒsdS |  |¡o*t|tjƒS r©   )ri   rª   Ú_fips_ecdh_curvesrx  r+   ÚECDH)ru   rœ   rs  r]   r]   r^   Ú+elliptic_curve_exchange_algorithm_supported�  s     ÿ ÿz3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_EC_KEYr}   )ru   r  ræ   r�   r]   r]   r^   r|  �  s    zBackend._ec_cdata_to_evp_pkeyc                 C   sN   dddœ}|  |j|j¡}| j | ¡ ¡}|| jjkrJtd |j¡tj	ƒ‚|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z${} is not a supported elliptic curve)
Úgetr¡   rf   Ú
OBJ_sn2nidr£   ru  r   rx   r   r}  )ru   rs  Zcurve_aliasesZ
curve_namerv  r]   r]   r^   rt  “  s    

þzBackend._elliptic_curve_to_nidc              	   c   sX   | j  ¡ }|  || jjk¡ | j || j j¡}| j  |¡ z
|V  W 5 | j  |¡ X d S r…   )	rf   Z
BN_CTX_newr}   rd   r�   rá   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)ru   rŽ  r]   r]   r^   r‹  ¤  s    

zBackend._tmp_bn_ctxc                 C   s¼   |   || jjk¡ | j d¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ ||kr¤| jj	r¤| jj
}n| jj}|s´t‚||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r}   rd   r�   rf   rš  ru  rˆ  ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFpr‡   )ru   r(  Znid_two_fieldrw  ÚmethodÚnidr‘  r]   r]   r^   r�  ¯  s    
z(Backend._ec_key_determine_group_get_func)r5  r4  c                 C   st   |dk s|dk rt dƒ‚| j |  |¡| jj¡}| j |  |¡| jj¡}| j |||¡}|dkrp|  ¡  t dƒ‚dS )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.ra   r  N)r¼   rd   rá   rÝ   rf   rã   Z(EC_KEY_set_public_key_affine_coordinatesrÑ   )ru   r(  r5  r4  r�   r]   r]   r^   rƒ  Ë  s    ÿz1Backend._ec_key_set_public_key_affine_coordinates)Úencodingrx   Úencryption_algorithmrw   c           
      C   s`  t |tjƒstdƒ‚t |tjƒs(tdƒ‚t |tjƒs<tdƒ‚t |tjƒrNd}nbt |tjƒrv|j}t	|ƒdkr°t
dƒ‚n:t |tjƒr¨|j|  krœtjjkr¨n n|j}nt
dƒ‚|tjjkrþ|tjjkrÒ| jj}n|tjjkrè| jj}nt
dƒ‚|  |||¡S |tjjk�r"| j�r*t |tjƒ�s*t
d	ƒ‚| j |¡}	|tjjk�r¢|	| jjk�r\| jj}n8|	| jjk�rt| jj}n |	| jjk�rŒ| jj}nt
d
ƒ‚|  |||¡S |tjjk�r|�r¾t
dƒ‚|	| jjk�rÖ| jj}n8|	| jjk�rî| jj}n |	| jjk�r| jj }nt
d
ƒ‚|  !||¡S t
dƒ‚|tjjk�rT|tjjk�rLt" #|||¡S t
dƒ‚t
dƒ‚d S )Nú/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancer€   iÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingúformat is invalid with this key)$rª   r'   rS  rO  ÚPrivateFormatÚKeySerializationEncryptionÚNoEncryptionÚBestAvailableEncryptionr   r”   r¼   Ú_KeySerializationEncryptionÚ_formatÚOpenSSHZPKCS8ÚPEMrf   ZPEM_write_bio_PKCS8PrivateKeyrT  Zi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioZTraditionalOpenSSLri   r  r  ZPEM_write_bio_RSAPrivateKeyr  ZPEM_write_bio_DSAPrivateKeyr  ZPEM_write_bio_ECPrivateKeyr  Zi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bioÚ_bio_func_outputrQ   Z_serialize_ssh_private_key)
ru   r�  rx   rž  r›   ræ   Úcdatar   Ú	write_bior  r]   r]   r^   Ú_private_key_bytesÝ  sÄ    
ÿ ÿÿ ÿÿ ÿÿûú


  ÿ
 ÿÿ


ÿ  ÿÿ


ÿ  ÿÿzBackend._private_key_bytesc              	   C   s<   |s| j j}n| j d¡}|  ||||t|ƒ| j j| j j¡S )Ns   aes-256-cbc)rd   r�   rf   ÚEVP_get_cipherbynamerª  r”   )ru   r¬  ræ   r   rº   r]   r]   r^   r©  W  s    
ùz"Backend._private_key_bytes_via_bioc                 G   s.   |   ¡ }||f|žŽ }|  |dk¡ |  |¡S rˆ   )rý   r}   rÿ   )ru   r¬  ÚargsrX   r�   r]   r]   r^   rª  h  s    zBackend._bio_func_output)r�  rx   rw   c                 C   s  t |tjƒstdƒ‚t |tjƒs(tdƒ‚|tjjkrt|tjjkrJ| jj}n|tjj	kr`| jj
}ntdƒ‚|  ||¡S |tjjkrà| j |¡}|| jjkr tdƒ‚|tjjkr¶| jj}n|tjj	krÌ| jj}ntdƒ‚|  ||¡S |tjjk�r|tjjk�rt |¡S tdƒ‚tdƒ‚d S )NrŸ  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingr   )rª   r'   rS  rO  ÚPublicFormatZSubjectPublicKeyInfor¨  rf   ZPEM_write_bio_PUBKEYrT  Zi2d_PUBKEY_bior¼   rª  ZPKCS1r  r  ZPEM_write_bio_RSAPublicKeyr  r§  rQ   Zserialize_ssh_public_key)ru   r�  rx   r›   ræ   r«  r¬  r  r]   r]   r^   Ú_public_key_bytesn  s@    ÿ

ÿ


ÿzBackend._public_key_bytesc                 C   s
   | j j S r…   ©rf   r  rt   r]   r]   r^   Údh_supported¥  s    zBackend.dh_supported)Ú	generatorrß   rw   c                 C   s†   |t jk rtd t j¡ƒ‚|dkr*tdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}| j |||| jj¡}|  |dk¡ t| |ƒS )Nz$DH key_size must be at least {} bits)é   é   zDH generator must be 2 or 5ra   )r)   Z_MIN_MODULUS_SIZEr¼   rx   rf   ÚDH_newr}   rd   r�   rá   r  ZDH_generate_parameters_exr   )ru   r´  rß   Zdh_param_cdatar�   r]   r]   r^   Úgenerate_dh_parameters¨  s&    
ÿÿ
   ÿzBackend.generate_dh_parametersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rˆ   )rø   rf   ZEVP_PKEY_set1_DHr}   )ru   r  ræ   r�   r]   r]   r^   Ú_dh_cdata_to_evp_pkeyÀ  s    zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| ƒ}| j |¡}|  |dk¡ |  |¡}t| ||ƒS rˆ   )r   Z	_dh_cdatarf   ZDH_generate_keyr}   r¹  r   )ru   r*  Zdh_key_cdatar�   ræ   r]   r]   r^   Úgenerate_dh_private_keyÆ  s     ÿ
zBackend.generate_dh_private_keyc                 C   s   |   |  ||¡¡S r…   )rº  r¸  )ru   r´  rß   r]   r]   r^   Ú&generate_dh_private_key_and_parametersÔ  s    
ÿz.Backend.generate_dh_private_key_and_parametersc                 C   s>  |j j}| j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|jd k	rf|  	|j¡}n| jj}|  	|j j¡}|  	|j¡}| j ||||¡}	|  |	dk¡ | j |||¡}	|  |	dk¡ | j dd¡}
| j ||
¡}	|  |	dk¡ |
d dk�r(|jdk�r |
d | jjA dk�s(tdƒ‚|  |¡}t| ||ƒS )Nra   úint[]r   rµ  z.DH private numbers did not pass safety checks.)rñ   r3  rf   r·  r}   rd   r�   rá   r  rÝ   rë   r/  rì   r4  r5  ÚDH_set0_pqgÚDH_set0_keyr“   ÚCryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr¼   r¹  r   )ru   rê   r3  r  rë   r/  rì   r0  r1  r�   Úcodesræ   r]   r]   r^   Úload_dh_private_numbersÛ  s4    


ÿþ
zBackend.load_dh_private_numbersc           
      C   sÐ   | j  ¡ }|  || jjk¡ | j || j j¡}|j}|  |j	¡}|  |j
¡}|jd k	rd|  |j¡}n| jj}|  |j¡}| j  ||||¡}|  |dk¡ | j  ||| jj¡}|  |dk¡ |  |¡}	t| ||	ƒS rˆ   )rf   r·  r}   rd   r�   rá   r  r3  rÝ   rë   r/  rì   r4  r½  r¾  r¹  r   )
ru   rê   r  r3  rë   r/  rì   r0  r�   ræ   r]   r]   r^   Úload_dh_public_numbers  s     


zBackend.load_dh_public_numbersc                 C   s�   | j  ¡ }|  || jjk¡ | j || j j¡}|  |j¡}|  |j	¡}|j
d k	r^|  |j
¡}n| jj}| j  ||||¡}|  |dk¡ t| |ƒS rˆ   )rf   r·  r}   rd   r�   rá   r  rÝ   rë   r/  rì   r½  r   )ru   rê   r  rë   r/  rì   r�   r]   r]   r^   Úload_dh_parameter_numbers(  s    

z!Backend.load_dh_parameter_numbers)rë   r/  rì   rw   c                 C   s´   | j  ¡ }|  || jjk¡ | j || j j¡}|  |¡}|  |¡}|d k	rV|  |¡}n| jj}| j  ||||¡}|  |dk¡ | j 	dd¡}| j  
||¡}|  |dk¡ |d dkS )Nra   r¼  r   )rf   r·  r}   rd   r�   rá   r  rÝ   r½  r“   r¿  )ru   rë   r/  rì   r  r�   rÀ  r]   r]   r^   Údh_parameters_supported<  s    


zBackend.dh_parameters_supportedc                 C   s   | j jdkS rˆ   )rf   rr   rt   r]   r]   r^   Údh_x942_serialization_supportedT  s    z'Backend.dh_x942_serialization_supportedc                 C   sh   t |ƒdkrtdƒ‚|  ¡ }| j || jj¡}|  |dk¡ | j ||t |ƒ¡}|  |dk¡ t| |ƒS )Né    z%An X25519 public key is 32 bytes longra   )	r”   r¼   rø   rf   ZEVP_PKEY_set_typeÚ
NID_X25519r}   ZEVP_PKEY_set1_tls_encodedpointr"   )ru   rù   ræ   r�   r]   r]   r^   Úx25519_load_public_bytesW  s      ÿz Backend.x25519_load_public_bytesc              	   C   s¬   t |ƒdkrtdƒ‚d}|  d¡�<}||dd…< ||dd …< |  |¡}| j |j| jj¡}W 5 Q R X |  	|| jjk¡ | j 
|| jj¡}|  	| j |¡| jjk¡ t| |ƒS )NrÆ  z&An X25519 private key is 32 bytes longs   0. 0+en" é0   r   é   )r”   r¼   Ú_zeroed_bytearrayrü   rf   rN  rX   rd   r�   r}   rá   rö   r  r  r!   )ru   rù   Zpkcs8_prefixÚbarX   ræ   r]   r]   r^   Úx25519_load_private_bytesf  s    
ÿz!Backend.x25519_load_private_bytesc                 C   s¨   | j  || jj¡}|  || jjk¡ | j || j j¡}| j  |¡}|  |dk¡ | j d¡}| j  	||¡}|  |dk¡ |  |d | jjk¡ | j |d | j j
¡}|S )Nra   úEVP_PKEY **r   )rf   ZEVP_PKEY_CTX_new_idrd   r�   r}   rá   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr“   ZEVP_PKEY_keygenrö   )ru   rœ  Zevp_pkey_ctxr�   Z	evp_ppkeyræ   r]   r]   r^   Ú_evp_pkey_keygen_gcŠ  s    zBackend._evp_pkey_keygen_gcc                 C   s   |   | jj¡}t| |ƒS r…   )rÏ  rf   rÇ  r!   r÷   r]   r]   r^   Úx25519_generate_key—  s    zBackend.x25519_generate_keyc                 C   s   | j r
dS | jj S r©   )ri   rf   r
  rt   r]   r]   r^   Úx25519_supported›  s    zBackend.x25519_supportedc                 C   s`   t |ƒdkrtdƒ‚| j | jj| jj|t |ƒ¡}|  || jjk¡ | j || jj	¡}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)r”   r¼   rf   ÚEVP_PKEY_new_raw_public_keyÚNID_X448rd   r�   r}   rá   rö   r$   ©ru   rù   ræ   r]   r]   r^   Úx448_load_public_bytes   s       ÿzBackend.x448_load_public_bytesc                 C   sl   t |ƒdkrtdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}|  || jjk¡ | j 	|| jj
¡}t| |ƒS )NrÒ  z$An X448 private key is 56 bytes long)r”   r¼   rd   rÍ   rf   ÚEVP_PKEY_new_raw_private_keyrÔ  r�   r}   rá   rö   r#   ©ru   rù   rû   ræ   r]   r]   r^   Úx448_load_private_bytes«  s       ÿzBackend.x448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r…   )rÏ  rf   rÔ  r#   r÷   r]   r]   r^   Úx448_generate_key·  s    zBackend.x448_generate_keyc                 C   s   | j r
dS | jj o| jj S r©   )ri   rf   Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r  rt   r]   r]   r^   Úx448_supported»  s
    
þzBackend.x448_supportedc                 C   s   | j r
dS | jj S r©   )ri   rf   Ú#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Brt   r]   r]   r^   Úed25519_supportedÃ  s    zBackend.ed25519_supportedc                 C   sn   t  d|¡ t|ƒtjkr"tdƒ‚| j | jj| j	j
|t|ƒ¡}|  || j	j
k¡ | j	 || jj¡}t| |ƒS )Nrù   z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesr”   r,   Ú_ED25519_KEY_SIZEr¼   rf   rÓ  ÚNID_ED25519rd   r�   r}   rá   rö   r   rÕ  r]   r]   r^   Úed25519_load_public_bytesÈ  s       ÿz!Backend.ed25519_load_public_bytesc                 C   sz   t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j 	| jj
| jj|t |ƒ¡}|  || jjk¡ | j || jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longrù   )r”   r,   rß  r¼   r   rk  rd   rÍ   rf   r×  rà  r�   r}   rá   rö   r   rØ  r]   r]   r^   Úed25519_load_private_bytesØ  s       ÿz"Backend.ed25519_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r…   )rÏ  rf   rà  r   r÷   r]   r]   r^   Úed25519_generate_keyè  s    zBackend.ed25519_generate_keyc                 C   s   | j r
dS | jj o| jj S r©   )ri   rf   rÜ  r  rt   r]   r]   r^   Úed448_supportedì  s
    
þzBackend.ed448_supportedc                 C   sl   t  d|¡ t|ƒtkr tdƒ‚| j | jj| jj	|t|ƒ¡}|  
|| jj	k¡ | j || jj¡}t| |ƒS )Nrù   z$An Ed448 public key is 57 bytes long)r   rÞ  r”   r   r¼   rf   rÓ  Ú	NID_ED448rd   r�   r}   rá   rö   r   rÕ  r]   r]   r^   Úed448_load_public_bytesô  s       ÿzBackend.ed448_load_public_bytesc                 C   sx   t  d|¡ t|ƒtkr tdƒ‚| j |¡}| j | jj	| jj
|t|ƒ¡}|  || jj
k¡ | j || jj¡}t| |ƒS )Nrù   z%An Ed448 private key is 57 bytes long)r   rk  r”   r   r¼   rd   rÍ   rf   r×  rå  r�   r}   rá   rö   r   rØ  r]   r]   r^   Úed448_load_private_bytes  s       ÿz Backend.ed448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r…   )rÏ  rf   rå  r   r÷   r]   r]   r^   Úed448_generate_key  s    zBackend.ed448_generate_key)rË   rÉ   rÈ   rò   Úrrë   rw   c                 C   s†   | j  d|¡}| j  |¡}| j |t|ƒ|t|ƒ|||tj||¡
}	|	dkrr|  ¡ }
d| | d }t	d 
|¡|
ƒ‚| j  |¡d d … S )NrÌ   ra   é€   i   zJNot enough memory to derive key. These parameters require {} MB of memory.)rd   r“   rÍ   rf   ZEVP_PBE_scryptr”   rO   Z
_MEM_LIMITrÒ   ÚMemoryErrorrx   rÎ   )ru   rË   rÉ   rÈ   rò   ré  rë   r—   rÏ   r�   r|   Z
min_memoryr]   r]   r^   Úderive_scrypt  s0    	öÿýzBackend.derive_scryptc                 C   sL   t  |¡}| jr|| jkrdS | d¡r4| jjdkS | j |¡| jj	kS d S )NFs   -sivra   )
r   Z_aead_cipher_nameri   Ú
_fips_aeadÚendswithrf   Ú#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr®  rd   r�   )ru   rµ   Úcipher_namer]   r]   r^   Úaead_cipher_supported6  s    

ÿzBackend.aead_cipher_supported)rÈ   rw   c              
   c   s&   t |ƒ}z
|V  W 5 |  ||¡ X dS )zÁ
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)Ú	bytearrayÚ
_zero_data)ru   rÈ   rÌ  r]   r]   r^   rË  D  s    
zBackend._zeroed_bytearrayc                 C   s   t |ƒD ]}d||< qd S r~   )Úrange)ru   rù   rÈ   Úir]   r]   r^   ró  Q  s    zBackend._zero_datac                 c   sf   |dkr| j jV  nNt|ƒ}| j  d|d ¡}| j  |||¡ z
|V  W 5 |  | j  d|¡|¡ X dS )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr�   ra   z	uint8_t *)rd   r�   r”   r“   Zmemmoveró  Úcast)ru   rù   Zdata_lenr—   r]   r]   r^   Ú_zeroed_null_terminated_bufX  s    
z#Backend._zeroed_null_terminated_bufc                 C   s2   |   ||¡}|j|jr|jjnd dd„ |jD ƒfS )Nc                 S   s   g | ]
}|j ‘qS r]   )Úcertificate©rp  rQ  r]   r]   r^   Ú
<listcomp>z  s     zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)Úload_pkcs12r›   rQ  rø  Zadditional_certs)ru   rù   r   Zpkcs12r]   r]   r^   Ú%load_key_and_certificates_from_pkcs12o  s
    ýz-Backend.load_key_and_certificates_from_pkcs12c              	   C   sv  |d k	rt  d|¡ |  |¡}| j |j| jj¡}|| jjkrN|  ¡  t	dƒ‚| j 
|| jj¡}| j d¡}| j d¡}| j d¡}|  |¡�}| j |||||¡}	W 5 Q R X | jjr¾|  ¡  |	dkrÖ|  ¡  t	dƒ‚d }
d }g }|d | jjk�r| j 
|d | jj¡}|  |¡}|d | jjk�r€| j 
|d | jj¡}|  |¡}d }| j || jj¡}|| jjk�rv| j |¡}t||ƒ}
|d | jjk�rj| j 
|d | jj¡}| j |d ¡}| jj�sÌ| jj�rÖt|ƒ}ntt|ƒƒ}|D ]‚}| j ||¡}|  || jjk¡ | j 
|| jj¡}|  |¡}d }| j || jj¡}|| jjk�rV| j |¡}| t||ƒ¡ �qæt ||
|ƒS )Nr   z!Could not deserialize PKCS12 datarÎ  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data)!r   rk  rü   rf   Zd2i_PKCS12_biorX   rd   r�   rÑ   r¼   rá   ÚPKCS12_freer“   r÷  ZPKCS12_parseZ#CRYPTOGRAPHY_LIBRESSL_LESS_THAN_340rö   r  rU  rX  ZX509_alias_get0r•   rS   Úsk_X509_freeÚsk_X509_numrï  r  rô  ÚreversedÚsk_X509_valuer}   rs   rT   )ru   rù   r   rX   Úp12Zevp_pkey_ptrZx509_ptrZsk_x509_ptrÚpassword_bufr�   rQ  r›   Zadditional_certificatesræ   r   Zcert_objr¡   Z
maybe_nameÚsk_x509rÙ   Úindicesrõ  Z	addl_certZ	addl_namer]   r]   r^   rû  }  sx    
    ÿ


ÿþ

ÿzBackend.load_pkcs12)r¡   r›   rQ  Úcasrž  rw   c                 C   sX  d }|d k	rt  d|¡ t|tjƒr@d}d}d}	d}
| jj}�nDt|tjƒrŽ| jj	rf| jj
}| jj
}n| jj}| jj}d}	d}
| jj}|j}nöt|tjƒ�r||jtjjk�r|d}d}d}	d}
|j}|j}|tjkrä| jj}| jj}n>|tjk�r| jj	�stdƒ‚| jj
}| jj
}n|d k�s"t‚|jd k	�r`| jj�s@tdƒ‚|  |j¡}|  || jjk¡ n| jj}|jd k	�r„|j}	ntdƒ‚|d k�sœt|ƒdk�r¦| jj}n°| j ¡ }| j || jj ¡}g }|D ]Š}t|t!ƒ�r"|j"}|  #|j$¡}|  %|¡�$}| j &||d¡}|  |dk¡ W 5 Q R X n
|  #|¡}| '|¡ | j (||¡}t) |dk¡ �qÊ|  %|¡� }|  %|¡�V}|�r~|  #|¡n| jj}|d k	�r˜|j*}n| jj}| j +||||||||	|
d¡
}W 5 Q R X | jj�rü|| jjk�rü| j ,||d| jjd|
|¡ W 5 Q R X |  || jjk¡ | j || jj-¡}|  .¡ }| j /||¡}|  |dk¡ |  0|¡S )	Nr¡   ri  r   i N  ra   z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption type)1r   rÞ  rª   r'   r£  rd   r�   r¤  rf   rï  ZNID_aes_256_cbcZ&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr   r¥  r¦  r¡  ZPKCS12Z_key_cert_algorithmrR   ZPBESv1SHA1And3KeyTripleDESCBCZPBESv2SHA256AndAES256CBCr   r‡   Z
_hmac_hashZCryptography_HAS_PKCS12_SET_MACr¨   r}   Z_kdf_roundsr¼   r”   Úsk_X509_new_nullrá   rþ  rS   Zfriendly_namerV  rø  r÷  ZX509_alias_set1rs   Úsk_X509_pushÚbackendrb  ZPKCS12_createZPKCS12_set_macrý  rý   Zi2d_PKCS12_biorÿ   )ru   r¡   r›   rQ  r  rž  r   Znid_certZnid_keyZpkcs12_iterZmac_iterZmac_algZ
keycertalgr  Zossl_casÚcaZca_aliasZossl_caZca_name_bufr�   r  Zname_bufÚ	ossl_certræ   r  rX   r]   r]   r^   Ú(serialize_key_and_certificates_to_pkcs12Ê  sò     ÿ
 ÿÿÿü	


ÿ

ÿÿ

ÿ  ÿ


öÿ
þù
z0Backend.serialize_key_and_certificates_to_pkcs12c                 C   s   | j r
dS | jjdkS r±   )ri   rf   ZCryptography_HAS_POLY1305rt   r]   r]   r^   Úpoly1305_supportedg	  s    zBackend.poly1305_supported)r›   rw   c                 C   s*   t  d|¡ t|ƒtkr tdƒ‚t| |ƒS )Nr›   zA poly1305 key is 32 bytes long)r   rk  r”   r   r¼   r   )ru   r›   r]   r]   r^   Úcreate_poly1305_ctxl	  s    zBackend.create_poly1305_ctxc                 C   s
   | j j S r…   r²  rt   r]   r]   r^   Úpkcs7_supporteds	  s    zBackend.pkcs7_supportedc                 C   sn   t  d|¡ |  |¡}| j |j| jj| jj| jj¡}|| jjkrR|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S ©Nrù   zUnable to parse PKCS7 data)r   rÞ  rü   rf   ZPEM_read_bio_PKCS7rX   rd   r�   rÑ   r¼   rá   Ú
PKCS7_freeÚ_load_pkcs7_certificates©ru   rù   rX   Úp7r]   r]   r^   Úload_pem_pkcs7_certificatesv	  s    
   ÿz#Backend.load_pem_pkcs7_certificatesc                 C   sb   t  d|¡ |  |¡}| j |j| jj¡}|| jjkrF|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S r  )r   rÞ  rü   rf   Zd2i_PKCS7_biorX   rd   r�   rÑ   r¼   rá   r  r  r  r]   r]   r^   Úload_der_pkcs7_certificates…	  s    
z#Backend.load_der_pkcs7_certificatesc           
      C   sÊ   | j  |j¡}|  || j jk¡ || j jkr>td |¡tj	ƒ‚|j
jj}| j  |¡}g }t|ƒD ]d}| j  ||¡}|  || jjk¡ | j  |¡}|  |dk¡ | j || j j¡}|  |¡}	| |	¡ q`|S )NzNOnly basic signed structures are currently supported. NID for this data was {}ra   )rf   ZOBJ_obj2nidr·   r}   ru  ZNID_pkcs7_signedr   rx   r   ZUNSUPPORTED_SERIALIZATIONrí   ÚsignrQ  rÿ  rô  r  rd   r�   ZX509_up_refrá   rU  rX  rs   )
ru   r  rœ  r  rÙ   Úcertsrõ  r   r�   rQ  r]   r]   r^   r  ’	  s*    ÿý

z Backend._load_pkcs7_certificates)r  r�  c           
      C   s"  t |ƒ}|rtdd„ |D ƒƒs&tdƒ‚|tjjtjjfkrBtdƒ‚| j ¡ }| j	 
|| jj¡}g }|D ]4}|  |¡}| |¡ | j ||¡}|  |dk¡ qf| j | j	j| j	j|| j	j| jj¡}|  ¡ }	|tjjkrì| j |	|| j	jd¡}n|tjjksüt‚| j |	|¡}|  |dk¡ |  |	¡S )Nc                 s   s   | ]}t |tjƒV  qd S r…   )rª   r   ÚCertificaterù  r]   r]   r^   rq  ²	  s    z7Backend.pkcs7_serialize_certificates.<locals>.<genexpr>z.certs must be a list of certs with length >= 1z/encoding must DER or PEM from the Encoding enumra   r   )ÚlistÚallrO  r'   rS  r¨  rT  rf   r  rd   rá   rþ  rV  rs   r  r}   Ú
PKCS7_signr�   ÚPKCS7_PARTIALrý   ÚPEM_write_bio_PKCS7_streamr‡   Úi2d_PKCS7_biorÿ   )
ru   r  r�  Zcerts_skÚ
ossl_certsrQ  r  r�   r  Úbio_outr]   r]   r^   Úpkcs7_serialize_certificates¬	  sJ    ÿþ


û   ÿz$Backend.pkcs7_serialize_certificates)Úbuilderr�  Úoptionsrw   c                 C   sÂ  |j d k	st‚|  |j ¡}| jj}d}t|jƒdkr>| jj}n\| j 	¡ }| j 
|| jj¡}g }|jD ]4}	|  |	¡}
| |
¡ | j ||
¡}|  |dk¡ qdtjj|kr¾|| jjO }|| jjO }| j | jj| jj|| jj|¡}|  || jjk¡ | j 
|| jj¡}d}tjj|k�r"|| jjO }ntjj|k�r<|| jjO }tjj|k�rV|| jjO }|jD ]H\}}}|  |¡}
|  |¡}| j ||
|j||¡}|  || jjk¡ �q\|D ]<}|tjj k�rÊ|| jj!O }n|tjj"k�rª|| jj#O }�qª|  $¡ }|t%j&j'k�r| j (|||j)|¡}n–|t%j&j*k�rX| j +||j)|¡}|  |dk¡ | j ,|||j)|¡}nR|t%j&j-k�sjt‚| j +||j)|¡}|  |dk¡ | jj.�rœ|  /¡  | j 0||¡}|  |dk¡ |  1|¡S )Nr   ra   )2Ú_datar‡   rü   rf   r  r”   Z_additional_certsrd   r�   r  rá   rþ  rV  rs   r  r}   rP   ÚPKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDr  r  ZNoCapabilitiesZPKCS7_NOSMIMECAPZNoAttributesZPKCS7_NOATTRZNoCertsZPKCS7_NOCERTSZ_signersr¨   ZPKCS7_sign_add_signerrb  ÚTextZ
PKCS7_TEXTÚBinaryZPKCS7_BINARYrý   r'   rS  ZSMIMEZSMIME_write_PKCS7rX   r¨  ZPKCS7_finalr  rT  rï  rÑ   r  rÿ   )ru   r#  r�  r$  rX   Z
init_flagsZfinal_flagsr  r   rQ  r  r�   r  Zsigner_flagsrø  Zprivate_keyZhash_algorithmÚmdZp7signerinfoÚoptionr!  r]   r]   r^   Ú
pkcs7_signÛ	  s”    




û

û   ÿ   ÿ
zBackend.pkcs7_sign)N)N)N)ûrZ   r[   r\   Ú__doc__r¡   rí  r:   r¶   r&   r  r   r!  r"  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r«   r+   Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1r–  Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrv   Ústrrz   rƒ   ÚtypingÚOptionalÚListr%   Z_OpenSSLErrorr}   rh   r†   rŽ   Ú
contextlibr   r�   rp   r˜   ry   rÔ   rš   ÚbytesZHashAlgorithmr   r�   r¦   r¨   r¬   r°   r²   r³   ZHashContextr´   r9   rL   r»   r¿   rk   r   rÅ   rÆ   rÇ   rÐ   rÑ   Z_OpenSSLErrorWithTextrÒ   rØ   rÝ   r.   ZRSAPrivateKeyrç   ré   ZRSAPrivateNumbersrô   ZRSAPublicNumbersZRSAPublicKeyrõ   rø   rä   rü   rý   rÿ   r6   r  r7   r  r#  r(   r&  r*   ZDSAParametersr)  ZDSAPrivateKeyr,  r-  r2  ZDSAPrivateNumbersr6  ZDSAPublicNumbersZDSAPublicKeyr8  ZDSAParameterNumbersr9  r+  r:  r;  r>  r8   r
   r?  rA  rJ  r)   ZDHParametersrK  r  rL  r  rP  r   r  ÚAnyrV  rX  ZCertificateSigningRequestr[  r\  ZCertificateRevocationListr_  r`  r5   rc  re  rh  r@  ÚNoReturnrG  ZEllipticCurverx  ZEllipticCurveSignatureAlgorithmrz  ZEllipticCurvePrivateKeyr~  ZEllipticCurvePrivateNumbersr…  ZEllipticCurvePublicNumbersZEllipticCurvePublicKeyr†  r�  r”  r{  r•  r—  r˜  r|  rt  r‹  r�  rƒ  r'   rS  r¡  r¢  r­  r©  rª  r°  r±  r³  r¸  r¹  ZDHPrivateKeyrº  r»  ZDHPrivateNumbersrÁ  ZDHPublicNumbersZDHPublicKeyrÂ  ZDHParameterNumbersrÃ  rÄ  rÅ  r/   ZX25519PublicKeyrÈ  ZX25519PrivateKeyrÍ  rÏ  rÐ  rÑ  r0   ZX448PublicKeyrÖ  ZX448PrivateKeyrÙ  rÚ  rÛ  rÝ  r,   ZEd25519PublicKeyrá  ZEd25519PrivateKeyrâ  rã  rä  r-   ZEd448PublicKeyræ  ZEd448PrivateKeyrç  rè  rì  rñ  ÚIteratorrò  rË  ró  r÷  ÚTuplerü  rT   rû  rU   rV   r  r  r   r  r  r  r  r  r"  rP   ZPKCS7SignatureBuilderr&  r+  r]   r]   r]   r^   r_   ‡   s|  ú
ôüýü
	 þþ	þ	5 þ þù
þ þ þ
þ%þ@:þþþþþ þ
* þ	þ	þ
üþ5/üþþþ þ þ' þ

øzù7 þþ þþ1þþÿ  þþ$þþø# 

þÿþ þO
ù 
þ
þ
ý1
ûr_   c                   @   s,   e Zd Zedœdd„Zeeedœdd„ZdS )rÀ   )Úfmtc                 C   s
   || _ d S r…   )Ú_fmt)ru   r7  r]   r]   r^   rv   ?
  s    zGetCipherByName.__init__)r	  rµ   r„   c                 C   sd   | j j||d� ¡ }|j | d¡¡}||jjkrX|jjrX|j 	|jj| d¡|jj¡}| 
¡  |S )N)rµ   r„   r’   )r8  rx   Úlowerrf   r®  r£   rd   r�   ZCryptography_HAS_300_EVP_CIPHERZEVP_CIPHER_fetchrÑ   )ru   r	  rµ   r„   rð  rº   r]   r]   r^   Ú__call__B
  s    ÿ
ÿþýzGetCipherByName.__call__N)	rZ   r[   r\   r-  rv   r_   r9   rL   r:  r]   r]   r]   r^   rÀ   >
  s   rÀ   )r	  rµ   c                 C   s"   d  |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsrµ  r’   )rx   rß   rf   r®  r£   )r	  rµ   r„   rð  r]   r]   r^   rÃ   W
  s    rÃ   )|Úcollectionsr1  rÁ   r.  rm   r   Zcryptographyr   r   Zcryptography.exceptionsr   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr
   Z'cryptography.hazmat.backends.openssl.dhr   r   r   r   Z(cryptography.hazmat.backends.openssl.dsar   r   r   Z'cryptography.hazmat.backends.openssl.ecr   r   Z,cryptography.hazmat.backends.openssl.ed25519r   r   Z*cryptography.hazmat.backends.openssl.ed448r   r   r   Z+cryptography.hazmat.backends.openssl.hashesr   Z)cryptography.hazmat.backends.openssl.hmacr   Z-cryptography.hazmat.backends.openssl.poly1305r   r   Z(cryptography.hazmat.backends.openssl.rsar   r    Z+cryptography.hazmat.backends.openssl.x25519r!   r"   Z)cryptography.hazmat.backends.openssl.x448r#   r$   Z"cryptography.hazmat.bindings._rustrW  Z$cryptography.hazmat.bindings.opensslr%   Zcryptography.hazmat.primitivesr&   r'   Z*cryptography.hazmat.primitives._asymmetricr(   Z)cryptography.hazmat.primitives.asymmetricr)   r*   r+   r,   r-   r.   r/   r0   Z1cryptography.hazmat.primitives.asymmetric.paddingr1   r2   r3   r4   Z/cryptography.hazmat.primitives.asymmetric.typesr5   r6   r7   Z&cryptography.hazmat.primitives.ciphersr8   r9   Z1cryptography.hazmat.primitives.ciphers.algorithmsr:   r;   r<   r=   r>   r?   r@   rA   rB   rC   rD   rE   Z,cryptography.hazmat.primitives.ciphers.modesrF   rG   rH   rI   rJ   rK   rL   rM   rN   Z"cryptography.hazmat.primitives.kdfrO   Z,cryptography.hazmat.primitives.serializationrP   rQ   Z3cryptography.hazmat.primitives.serialization.pkcs12rR   rS   rT   rU   rV   Ú
namedtuplerW   rY   r_   rÀ   rÃ   r	  r]   r]   r]   r^   Ú<module>   sv   (
8,	                   J