U
    *”}f›¡ ã                   @   sÒ  d dl mZmZmZ d dlZd dlZd dlZd dlZd dlmZ d dl	Z	d dl
mZ d dlmZmZ d dlmZmZ d dlmZmZmZmZmZ d dlmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z% d d	l&m'Z' d d
l(m)Z) d dl*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7m8Z8m9Z9m:Z: d dl;m<Z<m=Z=m>Z> d dl?m@Z@mAZA d dlBmCZCmDZD d dlEmFZFmGZGmHZH d dlImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZR d dlSmTZT d dlUmVZV d dlWmXZXmYZY d dlZm[Z[m\Z\ d dl]m^Z^m_Z_ d dl`maZambZb d dlcmdZdmeZe d dlfmgZgmhZhmiZimjZj d dlkmlZl d dlmmnZnmoZo d dlpmqZqmrZrmsZsmtZtmuZu d dlvmwZwmxZxmyZymzZz d dl{m|Z|m}Z}m~Z~mZm€Z€mZm‚Z‚mƒZƒm„Z„ d d l…m†Z†m‡Z‡mˆZˆm‰Z‰mŠZŠm‹Z‹mŒZŒmZ d d!lŽmZ d d"lm‘Z‘m’Z’ d d#l“m”Z” e •d$d%d&g¡Z–G d'd(„ d(e—ƒZ˜e ™e¡e ™e¡e ™e¡e ™e¡e ™e¡e ™e¡e ™e ¡e ™e¡e ™e!¡e ™e#¡e ™e"¡e ™e%¡e šel ›¡ jœje$¡G d)d*„ d*e—ƒƒƒƒƒƒƒƒƒƒƒƒƒƒZžG d+d,„ d,e—ƒZŸd-d.„ Z ežƒ Z¡dS )/é    )Úabsolute_importÚdivisionÚprint_functionN)Úcontextmanager©Úrange)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)ÚINTEGERÚNULLÚSEQUENCEÚ
encode_derÚencode_der_integer)ÚCMACBackendÚCipherBackendÚDERSerializationBackendÚ	DHBackendÚ
DSABackendÚEllipticCurveBackendÚHMACBackendÚHashBackendÚPBKDF2HMACBackendÚPEMSerializationBackendÚ
RSABackendÚScryptBackendÚX509Backend)Úaead)Ú_CipherContext©Ú_CMACContext)	Ú_CRL_ENTRY_REASON_ENUM_TO_CODEÚ_CRL_EXTENSION_HANDLERSÚ_EXTENSION_HANDLERS_BASEÚ_EXTENSION_HANDLERS_SCTÚ"_OCSP_BASICRESP_EXTENSION_HANDLERSÚ_OCSP_REQ_EXTENSION_HANDLERSÚ'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCTÚ_REVOKED_EXTENSION_HANDLERSÚ_X509ExtensionParser)Ú_DHParametersÚ_DHPrivateKeyÚ_DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey)	Ú$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERSÚ_CRL_EXTENSION_ENCODE_HANDLERSÚ_EXTENSION_ENCODE_HANDLERSÚ)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERSÚ'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERSÚ_encode_asn1_int_gcÚ_encode_asn1_str_gcÚ_encode_name_gcÚ_txt2obj_gc©Ú_HashContext©Ú_HMACContext)Ú_OCSPRequestÚ_OCSPResponse)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)Ú_CertificateÚ_CertificateRevocationListÚ_CertificateSigningRequestÚ_RevokedCertificate)Úbinding)ÚhashesÚserialization)ÚdsaÚecÚed25519Úed448Úrsa)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)	ÚAESÚARC4ÚBlowfishÚCAST5ÚCamelliaÚChaCha20ÚIDEAÚSEEDÚ	TripleDES)ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚOFBÚXTS)Úscrypt)Úpkcs7Ússh)ÚocspÚ
_MemoryBIOÚbioZchar_ptrc                   @   s   e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú__qualname__© r{   r{   úP/tmp/pip-unpacked-wheel-x36vw73o/cryptography/hazmat/backends/openssl/backend.pyrw   ¢   s   rw   c                   @   s|  e Zd ZdZdZddddddhZeefZe	j
e	je	je	je	je	je	je	je	je	je	je	je	jfZd	Zd
Zdd	> Zd	Zde> Zdd„ Zd-dd„Zdd„ Zdd„ Z e!j"dd„ ƒZ#dd„ Z$dd„ Z%dd„ Z&dd„ Z'dd „ Z(d!d"„ Z)d#d$„ Z*d%d&„ Z+d'd(„ Z,d)d*„ Z-d+d,„ Z.d-d.„ Z/d/d0„ Z0d1d2„ Z1d3d4„ Z2d5d6„ Z3d7d8„ Z4d9d:„ Z5d;d<„ Z6d=d>„ Z7d?d@„ Z8dAdB„ Z9d.dCdD„Z:dEdF„ Z;dGdH„ Z<dIdJ„ Z=dKdL„ Z>dMdN„ Z?dOdP„ Z@dQdR„ ZAdSdT„ ZBdUdV„ ZCdWdX„ ZDdYdZ„ ZEd[d\„ ZFd]d^„ ZGd_d`„ ZHdadb„ ZIdcdd„ ZJdedf„ ZKdgdh„ ZLdidj„ ZMdkdl„ ZNdmdn„ ZOdodp„ ZPdqdr„ ZQdsdt„ ZRdudv„ ZSdwdx„ ZTdydz„ ZUd{d|„ ZVd}d~„ ZWdd€„ ZXdd‚„ ZYdƒd„„ ZZd…d†„ Z[d‡dˆ„ Z\d‰dŠ„ Z]d‹dŒ„ Z^ddŽ„ Z_dd„ Z`d‘d’„ Zad“d”„ Zbd•d–„ Zcd—d˜„ Zdd™dš„ Zed›dœ„ Zfddž„ ZgdŸd „ Zhd¡d¢„ Zid£d¤„ Zjd¥d¦„ Zkd§d¨„ Zld©dª„ Zmd«d¬„ Znd­d®„ Zod¯d°„ Zpd±d²„ Zqd³d´„ Zrdµd¶„ Zsd·d¸„ Ztd¹dº„ Zud»d¼„ Zvd½d¾„ Zwd¿dÀ„ ZxdÁdÂ„ ZydÃdÄ„ ZzdÅdÆ„ Z{dÇdÈ„ Z|dÉdÊ„ Z}dËdÌ„ Z~e"dÍdÎ„ ƒZdÏdÐ„ Z€dÑdÒ„ ZdÓdÔ„ Z‚dÕdÖ„ Zƒd×dØ„ Z„dÙdÚ„ Z…dÛdÜ„ Z†dÝdÞ„ Z‡dßdà„ Zˆdádâ„ Z‰dãdä„ ZŠdådæ„ Z‹dçdè„ ZŒdédê„ Zd/dëdì„ZŽdídî„ Zdïdð„ Zdñdò„ Z‘dódô„ Z’dõdö„ Z“d÷dø„ Z”dùdú„ Z•dûdü„ Z–dýdþ„ Z—dÿd „ Z˜dd„ Z™dd„ Zšdd„ Z›dd„ Zœd	d
„ Zdd„ Zždd„ ZŸdd„ Z dd„ Z¡dd„ Z¢dd„ Z£e!j"dd„ ƒZ¤dd„ Z¥e!j"dd„ ƒZ¦dd„ Z§dd „ Z¨d!d"„ Z©d#d$„ Zªd%d&„ Z«d'd(„ Z¬d)d*„ Z­d+d,„ Z®dS (0  ÚBackendz)
    OpenSSL API binding interfaces.
    Zopenssls   aes-128-ccms   aes-192-ccms   aes-256-ccms   aes-128-gcms   aes-192-gcms   aes-256-gcmé   i  é   c                 C   s’   t  ¡ | _| jj| _| jj| _|  ¡ | _i | _	|  
¡  |  ¡  |  ¡  | jrb| jjrbt dt¡ n|  ¡  | jjg| _| jjrŽ| j | jj¡ d S )Nz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)rT   ÚBindingZ_bindingÚffiÚ_ffiÚlibÚ_libÚ_is_fips_enabledÚ_fips_enabledÚ_cipher_registryÚ_register_default_ciphersÚ_register_x509_ext_parsersÚ_register_x509_encodersÚ"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEÚwarningsÚwarnÚUserWarningÚactivate_osrandom_engineZEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendZEVP_PKEY_DHX©Úselfr{   r{   r|   Ú__init__Þ   s"    



þzBackend.__init__Nc                 C   s   t j| j||dS )N)Úerrors)rT   Z_openssl_assertr„   )r”   Úokr–   r{   r{   r|   Úopenssl_assertó   s    zBackend.openssl_assertc                 C   s2   t | jddd„ ƒ}|ƒ }|dkr*| j ¡  t|ƒS )NZ	FIPS_modec                   S   s   dS ©Nr   r{   r{   r{   r{   r|   Ú<lambda>÷   ó    z*Backend._is_fips_enabled.<locals>.<lambda>r   )Úgetattrr„   ZERR_clear_errorÚbool)r”   Z	fips_modeÚmoder{   r{   r|   r…   ö   s
    
zBackend._is_fips_enabledc                 C   sf   | j jrb| j  ¡ }|| jjkrb| j  |¡ | j  | jj¡}|  |dk¡ | j  |¡}|  |dk¡ d S ©Nr   )	r„   r‹   ZENGINE_get_default_RANDr‚   r   ZENGINE_unregister_RANDÚRAND_set_rand_methodr˜   ÚENGINE_finish©r”   ÚeÚresr{   r{   r|   Úactivate_builtin_randomþ   s    
zBackend.activate_builtin_randomc              
   c   s‚   | j  | j j¡}|  || jjk¡ | j  |¡}|  |dk¡ z
|V  W 5 | j  |¡}|  |dk¡ | j  |¡}|  |dk¡ X d S rŸ   )	r„   ZENGINE_by_idZCryptography_osrandom_engine_idr˜   r‚   r   ZENGINE_initZENGINE_freer¡   r¢   r{   r{   r|   Ú_get_osurandom_engine  s    
zBackend._get_osurandom_enginec              	   C   s`   | j jr\|  ¡  |  ¡  }| j  |¡}|  |dk¡ W 5 Q R X | j  | jj¡}|  |dk¡ d S rŸ   )	r„   r‹   r¥   r¦   ZENGINE_set_default_RANDr˜   r    r‚   r   r¢   r{   r{   r|   r     s    
z Backend.activate_osrandom_enginec              	   C   s`   | j  dd¡}|  ¡ 2}| j |dt|ƒ|| j jd¡}|  |dk¡ W 5 Q R X | j  |¡ 	d¡S )Núchar[]é@   s   get_implementationr   Úascii)
r‚   Únewr¦   r„   ZENGINE_ctrl_cmdÚlenr   r˜   ÚstringÚdecode)r”   Úbufr£   r¤   r{   r{   r|   Úosrandom_engine_implementation+  s    
     ÿz&Backend.osrandom_engine_implementationc                 C   s   | j  | j | jj¡¡ d¡S )zÀ
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r©   )r‚   r¬   r„   ZOpenSSL_versionÚOPENSSL_VERSIONr­   r“   r{   r{   r|   Úopenssl_version_text4  s
    ÿþzBackend.openssl_version_textc                 C   s
   | j  ¡ S ©N)r„   ZOpenSSL_version_numr“   r{   r{   r|   Úopenssl_version_number?  s    zBackend.openssl_version_numberc                 C   s   t | ||ƒS r²   rD   )r”   ÚkeyÚ	algorithmr{   r{   r|   Úcreate_hmac_ctxB  s    zBackend.create_hmac_ctxc                 C   sL   |j dks|j dkr0d |j |jd ¡ d¡}n|j  d¡}| j |¡}|S )NÚblake2bÚblake2sz{}{}é   r©   )ÚnameÚformatÚdigest_sizeÚencoder„   ZEVP_get_digestbyname)r”   rµ   ZalgÚevp_mdr{   r{   r|   Ú_evp_md_from_algorithmE  s     ÿþzBackend._evp_md_from_algorithmc                 C   s    |   |¡}|  || jjk¡ |S r²   )r¿   r˜   r‚   r   ©r”   rµ   r¾   r{   r{   r|   Ú_evp_md_non_null_from_algorithmP  s    
z'Backend._evp_md_non_null_from_algorithmc                 C   s,   | j rt|| jƒsdS |  |¡}|| jjkS ©NF)r†   Ú
isinstanceÚ_fips_hashesr¿   r‚   r   rÀ   r{   r{   r|   Úhash_supportedU  s    
zBackend.hash_supportedc                 C   s
   |   |¡S r²   ©rÅ   ©r”   rµ   r{   r{   r|   Úhmac_supported\  s    zBackend.hmac_supportedc                 C   s
   t | |ƒS r²   rB   rÇ   r{   r{   r|   Úcreate_hash_ctx_  s    zBackend.create_hash_ctxc                 C   s`   | j rt|| jƒsdS z| jt|ƒt|ƒf }W n tk
rF   Y dS X || ||ƒ}| jj|kS rÂ   )r†   rÃ   Ú_fips_ciphersr‡   ÚtypeÚKeyErrorr‚   r   )r”   Úcipherrž   ÚadapterÚ
evp_cipherr{   r{   r|   Úcipher_supportedb  s    zBackend.cipher_supportedc                 C   s0   ||f| j krtd ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)r‡   Ú
ValueErrorr»   )r”   Ú
cipher_clsÚmode_clsrÎ   r{   r{   r|   Úregister_cipher_adapterl  s     ÿÿzBackend.register_cipher_adapterc                 C   sV  t ttttttfD ]}|  t|t	dƒ¡ qt ttttfD ]}|  t
|t	dƒ¡ q8t tttfD ]}|  t|t	dƒ¡ q\|  ttt	dƒ¡ t tttfD ]}|  t|t	dƒ¡ q’t tttfD ]}|  t|t	dƒ¡ q¶t ttgt tttg¡D ]\}}|  ||t	dƒ¡ qæ|  ttd ƒt	dƒ¡ |  ttd ƒt	dƒ¡ |  ttd ƒt	d	ƒ¡ |  ttt¡ d S )
Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20)ri   rl   rm   ro   rj   rk   rn   rÔ   r`   ÚGetCipherByNamerd   rh   rb   rg   Ú	itertoolsÚproductrc   rf   ra   rË   rw   re   rp   Ú_get_xts_cipher)r”   rÓ   rÒ   r{   r{   r|   rˆ   u  sh    ýý  ÿ  ÿ  ÿ  ÿ
þý  ÿz!Backend._register_default_ciphersc                 C   sæ   t  ¡ }t ¡ }| jjr,| t¡ | t¡ t| | jj	| jj
|d| _t| | jj| jj|d| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jjtd| _t| | jj| jj|d| _ d S )N)Z	ext_countZget_extÚhandlers)!r$   Úcopyr)   r„   ZCryptography_HAS_SCTÚupdater%   r(   r*   ZX509_get_ext_countZX509_get_extZ_certificate_extension_parserZsk_X509_EXTENSION_numZsk_X509_EXTENSION_valueZ_csr_extension_parserZX509_REVOKED_get_ext_countZX509_REVOKED_get_extZ_revoked_cert_extension_parserZX509_CRL_get_ext_countZX509_CRL_get_extr#   Z_crl_extension_parserZOCSP_REQUEST_get_ext_countZOCSP_REQUEST_get_extr'   Z_ocsp_req_ext_parserZOCSP_BASICRESP_get_ext_countZOCSP_BASICRESP_get_extr&   Z_ocsp_basicresp_ext_parserZOCSP_SINGLERESP_get_ext_countZOCSP_SINGLERESP_get_extZ_ocsp_singleresp_ext_parser)r”   Zext_handlersZsingleresp_handlersr{   r{   r|   r‰   ¢  s^    

üüüüüüüz"Backend._register_x509_ext_parsersc                 C   s6   t  ¡ | _t ¡ | _t ¡ | _t ¡ | _t	 ¡ | _
d S r²   )r;   rÚ   Ú_extension_encode_handlersr:   Ú_crl_extension_encode_handlersr9   Ú$_crl_entry_extension_encode_handlersr=   Ú'_ocsp_request_extension_encode_handlersr<   Ú)_ocsp_basicresp_extension_encode_handlersr“   r{   r{   r|   rŠ   ×  s    
ÿÿÿÿzBackend._register_x509_encodersc                 C   s   t | ||t jƒS r²   )r   Z_ENCRYPT©r”   rÍ   rž   r{   r{   r|   Úcreate_symmetric_encryption_ctxæ  s    z'Backend.create_symmetric_encryption_ctxc                 C   s   t | ||t jƒS r²   )r   Z_DECRYPTrá   r{   r{   r|   Úcreate_symmetric_decryption_ctxé  s    z'Backend.create_symmetric_decryption_ctxc                 C   s
   |   |¡S r²   )rÈ   rÇ   r{   r{   r|   Úpbkdf2_hmac_supportedì  s    zBackend.pbkdf2_hmac_supportedc           
   
   C   sh   | j  d|¡}|  |¡}| j  |¡}| j |t|ƒ|t|ƒ||||¡}	|  |	dk¡ | j  |¡d d … S )Núunsigned char[]r   )	r‚   rª   rÁ   Úfrom_bufferr„   ZPKCS5_PBKDF2_HMACr«   r˜   Úbuffer)
r”   rµ   ÚlengthÚsaltZ
iterationsÚkey_materialr®   r¾   Úkey_material_ptrr¤   r{   r{   r|   Úderive_pbkdf2_hmacï  s    
ø
zBackend.derive_pbkdf2_hmacc                 C   s   t  | j¡S r²   )rT   Ú_consume_errorsr„   r“   r{   r{   r|   rí     s    zBackend._consume_errorsc                 C   s   t  | j¡S r²   )rT   Ú_consume_errors_with_textr„   r“   r{   r{   r|   rî     s    z!Backend._consume_errors_with_textc                 C   sÂ   || j jkst‚tjs~| j |¡}| j  d|¡}| j ||¡}|  	|dk¡ t
 | j  |¡d |… d¡}| j |¡rz| }|S | j |¡}|  	|| j jk¡ | j  |¡}| j |¡ t
|dƒS d S )Nrå   r   Úbigé   )r‚   r   ÚAssertionErrorÚsixÚPY2r„   ZBN_num_bytesrª   Z	BN_bn2binr˜   ÚintÚ
from_bytesrç   ZBN_is_negativeZ	BN_bn2hexr¬   ÚOPENSSL_free)r”   ÚbnZbn_num_bytesZbin_ptrZbin_lenÚvalZ	hex_cdataÚhex_strr{   r{   r|   Ú
_bn_to_int  s    zBackend._bn_to_intc                 C   sâ   |dks|| j jkst‚|dkr(| j j}tjst| t| ¡ d d ƒd¡}| j 	|t
|ƒ|¡}|  || j jk¡ |S t|ƒ d¡dd…  d¡}| j  d¡}||d	< | j ||¡}|  |d	k¡ |  |d	 | j jk¡ |d	 S dS )
a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @r   rï   ÚLé   r©   ú	BIGNUM **r   )r‚   r   rñ   rò   ró   Úto_bytesrô   Ú
bit_lengthr„   Z	BN_bin2bnr«   r˜   ÚhexÚrstripr½   rª   Z	BN_hex2bn)r”   Únumr÷   ÚbinaryZbn_ptrZhex_numr¤   r{   r{   r|   Ú
_int_to_bn  s    zBackend._int_to_bnc                 C   s   t  ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS rŸ   )r[   Z_verify_rsa_parametersr„   ÚRSA_newr˜   r‚   r   ÚgcÚRSA_freer  ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyrJ   )r”   Úpublic_exponentÚkey_sizeÚ	rsa_cdatar÷   r¤   Úevp_pkeyr{   r{   r|   Úgenerate_rsa_private_key=  s    

   ÿ
z Backend.generate_rsa_private_keyc                 C   s   |dko|d@ dko|dkS )Né   r   r   é   r{   )r”   r
  r  r{   r{   r|   Ú!generate_rsa_parameters_supportedO  s
    
ÿýz)Backend.generate_rsa_parameters_supportedc              
   C   s2  t  |j|j|j|j|j|j|jj	|jj
¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |j¡}|  |jj	¡}	|  |jj
¡}
| j |||¡}|  |dk¡ | j ||
|	|¡}|  |dk¡ | j ||||¡}|  |dk¡ |  |¡}t| ||ƒS rŸ   )r[   Z_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersr£   Únr„   r  r˜   r‚   r   r  r  r  ZRSA_set0_factorsÚRSA_set0_keyZRSA_set0_crt_paramsr	  rJ   )r”   Únumbersr  r  r  r  r  r  r  r£   r  r¤   r  r{   r{   r|   Úload_rsa_private_numbersV  s:    ø


z Backend.load_rsa_private_numbersc                 C   s   t  |j|j¡ | j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}| j |||| jj¡}|  |dk¡ |  |¡}t| ||ƒS rŸ   )r[   Z_check_public_key_componentsr£   r  r„   r  r˜   r‚   r   r  r  r  r  r	  rK   )r”   r  r  r£   r  r¤   r  r{   r{   r|   Úload_rsa_public_numbersv  s    

zBackend.load_rsa_public_numbersc                 C   s2   | j  ¡ }|  || jjk¡ | j || j j¡}|S r²   )r„   ZEVP_PKEY_newr˜   r‚   r   r  ÚEVP_PKEY_free©r”   r  r{   r{   r|   Ú_create_evp_pkey_gcƒ  s    
zBackend._create_evp_pkey_gcc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rŸ   )r   r„   ZEVP_PKEY_set1_RSAr˜   )r”   r  r  r¤   r{   r{   r|   r	  ‰  s    zBackend._rsa_cdata_to_evp_pkeyc                 C   sH   | j  |¡}| j |t|ƒ¡}|  || j jk¡ t| j  || jj	¡|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
r‚   ræ   r„   ZBIO_new_mem_bufr«   r˜   r   ru   r  ÚBIO_free)r”   ÚdataÚdata_ptrrv   r{   r{   r|   Ú_bytes_to_bio  s    zBackend._bytes_to_bioc                 C   sP   | j  ¡ }|  || jjk¡ | j  |¡}|  || jjk¡ | j || j j¡}|S )z.
        Creates an empty memory BIO.
        )r„   Z	BIO_s_memr˜   r‚   r   ZBIO_newr  r!  )r”   Z
bio_methodrv   r{   r{   r|   Ú_create_mem_bio_gcœ  s    
zBackend._create_mem_bio_gcc                 C   s\   | j  d¡}| j ||¡}|  |dk¡ |  |d | j jk¡ | j  |d |¡dd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)r‚   rª   r„   ZBIO_get_mem_datar˜   r   rç   )r”   rv   r®   Zbuf_lenÚbio_datar{   r{   r|   Ú_read_mem_bio§  s    zBackend._read_mem_bioc                 C   s°  | j  |¡}|| j jkrT| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krœ| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrä| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jkr,| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrJt| |ƒS |t| j ddƒkrht| |ƒS |t| j ddƒkr†t| |ƒS |t| j ddƒkr¤t| |ƒS tdƒ‚dS )zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        ÚEVP_PKEY_ED25519NÚEVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.)r„   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAr˜   r‚   r   r  r  rJ   ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer0   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer2   r   ÚEVP_PKEY_get1_DHÚDH_freer,   rœ   r4   rN   rL   r7   r
   ©r”   r  Úkey_typer  Ú	dsa_cdataÚec_cdataÚdh_cdatar{   r{   r|   Ú_evp_pkey_to_private_key²  s<    



z Backend._evp_pkey_to_private_keyc                 C   s°  | j  |¡}|| j jkrT| j  |¡}|  || jjk¡ | j || j j¡}t	| ||ƒS || j j
krœ| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || j jkrä| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS || jkr,| j  |¡}|  || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrJt| |ƒS |t| j ddƒkrht| |ƒS |t| j ddƒkr†t| |ƒS |t| j ddƒkr¤t| |ƒS tdƒ‚dS )zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        r(  Nr)  r*  r+  r,  )r„   r-  r.  r/  r˜   r‚   r   r  r  rK   r0  r1  r2  r1   r3  r4  r5  r3   r   r6  r7  r-   rœ   r5   rO   rM   r8   r
   r8  r{   r{   r|   Ú_evp_pkey_to_public_keyÝ  s<    



zBackend._evp_pkey_to_public_keyc                 C   s6   | j jr&t|tjtjtjtjtjfƒS t|tjƒS d S r²   )	r„   ZCryptography_HAS_RSA_OAEP_MDrÃ   rU   ÚSHA1ÚSHA224ÚSHA256ÚSHA384ÚSHA512rÇ   r{   r{   r|   Ú_oaep_hash_supported  s    ûþzBackend._oaep_hash_supportedc                 C   sŽ   t |tƒrdS t |tƒr2t |jtƒr2|  |jj¡S t |tƒr†t |jtƒr†|  |jj¡o„|  |j¡o„|j	d kp„t
|j	ƒdkp„| jjdkS dS d S )NTr   r   F)rÃ   r^   r_   Z_mgfr\   rÅ   Ú
_algorithmr]   rD  Z_labelr«   r„   ZCryptography_HAS_RSA_OAEP_LABEL)r”   Úpaddingr{   r{   r|   Úrsa_padding_supported  s    

ÿ
û	zBackend.rsa_padding_supportedc              	   C   s~   |dkrt dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}|  |dk¡ t	| |ƒS )N)i   r~   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   r   )
rÑ   r„   ÚDSA_newr˜   r‚   r   r  r2  ZDSA_generate_parameters_exr/   )r”   r  Úctxr¤   r{   r{   r|   Úgenerate_dsa_parameters(  s$    ÿ
ù
zBackend.generate_dsa_parametersc                 C   sT   | j  |j¡}|  || jjk¡ | j || j j¡}| j  |¡ |  	|¡}t
| ||ƒS r²   )r„   ZDSAparams_dupZ
_dsa_cdatar˜   r‚   r   r  r2  ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr0   )r”   Ú
parametersrI  r  r{   r{   r|   Úgenerate_dsa_private_key@  s    
z Backend.generate_dsa_private_keyc                 C   s   |   |¡}|  |¡S r²   )rJ  rM  )r”   r  rL  r{   r{   r|   Ú'generate_dsa_private_key_and_parametersI  s    
z/Backend.generate_dsa_private_key_and_parametersc                 C   sB   | j  ||||¡}|  |dk¡ | j  |||¡}|  |dk¡ d S rŸ   )r„   ÚDSA_set0_pqgr˜   ZDSA_set0_key)r”   r:  r  r  ÚgÚpub_keyÚpriv_keyr¤   r{   r{   r|   Ú_dsa_cdata_set_valuesM  s    zBackend._dsa_cdata_set_valuesc           
      C   s¨   t  |¡ |jj}| j ¡ }|  || jjk¡ | j 	|| jj
¡}|  |j¡}|  |j¡}|  |j¡}|  |jj¡}|  |j¡}|  ||||||¡ |  |¡}	t| ||	ƒS r²   )rW   Z_check_dsa_private_numbersr  Úparameter_numbersr„   rH  r˜   r‚   r   r  r2  r  r  r  rP  ÚyÚxrS  rK  r0   )
r”   r  rT  r:  r  r  rP  rQ  rR  r  r{   r{   r|   Úload_dsa_private_numbersS  s    


z Backend.load_dsa_private_numbersc           	      C   s¢   t  |j¡ | j ¡ }|  || jjk¡ | j || jj	¡}|  
|jj¡}|  
|jj¡}|  
|jj¡}|  
|j¡}| jj}|  ||||||¡ |  |¡}t| ||ƒS r²   )rW   Ú_check_dsa_parametersrT  r„   rH  r˜   r‚   r   r  r2  r  r  r  rP  rU  rS  rK  r1   )	r”   r  r:  r  r  rP  rQ  rR  r  r{   r{   r|   Úload_dsa_public_numbersf  s    

zBackend.load_dsa_public_numbersc                 C   s†   t  |¡ | j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|  	|j¡}| j ||||¡}|  |dk¡ t| |ƒS rŸ   )rW   rX  r„   rH  r˜   r‚   r   r  r2  r  r  r  rP  rO  r/   )r”   r  r:  r  r  rP  r¤   r{   r{   r|   Úload_dsa_parameter_numbersw  s    

z"Backend.load_dsa_parameter_numbersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rŸ   )r   r„   ZEVP_PKEY_set1_DSAr˜   )r”   r:  r  r¤   r{   r{   r|   rK  …  s    zBackend._dsa_cdata_to_evp_pkeyc                 C   s
   |   |¡S r²   rÆ   rÇ   r{   r{   r|   Údsa_hash_supported‹  s    zBackend.dsa_hash_supportedc                 C   s   dS )NTr{   )r”   r  r  rP  r{   r{   r|   Údsa_parameters_supportedŽ  s    z Backend.dsa_parameters_supportedc                 C   s   |   |td|j ƒ¡S )Nó    )rÐ   ri   Ú
block_sizerÇ   r{   r{   r|   Úcmac_algorithm_supported‘  s     ÿz Backend.cmac_algorithm_supportedc                 C   s
   t | |ƒS r²   r    rÇ   r{   r{   r|   Úcreate_cmac_ctx–  s    zBackend.create_cmac_ctxc                 C   s~   t |tjtjfƒr$|d k	rztdƒ‚nVt |tjtj	t
jfƒsDtdƒ‚n6t |tjƒsZtdƒ‚n t |tjƒrzt |tjƒsztdƒ‚d S )Nz8algorithm must be None when signing via ed25519 or ed448z;Key must be an rsa, dsa, ec, ed25519, or ed448 private key.z.Algorithm must be a registered hash algorithm.z2MD5 hash algorithm is only supported with RSA keys)rÃ   rY   ÚEd25519PrivateKeyrZ   ÚEd448PrivateKeyrÑ   r[   ZRSAPrivateKeyrW   ZDSAPrivateKeyrX   ZEllipticCurvePrivateKeyÚ	TypeErrorrU   ZHashAlgorithmÚMD5©r”   Úprivate_keyrµ   r{   r{   r|   Ú_x509_check_signature_params™  s0     
ÿÿþÿ
 ÿÿz$Backend._x509_check_signature_paramsc              	      s´  t |tjƒstdƒ‚ˆ  ||¡ ˆ  ||¡}ˆ j ¡ }ˆ  |ˆ j	j
k¡ ˆ j	 |ˆ jj¡}ˆ j |tjjj¡}ˆ  |dk¡ ˆ j |tˆ |jƒ¡}ˆ  |dk¡ | ¡ }ˆ j ||j¡}ˆ  |dk¡ ˆ j ¡ }ˆ  |ˆ j	j
k¡ ˆ j	 |‡ fdd„¡}ˆ j|jˆ j|ˆ jjdd ˆ j ||¡}ˆ  |dk¡ |jD ]D\}	}
tˆ |	jƒ}ˆ j  ||tj!j"j#j|
t$|
ƒ¡}ˆ  |dk¡ q6ˆ j %||j|¡}|dkrªˆ  &¡ }t'd|ƒ‚t(ˆ |ƒS )	NúBuilder type mismatch.r   c                    s   ˆ j  | ˆ j ˆ j jd¡¡S )NÚX509_EXTENSION_free)r„   Zsk_X509_EXTENSION_pop_freer‚   Ú	addressofÚ_original_lib)rV  r“   r{   r|   rš   Ò  s    ÿþz)Backend.create_x509_csr.<locals>.<lambda>F©Ú
extensionsrÙ   Úx509_objÚadd_funcr  r   úSigning failed))rÃ   r	   Z CertificateSigningRequestBuilderrc  rg  Ú_evp_md_x509_null_if_eddsar„   ZX509_REQ_newr˜   r‚   r   r  ÚX509_REQ_freeZX509_REQ_set_versionÚVersionZv1ÚvalueZX509_REQ_set_subject_namer@   Ú_subject_nameÚ
public_keyZX509_REQ_set_pubkeyÚ	_evp_pkeyZsk_X509_EXTENSION_new_nullÚ_create_x509_extensionsÚ_extensionsrÜ   Zsk_X509_EXTENSION_insertZX509_REQ_add_extensionsÚ_attributesrA   Údotted_stringZX509_REQ_add1_attr_by_OBJrº   Z	_ASN1TypeZ
UTF8Stringr«   ZX509_REQ_signrî   rÑ   rR   )r”   Úbuilderrf  rµ   r¾   Úx509_reqr¤   rv  Zsk_extensionZattr_oidZattr_valÚobjr–   r{   r“   r|   Úcreate_x509_csr±  s^    
 
ÿ

þû
û

zBackend.create_x509_csrc           	      C   sx  t |tjƒstdƒ‚|  ||¡ |  ||¡}| j ¡ }| j 	|| jj
¡}| j ||jj¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ | j ||jj¡}|  |dk¡ t| |jƒ}| j ||¡}|  |dk¡ |  | j |¡|j¡ |  | j |¡|j¡ | j|j| j|| jj dd | j !|t| |j"ƒ¡}|  |dk¡ | j #||j|¡}|dkrn|  $¡ }t%d|ƒ‚t&| |ƒS ©Nrh  r   Trl  r   rp  )'rÃ   r	   ZCertificateBuilderrc  rg  rq  r„   ZX509_newr‚   r  Ú	X509_freeZX509_set_versionÚ_versionrt  r˜   ZX509_set_subject_namer@   ru  ZX509_set_pubkeyZ_public_keyrw  r>   Ú_serial_numberZX509_set_serialNumberÚ_set_asn1_timeZX509_getm_notBeforeZ_not_valid_beforeZX509_getm_notAfterZ_not_valid_afterrx  ry  rÜ   ZX509_add_extZX509_set_issuer_nameÚ_issuer_nameZ	X509_signrî   rÑ   rP   )	r”   r|  rf  rµ   r¾   Z	x509_certr¤   Úserial_numberr–   r{   r{   r|   Úcreate_x509_certificateù  s\    
 
ÿ ÿ
 ÿ
 ÿû	 
ÿ

zBackend.create_x509_certificatec                 C   s(   t |tjtjfƒr| jjS |  |¡S d S r²   )rÃ   rY   ra  rZ   rb  r‚   r   rÁ   re  r{   r{   r|   rq  ;  s     
ÿz"Backend._evp_md_x509_null_if_eddsac                 C   sL   |j dkr| d¡ d¡}n| d¡ d¡}| j ||¡}|  |dk¡ d S )Ni  z%Y%m%d%H%M%SZr©   z%y%m%d%H%M%SZr   )ÚyearÚstrftimer½   r„   ZASN1_TIME_set_stringr˜   )r”   Ú	asn1_timeÚtimeZasn1_strr¤   r{   r{   r|   r„  D  s
    
zBackend._set_asn1_timec                 C   s>   | j  ¡ }|  || jjk¡ | j || j j¡}|  ||¡ |S r²   )r„   ZASN1_TIME_newr˜   r‚   r   r  ZASN1_TIME_freer„  )r”   r‹  rŠ  r{   r{   r|   Ú_create_asn1_timeL  s
    
zBackend._create_asn1_timec                 C   st  t |tjƒstdƒ‚|  ||¡ |  ||¡}| j ¡ }| j 	|| jj
¡}| j |d¡}|  |dk¡ | j |t| |jƒ¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ | j|j| j|| jjdd |jD ]@}	| j |	j¡}
|  |
| jjk¡ | j ||
¡}|  |dk¡ qú| j ||j|¡}|dkrj|   ¡ }t!d|ƒ‚t"| |ƒS r€  )#rÃ   r	   Z CertificateRevocationListBuilderrc  rg  rq  r„   ZX509_CRL_newr‚   r  ÚX509_CRL_freeZX509_CRL_set_versionr˜   ZX509_CRL_set_issuer_namer@   r…  rŒ  Ú_last_updateZX509_CRL_set_lastUpdateÚ_next_updateZX509_CRL_set_nextUpdaterx  ry  rÝ   ZX509_CRL_add_extZ_revoked_certificatesZX509_REVOKED_dupZ_x509_revokedr   ZX509_CRL_add0_revokedZX509_CRL_signrw  rî   rÑ   rQ   )r”   r|  rf  rµ   r¾   Úx509_crlr¤   Zlast_updateÚnext_updateZrevoked_certZrevokedr–   r{   r{   r|   Úcreate_x509_crlS  sH    
 
ÿû	


zBackend.create_x509_crlc           
      C   sd   t |ƒD ]V\}}|  ||¡}|  || jjk¡ |rD| j || jj¡}||||ƒ}	|  |	dk¡ qd S rŸ   )Ú	enumerateÚ_create_x509_extensionr˜   r‚   r   r  r„   ri  )
r”   rm  rÙ   rn  ro  r  ÚiÚ	extensionZx509_extensionr¤   r{   r{   r|   rx  ‹  s     ÿzBackend._create_x509_extensionsc                 C   s.   t | |jjƒ}| j | jj||jr&dnd|¡S )Nr   r   )rA   Úoidr{  r„   ZX509_EXTENSION_create_by_OBJr‚   r   Úcritical)r”   r–  rt  r~  r{   r{   r|   Ú_create_raw_x509_extension™  s       ÿz"Backend._create_raw_x509_extensionc                 C   s  t |jtjƒr(t| |jjƒ}|  ||¡S t |jtjƒrfttfdd„ |jD ƒžŽ }t| |ƒ}|  ||¡S t |jtj	ƒrŽt| tt
ƒƒ}|  ||¡S z||j }W n$ tk
rÀ   td |j¡ƒ‚Y nX || |jƒ}| j |jj d¡¡}|  || jjk¡ | j ||jr
dnd|¡S d S )Nc                 S   s   g | ]}t tt|jƒƒ‘qS r{   )r   r   r   rt  )Ú.0rV  r{   r{   r|   Ú
<listcomp>¦  s   ÿz2Backend._create_x509_extension.<locals>.<listcomp>zExtension not supported: {}r©   r   r   )rÃ   rt  r	   ZUnrecognizedExtensionr?   r™  Z
TLSFeaturer   r   ZPrecertPoisonr   r—  rÌ   ÚNotImplementedErrorr»   r„   ZOBJ_txt2nidr{  r½   r˜   Ú	NID_undefZX509V3_EXT_i2dr˜  )r”   rÙ   r–  rt  Zasn1r½   Z
ext_structÚnidr{   r{   r|   r”  Ÿ  s@    ÿþþ

ÿ
ÿ  ÿzBackend._create_x509_extensionc                 C   sº   t |tjƒstdƒ‚| j ¡ }|  || jjk¡ | j 	|| jj
¡}t| |jƒ}| j ||¡}|  |dk¡ |  |j¡}| j ||¡}|  |dk¡ | j|j| j|| jjdd t| d |ƒS )Nrh  r   Trl  )rÃ   r	   ZRevokedCertificateBuilderrc  r„   ZX509_REVOKED_newr˜   r‚   r   r  ZX509_REVOKED_freer>   rƒ  ZX509_REVOKED_set_serialNumberrŒ  Z_revocation_dateZX509_REVOKED_set_revocationDaterx  ry  rÞ   ZX509_REVOKED_add_extrS   )r”   r|  Zx509_revokedr†  r¤   Zrev_dater{   r{   r|   Úcreate_x509_revoked_certificateÁ  s,    
 ÿûz'Backend.create_x509_revoked_certificatec                 C   s   |   | jj| j||¡S r²   )Ú	_load_keyr„   ZPEM_read_bio_PrivateKeyr=  )r”   r"  Úpasswordr{   r{   r|   Úload_pem_private_keyÚ  s    üzBackend.load_pem_private_keyc                 C   sÖ   |   |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj| jj| jj¡}|| jjkrÊ| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rŸ   )r$  r„   ZPEM_read_bio_PUBKEYrv   r‚   r   r  r  r>  rí   Ú	BIO_resetr˜   ZPEM_read_bio_RSAPublicKeyr  r	  rK   Ú_handle_key_loading_error©r”   r"  Úmem_bior  r¤   r  r{   r{   r|   Úload_pem_public_keyâ  s0    
   ÿ
   ÿ
zBackend.load_pem_public_keyc                 C   s^   |   |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}t| |ƒS |  	¡  d S r²   )
r$  r„   ZPEM_read_bio_DHparamsrv   r‚   r   r  r7  r+   r¤  )r”   r"  r¦  r<  r{   r{   r|   Úload_pem_parametersû  s    
   ÿ
zBackend.load_pem_parametersc                 C   s>   |   |¡}|  ||¡}|r$|  |¡S |  | jj| j||¡S d S r²   )r$  Ú"_evp_pkey_from_der_traditional_keyr=  r   r„   Zd2i_PKCS8PrivateKey_bio)r”   r"  r¡  r&  r´   r{   r{   r|   Úload_der_private_key  s    

üzBackend.load_der_private_keyc                 C   sV   | j  |j| jj¡}|| jjkrF| j || j j¡}|d k	rBtdƒ‚|S |  ¡  d S d S )Nú4Password was given but private key is not encrypted.)	r„   Úd2i_PrivateKey_biorv   r‚   r   r  r  rc  rí   )r”   r&  r¡  r´   r{   r{   r|   r©    s    ÿz*Backend._evp_pkey_from_der_traditional_keyc                 C   s¾   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}|  |¡S |  	¡  | j 
|j¡}|  |dk¡ | j |j| jj¡}|| jjkr²| j || jj¡}|  |¡}t| ||ƒS |  ¡  d S rŸ   )r$  r„   Zd2i_PUBKEY_biorv   r‚   r   r  r  r>  rí   r£  r˜   Zd2i_RSAPublicKey_bior  r	  rK   r¤  r¥  r{   r{   r|   Úload_der_public_key(  s"    

 ÿ
zBackend.load_der_public_keyc                 C   sº   |   |¡}| j |j| jj¡}|| jjkrF| j || jj¡}t| |ƒS | jj	r®|  
¡  | j |j¡}|  |dk¡ | j |j| jj¡}|| jjkr®| j || jj¡}t| |ƒS |  ¡  d S rŸ   )r$  r„   Zd2i_DHparams_biorv   r‚   r   r  r7  r+   r‘   rí   r£  r˜   ZCryptography_d2i_DHxparams_bior¤  )r”   r"  r¦  r<  r¤   r{   r{   r|   Úload_der_parameters?  s"    

 ÿ
zBackend.load_der_parametersc                 C   sb   |   |¡}| j |j| jj| jj| jj¡}|| jjkrF|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzwUnable to load certificate. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)r$  r„   ZPEM_read_bio_X509rv   r‚   r   rí   rÑ   r  r  rP   ©r”   r"  r¦  r	   r{   r{   r|   Úload_pem_x509_certificateS  s    
   ÿÿz!Backend.load_pem_x509_certificatec                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load certificate)r$  r„   Zd2i_X509_biorv   r‚   r   rí   rÑ   r  r  rP   r¯  r{   r{   r|   Úload_der_x509_certificateb  s    
z!Backend.load_der_x509_certificatec                 C   sb   |   |¡}| j |j| jj| jj| jj¡}|| jjkrF|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzoUnable to load CRL. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)r$  r„   ZPEM_read_bio_X509_CRLrv   r‚   r   rí   rÑ   r  r  rQ   ©r”   r"  r¦  r  r{   r{   r|   Úload_pem_x509_crll  s    
   ÿÿzBackend.load_pem_x509_crlc                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load CRL)r$  r„   Zd2i_X509_CRL_biorv   r‚   r   rí   rÑ   r  r  rQ   r²  r{   r{   r|   Úload_der_x509_crl{  s    
zBackend.load_der_x509_crlc                 C   sb   |   |¡}| j |j| jj| jj| jj¡}|| jjkrF|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzsUnable to load request. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.)r$  r„   ZPEM_read_bio_X509_REQrv   r‚   r   rí   rÑ   r  rr  rR   ©r”   r"  r¦  r}  r{   r{   r|   Úload_pem_x509_csr…  s    
   ÿÿzBackend.load_pem_x509_csrc                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load request)r$  r„   Zd2i_X509_REQ_biorv   r‚   r   rí   rÑ   r  rr  rR   rµ  r{   r{   r|   Úload_der_x509_csr”  s    
zBackend.load_der_x509_csrc           
      C   s(  |   |¡}| j d¡}|d k	rFt d|¡ | j |¡}||_t|ƒ|_||j	| jj
| j | jjd¡|ƒ}|| jj
krÐ|jdkrÈ|  ¡ }	|  |	¡ |jdkr¤tdƒ‚qÐ|jdks²t‚td |jd	 ¡ƒ‚n|  ¡  | j || jj¡}|d k	rü|jdkrütd
ƒ‚|d k	r|jd	ks |d ks t‚||ƒS )NzCRYPTOGRAPHY_PASSWORD_DATA *r¡  ZCryptography_pem_password_cbr   éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.r   r«  )r$  r‚   rª   r   Ú_check_byteslikeræ   r¡  r«   rè   rv   r   rj  r„   rk  Úerrorrí   r˜   rc  rñ   rÑ   r»   Úmaxsizer¤  r  r  Úcalled)
r”   Zopenssl_read_funcZconvert_funcr"  r¡  r¦  ZuserdataZpassword_ptrr  r–   r{   r{   r|   r   ž  sV    

 ÿú	


ÿÿÿÿÿÿþzBackend._load_keyc                    sÞ   ˆ   ¡ }|stdƒ‚nÄ|d  ˆ jjˆ jj¡sF|d  ˆ jjˆ jj¡rPtdƒ‚nŠ|d  ˆ jjˆ jj¡s€|d  ˆ jj	ˆ jj
¡rŽtdtjƒ‚nLt‡ fdd„|D ƒƒr®tdƒ‚n,|d jˆ jjˆ jj	ˆ jjfksÒt‚tdƒ‚d S )NzCould not deserialize key data.r   z Bad decrypt. Incorrect password?z0PEM data is encrypted with an unsupported cipherc                 3   s"   | ]}|  ˆ jjˆ jj¡V  qd S r²   )Ú_lib_reason_matchr„   ÚERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)rš  r»  r“   r{   r|   Ú	<genexpr>ç  s
   üþz4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.)rí   rÑ   r¾  r„   r¿  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZEVP_R_UNKNOWN_PBE_ALGORITHMZERR_LIB_PEMZPEM_R_UNSUPPORTED_ENCRYPTIONr
   r   ZUNSUPPORTED_CIPHERÚanyrƒ   ZERR_LIB_ASN1rñ   )r”   r–   r{   r“   r|   r¤  Ï  sH    
 ÿþþ
 ÿ ÿþþû
ý
z!Backend._handle_key_loading_errorc                 C   sv   z|   |¡}W n tk
r*   | jj}Y nX | j |¡}|| jjkrP|  ¡  dS |  || jjk¡ | j 	|¡ dS d S )NFT)
Ú_elliptic_curve_to_nidr
   r„   r  ZEC_GROUP_new_by_curve_namer‚   r   rí   r˜   ZEC_GROUP_free)r”   ÚcurveÚ	curve_nidÚgroupr{   r{   r|   Úelliptic_curve_supportedø  s    z Backend.elliptic_curve_supportedc                 C   s   t |tjƒsdS |  |¡S rÂ   )rÃ   rX   ZECDSArÆ  )r”   Zsignature_algorithmrÃ  r{   r{   r|   Ú,elliptic_curve_signature_algorithm_supported  s    z4Backend.elliptic_curve_signature_algorithm_supportedc                 C   s\   |   |¡rD|  |¡}| j |¡}|  |dk¡ |  |¡}t| ||ƒS td |j	¡t
jƒ‚dS )z@
        Generate a new private key on the named curve.
        r   z#Backend object does not support {}.N)rÆ  Ú_ec_key_new_by_curver„   ZEC_KEY_generate_keyr˜   Ú_ec_cdata_to_evp_pkeyr2   r
   r»   rº   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)r”   rÃ  r;  r¤   r  r{   r{   r|   Ú#generate_elliptic_curve_private_key  s    



þz+Backend.generate_elliptic_curve_private_keyc                 C   sp   |j }|  |j¡}| j |  |j¡| jj¡}| j 	||¡}|  
|dk¡ |  ||j|j¡}|  |¡}t| ||ƒS rŸ   )r  rÈ  rÃ  r‚   r  r  Úprivate_valuer„   ÚBN_clear_freeÚEC_KEY_set_private_keyr˜   Ú)_ec_key_set_public_key_affine_coordinatesrV  rU  rÉ  r2   )r”   r  Úpublicr;  rÌ  r¤   r  r{   r{   r|   Ú#load_elliptic_curve_private_numbers%  s    
 ÿ  ÿ
z+Backend.load_elliptic_curve_private_numbersc                 C   s4   |   |j¡}|  ||j|j¡}|  |¡}t| ||ƒS r²   )rÈ  rÃ  rÏ  rV  rU  rÉ  r3   )r”   r  r;  r  r{   r{   r|   Ú"load_elliptic_curve_public_numbers8  s      ÿ
z*Backend.load_elliptic_curve_public_numbersc           	   	   C   sÎ   |   |¡}| j |¡}|  || jjk¡ | j |¡}|  || jjk¡ | j || jj¡}|  	¡ 6}| j 
|||t|ƒ|¡}|dkr’|  ¡  tdƒ‚W 5 Q R X | j ||¡}|  |dk¡ |  |¡}t| ||ƒS )Nr   z(Invalid public bytes for the given curve)rÈ  r„   ÚEC_KEY_get0_groupr˜   r‚   r   ÚEC_POINT_newr  ÚEC_POINT_freeÚ_tmp_bn_ctxZEC_POINT_oct2pointr«   rí   rÑ   ÚEC_KEY_set_public_keyrÉ  r3   )	r”   rÃ  Zpoint_bytesr;  rÅ  ÚpointÚbn_ctxr¤   r  r{   r{   r|   Ú load_elliptic_curve_public_bytesA  s*    

    ÿ
z(Backend.load_elliptic_curve_public_bytesc              	   C   sD  |   |¡}|  |¡\}}| j |¡}|  || jjk¡ | j || jj¡}|  	|¡}| j || jj
¡}|  ¡ h}| j |||| jj| jj|¡}	|  |	dk¡ | j |¡}
| j |¡}||||
||ƒ}	|  |	dk¡ W 5 Q R X | j ||¡}	|  |	dk¡ |  	|¡}| j || jj
¡}| j ||¡}	|  |	dk¡ |  |¡}t| ||ƒS rŸ   )rÈ  Ú _ec_key_determine_group_get_funcr„   rÔ  r˜   r‚   r   r  rÕ  r  rÍ  rÖ  ZEC_POINT_mulZ
BN_CTX_getr×  rÎ  rÉ  r2   )r”   rÌ  rÃ  r;  Úget_funcrÅ  rØ  rt  rÙ  r¤   Zbn_xZbn_yÚprivater  r{   r{   r|   Ú!derive_elliptic_curve_private_keyU  s:    


     ÿ

z)Backend.derive_elliptic_curve_private_keyc                 C   s   |   |¡}|  |¡S r²   )rÂ  Ú_ec_key_new_by_curve_nid)r”   rÃ  rÄ  r{   r{   r|   rÈ  x  s    
zBackend._ec_key_new_by_curvec                 C   sB   | j  |¡}|  || jjk¡ | j  |tj j¡ | j || j j	¡S r²   )
r„   ZEC_KEY_new_by_curve_namer˜   r‚   r   ZEC_KEY_set_asn1_flagÚbackendZOPENSSL_EC_NAMED_CURVEr  r5  )r”   rÄ  r;  r{   r{   r|   rß  |  s     ÿz Backend._ec_key_new_by_curve_nidc                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load OCSP request)r$  r„   Zd2i_OCSP_REQUEST_biorv   r‚   r   rí   rÑ   r  ÚOCSP_REQUEST_freerF   )r”   r"  r¦  Úrequestr{   r{   r|   Úload_der_ocsp_request‰  s    
zBackend.load_der_ocsp_requestc                 C   sV   |   |¡}| j |j| jj¡}|| jjkr:|  ¡  tdƒ‚| j || jj	¡}t
| |ƒS )NzUnable to load OCSP response)r$  r„   Zd2i_OCSP_RESPONSE_biorv   r‚   r   rí   rÑ   r  ÚOCSP_RESPONSE_freerG   )r”   r"  r¦  Úresponser{   r{   r|   Úload_der_ocsp_response“  s    
zBackend.load_der_ocsp_responsec           	      C   s°   | j  ¡ }|  || jjk¡ | j || j j¡}|j\}}}|  |¡}| j  	||j
|j
¡}|  || jjk¡ | j  ||¡}|  || jjk¡ | j|j| j|| j jdd t| |ƒS )NTrl  )r„   ZOCSP_REQUEST_newr˜   r‚   r   r  rá  Ú_requestrÁ   ÚOCSP_cert_to_idÚ_x509ZOCSP_request_add0_idrx  ry  rß   ZOCSP_REQUEST_add_extrF   )	r”   r|  Zocsp_reqÚcertZissuerrµ   r¾   ÚcertidZonereqr{   r{   r|   Úcreate_ocsp_request  s"    

ûzBackend.create_ocsp_requestc              	   C   sô  |   ||¡ | j ¡ }|  || jjk¡ | j || jj¡}|  |j	j
¡}| j ||j	jj|j	jj¡}|  || jjk¡ | j || jj¡}|j	jd kršd}nt|j	j }|j	jd kr¼| jj}n|  |j	j¡}| jj}	|j	jd k	rì|  |j	j¡}	|  |j	j¡}
| j |||j	jj|||
|	¡}|  || jjk¡ |  ||¡}|j\}}| jj}|tjjkrb|| jjO }|j d k	rš|j D ]$}| j !||j¡}|  |dk¡ qt| j"|j#| j$|| jj%dd | j &||j|j'|| jj|¡}|dkrð|  (¡ }t)d|ƒ‚|S )Nr¸  r   Trl  zAError while signing. responder_cert must be signed by private_key)*rg  r„   ZOCSP_BASICRESP_newr˜   r‚   r   r  ZOCSP_BASICRESP_freerÁ   Ú	_responserE  rè  Z_certré  Z_issuerZOCSP_CERTID_freeZ_revocation_reasonr"   Z_revocation_timerŒ  r  Z_this_updateZOCSP_basic_add1_statusZ_cert_statusrt  rq  Z_responder_idZOCSP_NOCERTSrt   ZOCSPResponderEncodingÚHASHZOCSP_RESPID_KEYZ_certsZOCSP_basic_add1_certrx  ry  rà   ZOCSP_BASICRESP_add_extZOCSP_basic_signrw  rî   rÑ   )r”   r|  rf  rµ   Úbasicr¾   rë  ÚreasonZrev_timer‘  Zthis_updater¤   Zresponder_certZresponder_encodingÚflagsrê  r–   r{   r{   r|   Ú_create_ocsp_basic_response°  sŽ    
ÿýÿ
ÿÿù	

ûú
ýz#Backend._create_ocsp_basic_responsec                 C   sb   |t jjkr|  |||¡}n| jj}| j |j|¡}|  	|| jjk¡ | j 
|| jj¡}t| |ƒS r²   )rt   ZOCSPResponseStatusZ
SUCCESSFULrò  r‚   r   r„   ZOCSP_response_creatert  r˜   r  rä  rG   )r”   Zresponse_statusr|  rf  rµ   rï  Z	ocsp_respr{   r{   r|   Úcreate_ocsp_response  s      ÿ ÿzBackend.create_ocsp_responsec                 C   s   |   |¡ot|tjƒS r²   )rÆ  rÃ   rX   ZECDH)r”   rµ   rÃ  r{   r{   r|   Ú+elliptic_curve_exchange_algorithm_supported  s     ÿz3Backend.elliptic_curve_exchange_algorithm_supportedc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rŸ   )r   r„   ZEVP_PKEY_set1_EC_KEYr˜   )r”   r;  r  r¤   r{   r{   r|   rÉ    s    zBackend._ec_cdata_to_evp_pkeyc                 C   sN   dddœ}|  |j|j¡}| j | ¡ ¡}|| jjkrJtd |j¡tj	ƒ‚|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z${} is not a supported elliptic curve)
Úgetrº   r„   Ú
OBJ_sn2nidr½   r  r
   r»   r   rÊ  )r”   rÃ  Zcurve_aliasesZ
curve_namerÄ  r{   r{   r|   rÂ  !  s    

þzBackend._elliptic_curve_to_nidc              	   c   sX   | j  ¡ }|  || jjk¡ | j || j j¡}| j  |¡ z
|V  W 5 | j  |¡ X d S r²   )	r„   Z
BN_CTX_newr˜   r‚   r   r  ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)r”   rÙ  r{   r{   r|   rÖ  2  s    

zBackend._tmp_bn_ctxc                 C   s¼   |   || jjk¡ | j d¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ | j |¡}|   || jjk¡ ||kr¤| jj	r¤| jj
}n| jj}|s´t‚||fS )zu
        Given an EC_KEY determine the group and what function is required to
        get point coordinates.
        s   characteristic-two-field)r˜   r‚   r   r„   rö  r  rÓ  ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFprñ   )r”   rI  Znid_two_fieldrÅ  Úmethodrž  rÜ  r{   r{   r|   rÛ  =  s    
z(Backend._ec_key_determine_group_get_funcc                 C   st   |dk s|dk rt dƒ‚| j |  |¡| jj¡}| j |  |¡| jj¡}| j |||¡}|dkrp|  ¡  t dƒ‚|S )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.r   zInvalid EC key.)rÑ   r‚   r  r  r„   r  Z(EC_KEY_set_public_key_affine_coordinatesrí   )r”   rI  rV  rU  r¤   r{   r{   r|   rÏ  Y  s    ÿz1Backend._ec_key_set_public_key_affine_coordinatesc           
      C   s(  t |tjƒstdƒ‚t |tjƒs(tdƒ‚t |tjƒs<tdƒ‚t |tjƒrNd}n0t |tjƒrv|j}t	|ƒdkr~t
dƒ‚nt
dƒ‚|tjjkrÌ|tjjkr | jj}n|tjjkr¶| jj}nt
dƒ‚|  |||¡S |tjjkrì| jrôt |tjƒsôt
d	ƒ‚| j |¡}	|tjjkrl|	| jjkr&| jj}n8|	| jjkr>| jj}n |	| jjkrV| jj}nt
d
ƒ‚|  |||¡S |tjjkrä|rˆt
dƒ‚|	| jjkr | jj}n8|	| jjkr¸| jj}n |	| jjkrÐ| jj}nt
d
ƒ‚|  ||¡S t
dƒ‚|tjjkr|tjjkrt  !||¡S t
dƒ‚t
dƒ‚d S )Nú/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancer›   iÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingúformat is invalid with this key)"rÃ   rV   ÚEncodingrc  ZPrivateFormatZKeySerializationEncryptionÚNoEncryptionÚBestAvailableEncryptionr¡  r«   rÑ   ZPKCS8ÚPEMr„   ZPEM_write_bio_PKCS8PrivateKeyÚDERZi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioZTraditionalOpenSSLr†   r-  r.  ZPEM_write_bio_RSAPrivateKeyr0  ZPEM_write_bio_DSAPrivateKeyr3  ZPEM_write_bio_ECPrivateKeyZi2d_RSAPrivateKey_bioZi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bioÚ_bio_func_outputÚOpenSSHrs   Zserialize_ssh_private_key)
r”   Úencodingr»   Úencryption_algorithmr´   r  Úcdatar¡  Ú	write_bior9  r{   r{   r|   Ú_private_key_bytesm  s¦    ÿ ÿÿ ÿÿ

  ÿ ÿÿ


ÿ  ÿÿ


ÿÿzBackend._private_key_bytesc              	   C   s<   |s| j j}n| j d¡}|  ||||t|ƒ| j j| j j¡S )Ns   aes-256-cbc)r‚   r   r„   ÚEVP_get_cipherbynamer   r«   )r”   r  r  r¡  rÏ   r{   r{   r|   rÿ  Ö  s    
ùz"Backend._private_key_bytes_via_bioc                 G   s.   |   ¡ }||f|žŽ }|  |dk¡ |  |¡S rŸ   )r%  r˜   r'  )r”   r  Úargsrv   r¤   r{   r{   r|   r   ç  s    zBackend._bio_func_outputc                 C   s  t |tjƒstdƒ‚t |tjƒs(tdƒ‚|tjjkrt|tjjkrJ| jj}n|tjj	kr`| jj
}ntdƒ‚|  ||¡S |tjjkrà| j |¡}|| jjkr tdƒ‚|tjjkr¶| jj}n|tjj	krÌ| jj}ntdƒ‚|  ||¡S |tjjkr|tjjkrt |¡S tdƒ‚tdƒ‚d S )Nrø  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingrù  )rÃ   rV   rú  rc  ZPublicFormatZSubjectPublicKeyInforý  r„   ZPEM_write_bio_PUBKEYrþ  Zi2d_PUBKEY_biorÑ   r   ZPKCS1r-  r.  ZPEM_write_bio_RSAPublicKeyZi2d_RSAPublicKey_bior  rs   Zserialize_ssh_public_key)r”   r  r»   r´   r  r  r  r9  r{   r{   r|   Ú_public_key_bytesí  s@    ÿ

ÿ


ÿzBackend._public_key_bytesc                 C   sÌ   |t jjkrtdƒ‚| j d¡}| j || jj|| jj¡ |t jj	krj|d | jjkr`| jj
}q¢| jj}n8|t jjkrš|d | jjkr| jj}q¢| jj}ntdƒ‚|  ¡ }|||ƒ}|  |dk¡ |  |¡S )Nz!OpenSSH encoding is not supportedrý   r   rø  r   )rV   rú  r  rc  r‚   rª   r„   ZDH_get0_pqgr   rý  ZPEM_write_bio_DHxparamsZPEM_write_bio_DHparamsrþ  ZCryptography_i2d_DHxparams_bioZi2d_DHparams_bior%  r˜   r'  )r”   r  r»   r  r  r  rv   r¤   r{   r{   r|   Ú_parameter_bytes  s"    




zBackend._parameter_bytesc                 C   s|   |dk rt dƒ‚|dkr t dƒ‚| j ¡ }|  || jjk¡ | j || jj¡}| j |||| jj¡}|  |dk¡ t	| |ƒS )Nr  z%DH key_size must be at least 512 bits)rü   é   zDH generator must be 2 or 5r   )
rÑ   r„   ÚDH_newr˜   r‚   r   r  r7  ZDH_generate_parameters_exr+   )r”   Ú	generatorr  Zdh_param_cdatar¤   r{   r{   r|   Úgenerate_dh_parameters6  s    
   ÿzBackend.generate_dh_parametersc                 C   s(   |   ¡ }| j ||¡}|  |dk¡ |S rŸ   )r   r„   ZEVP_PKEY_set1_DHr˜   )r”   r<  r  r¤   r{   r{   r|   Ú_dh_cdata_to_evp_pkeyH  s    zBackend._dh_cdata_to_evp_pkeyc                 C   s<   t |j| ƒ}| j |¡}|  |dk¡ |  |¡}t| ||ƒS rŸ   )r.   Z	_dh_cdatar„   ZDH_generate_keyr˜   r  r,   )r”   rL  Zdh_key_cdatar¤   r  r{   r{   r|   Úgenerate_dh_private_keyN  s
    
zBackend.generate_dh_private_keyc                 C   s   |   |  ||¡¡S r²   )r  r  )r”   r  r  r{   r{   r|   Ú&generate_dh_private_key_and_parametersX  s    
ÿz.Backend.generate_dh_private_key_and_parametersc                 C   s>  |j j}| j ¡ }|  || jjk¡ | j || jj¡}|  	|j
¡}|  	|j¡}|jd k	rf|  	|j¡}n| jj}|  	|j j¡}|  	|j¡}| j ||||¡}	|  |	dk¡ | j |||¡}	|  |	dk¡ | j dd¡}
| j ||
¡}	|  |	dk¡ |
d dkr(|jdkr |
d | jjA dks(tdƒ‚|  |¡}t| ||ƒS )Nr   úint[]r   rü   z.DH private numbers did not pass safety checks.)r  rT  r„   r  r˜   r‚   r   r  r7  r  r  rP  r  rU  rV  ÚDH_set0_pqgÚDH_set0_keyrª   ÚCryptography_DH_checkZDH_NOT_SUITABLE_GENERATORrÑ   r  r,   )r”   r  rT  r<  r  rP  r  rQ  rR  r¤   Úcodesr  r{   r{   r|   Úload_dh_private_numbers]  s4    


ÿþ
zBackend.load_dh_private_numbersc           
      C   sÐ   | j  ¡ }|  || jjk¡ | j || j j¡}|j}|  |j	¡}|  |j
¡}|jd k	rd|  |j¡}n| jj}|  |j¡}| j  ||||¡}|  |dk¡ | j  ||| jj¡}|  |dk¡ |  |¡}	t| ||	ƒS rŸ   )r„   r  r˜   r‚   r   r  r7  rT  r  r  rP  r  rU  r  r  r  r-   )
r”   r  r<  rT  r  rP  r  rQ  r¤   r  r{   r{   r|   Úload_dh_public_numbers‹  s     


zBackend.load_dh_public_numbersc                 C   s   | j  ¡ }|  || jjk¡ | j || j j¡}|  |j¡}|  |j	¡}|j
d k	r^|  |j
¡}n| jj}| j  ||||¡}|  |dk¡ t| |ƒS rŸ   )r„   r  r˜   r‚   r   r  r7  r  r  rP  r  r  r+   )r”   r  r<  r  rP  r  r¤   r{   r{   r|   Úload_dh_parameter_numbers¦  s    

z!Backend.load_dh_parameter_numbersc                 C   s´   | j  ¡ }|  || jjk¡ | j || j j¡}|  |¡}|  |¡}|d k	rV|  |¡}n| jj}| j  ||||¡}|  |dk¡ | j 	dd¡}| j  
||¡}|  |dk¡ |d dkS )Nr   r  r   )r„   r  r˜   r‚   r   r  r7  r  r  rª   r  )r”   r  rP  r  r<  r¤   r  r{   r{   r|   Údh_parameters_supported¸  s    


zBackend.dh_parameters_supportedc                 C   s   | j jdkS rŸ   )r„   r‘   r“   r{   r{   r|   Údh_x942_serialization_supportedÎ  s    z'Backend.dh_x942_serialization_supportedc                    sx   t ˆ |ƒ}ˆ j d¡}ˆ j ||¡}ˆ  |d ˆ jjk¡ ˆ j |‡ fdd„¡}ˆ  |dk¡ ˆ j |d |¡d d … S )Nzunsigned char **r   c                    s   ˆ j  | d ¡S r™   )r„   rö   )Úpointerr“   r{   r|   rš   ×  r›   z)Backend.x509_name_bytes.<locals>.<lambda>)	r@   r‚   rª   r„   Zi2d_X509_NAMEr˜   r   r  rç   )r”   rº   Z	x509_nameÚppr¤   r{   r“   r|   Úx509_name_bytesÑ  s    
 
ÿzBackend.x509_name_bytesc                 C   sh   t |ƒdkrtdƒ‚|  ¡ }| j || jj¡}|  |dk¡ | j ||t |ƒ¡}|  |dk¡ t| |ƒS )Né    z%An X25519 public key is 32 bytes longr   )	r«   rÑ   r   r„   ZEVP_PKEY_set_typeÚ
NID_X25519r˜   ZEVP_PKEY_set1_tls_encodedpointrM   )r”   r"  r  r¤   r{   r{   r|   Úx25519_load_public_bytesÜ  s      ÿz Backend.x25519_load_public_bytesc              	   C   s¬   t |ƒdkrtdƒ‚d}|  d¡<}||dd…< ||dd …< |  |¡}| j |j| jj¡}W 5 Q R X |  	|| jjk¡ | j 
|| jj¡}|  	| j |¡| jjk¡ t| |ƒS )Nr  z&An X25519 private key is 32 bytes longs   0. 0+en" é0   r   rð   )r«   rÑ   Ú_zeroed_bytearrayr$  r„   r¬  rv   r‚   r   r˜   r  r  r-  r*  rL   )r”   r"  Zpkcs8_prefixÚbarv   r  r{   r{   r|   Úx25519_load_private_bytesë  s    
ÿz!Backend.x25519_load_private_bytesc                 C   s¨   | j  || jj¡}|  || jjk¡ | j || j j¡}| j  |¡}|  |dk¡ | j d¡}| j  	||¡}|  |dk¡ |  |d | jjk¡ | j |d | j j
¡}|S )Nr   úEVP_PKEY **r   )r„   ZEVP_PKEY_CTX_new_idr‚   r   r˜   r  ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initrª   ZEVP_PKEY_keygenr  )r”   rž  Zevp_pkey_ctxr¤   Z	evp_ppkeyr  r{   r{   r|   Ú_evp_pkey_keygen_gc	  s    zBackend._evp_pkey_keygen_gcc                 C   s   |   | jj¡}t| |ƒS r²   )r'  r„   r   rL   r  r{   r{   r|   Úx25519_generate_key	  s    zBackend.x25519_generate_keyc                 C   s   | j r
dS | jjS rÂ   )r†   r„   Z#CRYPTOGRAPHY_OPENSSL_110_OR_GREATERr“   r{   r{   r|   Úx25519_supported	  s    zBackend.x25519_supportedc                 C   s`   t |ƒdkrtdƒ‚| j | jj| jj|t |ƒ¡}|  || jjk¡ | j || jj	¡}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)r«   rÑ   r„   ÚEVP_PKEY_new_raw_public_keyÚNID_X448r‚   r   r˜   r  r  rO   ©r”   r"  r  r{   r{   r|   Úx448_load_public_bytes#	  s       ÿzBackend.x448_load_public_bytesc                 C   sl   t |ƒdkrtdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}|  || jjk¡ | j 	|| jj
¡}t| |ƒS )Nr*  z$An X448 private key is 56 bytes long)r«   rÑ   r‚   ræ   r„   ÚEVP_PKEY_new_raw_private_keyr,  r   r˜   r  r  rN   ©r”   r"  r#  r  r{   r{   r|   Úx448_load_private_bytes.	  s       ÿzBackend.x448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r²   )r'  r„   r,  rN   r  r{   r{   r|   Úx448_generate_key:	  s    zBackend.x448_generate_keyc                 C   s   | j r
dS | jj S rÂ   )r†   r„   Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r“   r{   r{   r|   Úx448_supported>	  s    zBackend.x448_supportedc                 C   s   | j r
dS | jj S rÂ   ©r†   r„   Z#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Br“   r{   r{   r|   Úed25519_supportedC	  s    zBackend.ed25519_supportedc                 C   sn   t  d|¡ t|ƒtjkr"tdƒ‚| j | jj| j	j
|t|ƒ¡}|  || j	j
k¡ | j	 || jj¡}t| |ƒS )Nr"  z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesr«   rY   Ú_ED25519_KEY_SIZErÑ   r„   r+  ÚNID_ED25519r‚   r   r˜   r  r  r5   r-  r{   r{   r|   Úed25519_load_public_bytesH	  s       ÿz!Backend.ed25519_load_public_bytesc                 C   sz   t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j 	| jj
| jj|t |ƒ¡}|  || jjk¡ | j || jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longr"  )r«   rY   r7  rÑ   r   rº  r‚   ræ   r„   r/  r8  r   r˜   r  r  r4   r0  r{   r{   r|   Úed25519_load_private_bytesV	  s       ÿz"Backend.ed25519_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r²   )r'  r„   r8  r4   r  r{   r{   r|   Úed25519_generate_keyd	  s    zBackend.ed25519_generate_keyc                 C   s   | j r
dS | jj S rÂ   r4  r“   r{   r{   r|   Úed448_supportedh	  s    zBackend.ed448_supportedc                 C   sl   t  d|¡ t|ƒtkr tdƒ‚| j | jj| jj	|t|ƒ¡}|  
|| jj	k¡ | j || jj¡}t| |ƒS )Nr"  z$An Ed448 public key is 57 bytes long)r   r6  r«   r6   rÑ   r„   r+  Ú	NID_ED448r‚   r   r˜   r  r  r8   r-  r{   r{   r|   Úed448_load_public_bytesm	  s       ÿzBackend.ed448_load_public_bytesc                 C   sx   t  d|¡ t|ƒtkr tdƒ‚| j |¡}| j | jj	| jj
|t|ƒ¡}|  || jj
k¡ | j || jj¡}t| |ƒS )Nr"  z%An Ed448 private key is 57 bytes long)r   rº  r«   r6   rÑ   r‚   ræ   r„   r/  r=  r   r˜   r  r  r7   r0  r{   r{   r|   Úed448_load_private_bytesz	  s       ÿz Backend.ed448_load_private_bytesc                 C   s   |   | jj¡}t| |ƒS r²   )r'  r„   r=  r7   r  r{   r{   r|   Úed448_generate_keyˆ	  s    zBackend.ed448_generate_keyc                 C   s†   | j  d|¡}| j  |¡}| j |t|ƒ|t|ƒ|||tj||¡
}	|	dkrr|  ¡ }
d| | d }t	d 
|¡|
ƒ‚| j  |¡d d … S )Nrå   r   é€   i   zJNot enough memory to derive key. These parameters require {} MB of memory.)r‚   rª   ræ   r„   ZEVP_PBE_scryptr«   rq   Z
_MEM_LIMITrî   ÚMemoryErrorr»   rç   )r”   rê   ré   rè   r  Úrr  r®   rë   r¤   r–   Z
min_memoryr{   r{   r|   Úderive_scryptŒ	  s0    öÿýzBackend.derive_scryptc                 C   s2   t  |¡}| jr|| jkrdS | j |¡| jjkS rÂ   )r   Z_aead_cipher_namer†   Ú
_fips_aeadr„   r  r‚   r   )r”   rÍ   Úcipher_namer{   r{   r|   Úaead_cipher_supported§	  s    
zBackend.aead_cipher_supportedc              
   c   s&   t |ƒ}z
|V  W 5 |  ||¡ X dS )zÁ
        This method creates a bytearray, which we copy data into (hopefully
        also from a mutable buffer that can be dynamically erased!), and then
        zero when we're done.
        N)Ú	bytearrayÚ
_zero_data)r”   rè   r$  r{   r{   r|   r#  ­	  s    
zBackend._zeroed_bytearrayc                 C   s   t |ƒD ]}d||< qd S r™   r   )r”   r"  rè   r•  r{   r{   r|   rI  º	  s    zBackend._zero_datac                 c   sf   |dkr| j jV  nNt|ƒ}| j  d|d ¡}| j  |||¡ z
|V  W 5 |  | j  d|¡|¡ X dS )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nr§   r   z	uint8_t *)r‚   r   r«   rª   ÚmemmoverI  Úcast)r”   r"  Zdata_lenr®   r{   r{   r|   Ú_zeroed_null_terminated_bufÁ	  s    
z#Backend._zeroed_null_terminated_bufc              	   C   sÊ  |d k	rt  d|¡ |  |¡}| j |j| jj¡}|| jjkrN|  ¡  t	dƒ‚| j 
|| jj¡}| j d¡}| j d¡}| j d¡}|  |¡}| j |||||¡}	W 5 Q R X |	dkrÆ|  ¡  t	dƒ‚d }
d }g }|d | jjkr| j 
|d | jj¡}|  |¡}|d | jjkr6| j 
|d | jj¡}t| |ƒ}
|d | jjkrÀ| j 
|d | jj¡}| j |d ¡}t|ƒD ]H}| j ||¡}|  || jjk¡ | j 
|| jj¡}| t| |ƒ¡ qv||
|fS )Nr¡  z!Could not deserialize PKCS12 datar&  zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data)r   rº  r$  r„   Zd2i_PKCS12_biorv   r‚   r   rí   rÑ   r  ÚPKCS12_freerª   rL  ZPKCS12_parser  r=  r  rP   Úsk_X509_freeÚsk_X509_numr   Úsk_X509_valuer˜   r’   )r”   r"  r¡  rv   Úp12Zevp_pkey_ptrZx509_ptrZsk_x509_ptrÚpassword_bufr¤   rê  r´   Zadditional_certificatesr  r	   Úsk_x509r  r•  r{   r{   r|   Ú%load_key_and_certificates_from_pkcs12Ø	  sP    
    ÿ

z-Backend.load_key_and_certificates_from_pkcs12c                 C   sŠ  d }|d k	rt  d|¡ t|tjƒr6d}d}d}	d}
n4t|tjƒrb| jj}| jj}d}	d}
|j}nt	dƒ‚|d ks~t
|ƒdkrˆ| jj}nH| j ¡ }| j || jj¡}t|ƒD ]"}| j ||j¡}t |dk¡ q¬|  |¡X}|  |¡B}| j |||rü|jn| jj|r|jn| jj||||	|
d¡
}W 5 Q R X W 5 Q R X |  || jjk¡ | j || jj¡}|  ¡ }| j ||¡}|  |dk¡ |  |¡S )Nrº   r¸  r   i N  r   zUnsupported key encryption type)r   r6  rÃ   rV   rû  rü  r„   Z&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr¡  rÑ   r«   r‚   r   Úsk_X509_new_nullr  rN  ÚreversedÚsk_X509_pushré  rà  r˜   rL  ZPKCS12_createrw  rM  r%  Zi2d_PKCS12_bior'  )r”   rº   r´   rê  Zcasr  r¡  Znid_certZnid_keyZpkcs12_iterZmac_iterrS  Úcar¤   rR  Zname_bufrQ  rv   r{   r{   r|   Ú(serialize_key_and_certificates_to_pkcs12
  sZ     ÿ

öz0Backend.serialize_key_and_certificates_to_pkcs12c                 C   s   | j r
dS | jjdkS )NFr   )r†   r„   ZCryptography_HAS_POLY1305r“   r{   r{   r|   Úpoly1305_supportedF
  s    zBackend.poly1305_supportedc                 C   s*   t  d|¡ t|ƒtkr tdƒ‚t| |ƒS )Nr´   zA poly1305 key is 32 bytes long)r   rº  r«   rH   rÑ   rI   )r”   r´   r{   r{   r|   Úcreate_poly1305_ctxK
  s    zBackend.create_poly1305_ctxc                 C   sn   t  d|¡ |  |¡}| j |j| jj| jj| jj¡}|| jjkrR|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S ©Nr"  zUnable to parse PKCS7 data)r   r6  r$  r„   ZPEM_read_bio_PKCS7rv   r‚   r   rí   rÑ   r  Ú
PKCS7_freeÚ_load_pkcs7_certificates©r”   r"  rv   Úp7r{   r{   r|   Úload_pem_pkcs7_certificatesR
  s    
   ÿz#Backend.load_pem_pkcs7_certificatesc                 C   sb   t  d|¡ |  |¡}| j |j| jj¡}|| jjkrF|  ¡  t	dƒ‚| j 
|| jj¡}|  |¡S r\  )r   r6  r$  r„   Zd2i_PKCS7_biorv   r‚   r   rí   rÑ   r  r]  r^  r_  r{   r{   r|   Úload_der_pkcs7_certificates_
  s    
z#Backend.load_der_pkcs7_certificatesc           	      C   sÆ   | j  |j¡}|  || j jk¡ || j jkr>td |¡tj	ƒ‚|j
jj}| j  |¡}g }t|ƒD ]`}| j  ||¡}|  || jjk¡ | j  |¡}|  |dk¡ | j || j j¡}| t| |ƒ¡ q`|S )NzNOnly basic signed structures are currently supported. NID for this data was {}r   )r„   ZOBJ_obj2nidrË   r˜   r  ZNID_pkcs7_signedr
   r»   r   ZUNSUPPORTED_SERIALIZATIONr  Úsignrê  rO  r   rP  r‚   r   ZX509_up_refr  r  r’   rP   )	r”   r`  rž  rS  r  Úcertsr•  r	   r¤   r{   r{   r|   r^  j
  s(    ÿý
z Backend._load_pkcs7_certificatesc                 C   s‚  |   |j¡}| jj}d}t|jƒdkr0| jj}nF| j ¡ }| j 	|| jj
¡}|jD ]"}| j ||j¡}	|  |	dk¡ qRtjj|krš|| jjO }|| jjO }| j | jj| jj|| jj|¡}
|  |
| jjk¡ | j 	|
| jj¡}
d}tjj|krü|| jjO }ntjj|kr|| jjO }tjj|kr0|| jjO }|jD ]@\}}}|  |¡}| j |
|j|j||¡}|  || jjk¡ q6|D ]<}|tjjkrœ|| jjO }n|tjj kr||| jj!O }q||  "¡ }|t#j$j%kræ| j &||
|j'|¡}	n„|t#j$j(kr*| j )|
|j'|¡}	|  |	dk¡ | j *||
|j'|¡}	n@|t#j$j+ks<t,‚| j )|
|j'|¡}	|  |	dk¡ | j -||
¡}	|  |	dk¡ |  .|¡S )Nr   r   )/r$  Ú_datar„   ZPKCS7_PARTIALr«   Z_additional_certsr‚   r   rU  r  rN  rW  ré  r˜   rr   ZPKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDZ
PKCS7_signr]  ZNoCapabilitiesZPKCS7_NOSMIMECAPZNoAttributesZPKCS7_NOATTRZNoCertsZPKCS7_NOCERTSZ_signersrÁ   ZPKCS7_sign_add_signerrw  ÚTextZ
PKCS7_TEXTÚBinaryZPKCS7_BINARYr%  rV   rú  ZSMIMEZSMIME_write_PKCS7rv   rý  ZPKCS7_finalZPEM_write_bio_PKCS7_streamrþ  rñ   Zi2d_PKCS7_bior'  )r”   r|  r  Úoptionsrv   Z
init_flagsZfinal_flagsrd  rê  r¤   r`  Zsigner_flagsZcertificaterf  Zhash_algorithmZmdZp7signerinfoÚoptionZbio_outr{   r{   r|   Ú
pkcs7_signƒ
  s†    


û
    ÿ   ÿ   ÿzBackend.pkcs7_sign)N)N)N)¯rx   ry   rz   Ú__doc__rº   rE  r`   rh   rÊ   rU   r?  r@  rA  rB  rC  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256rÄ   Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusr•   r˜   r…   r¥   Ú
contextlibr   r¦   r   r¯   r±   r³   r¶   r¿   rÁ   rÅ   rÈ   rÉ   rÐ   rÔ   rˆ   r‰   rŠ   râ   rã   rä   rì   rí   rî   rú   r  r  r  r  r  r   r	  r$  r%  r'  r=  r>  rD  rG  rJ  rM  rN  rS  rW  rY  rZ  rK  r[  r\  r_  r`  rg  r  r‡  rq  r„  rŒ  r’  rx  r™  r”  rŸ  r¢  r§  r¨  rª  r©  r­  r®  r°  r±  r³  r´  r¶  r·  r   r¤  rÆ  rÇ  rË  rÑ  rÒ  rÚ  rÞ  rÈ  rß  rã  ræ  rì  rò  ró  rô  rÉ  rÂ  rÖ  rÛ  rÏ  r  rÿ  r   r	  r
  r  r  r  r  r  r  r  r  r  r  r!  r%  r'  r(  r)  r.  r1  r2  r3  r5  r9  r:  r;  r<  r>  r?  r@  rD  rG  r#  rI  rL  rT  rY  rZ  r[  ra  rb  r^  rj  r{   r{   r{   r|   r}   ¦   sb  úó
	
	-5 ++	HB	8"


1)		#

U

i0
."
.@r}   c                   @   s   e Zd Zdd„ Zdd„ ZdS )rÕ   c                 C   s
   || _ d S r²   )Ú_fmt)r”   Úfmtr{   r{   r|   r•   Ô
  s    zGetCipherByName.__init__c                 C   s&   | j j||d ¡ }|j | d¡¡S )N)rÍ   rž   r©   )rm  r»   Úlowerr„   r  r½   )r”   rà  rÍ   rž   rF  r{   r{   r|   Ú__call__×
  s    zGetCipherByName.__call__N)rx   ry   rz   r•   rp  r{   r{   r{   r|   rÕ   Ó
  s   rÕ   c                 C   s"   d  |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsrü   r©   )r»   r  r„   r  r½   )rà  rÍ   rž   rF  r{   r{   r|   rØ   Ü
  s    rØ   )¢Ú
__future__r   r   r   Úcollectionsrl  rÖ   rŒ   r   rò   Z	six.movesr   Zcryptographyr   r	   Zcryptography.exceptionsr
   r   Zcryptography.hazmat._derr   r   r   r   r   Z'cryptography.hazmat.backends.interfacesr   r   r   r   r   r   r   r   r   r   r   r   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr!   Z0cryptography.hazmat.backends.openssl.decode_asn1r"   r#   r$   r%   r&   r'   r(   r)   r*   Z'cryptography.hazmat.backends.openssl.dhr+   r,   r-   r.   Z(cryptography.hazmat.backends.openssl.dsar/   r0   r1   Z'cryptography.hazmat.backends.openssl.ecr2   r3   Z,cryptography.hazmat.backends.openssl.ed25519r4   r5   Z*cryptography.hazmat.backends.openssl.ed448r6   r7   r8   Z0cryptography.hazmat.backends.openssl.encode_asn1r9   r:   r;   r<   r=   r>   r?   r@   rA   Z+cryptography.hazmat.backends.openssl.hashesrC   Z)cryptography.hazmat.backends.openssl.hmacrE   Z)cryptography.hazmat.backends.openssl.ocsprF   rG   Z-cryptography.hazmat.backends.openssl.poly1305rH   rI   Z(cryptography.hazmat.backends.openssl.rsarJ   rK   Z+cryptography.hazmat.backends.openssl.x25519rL   rM   Z)cryptography.hazmat.backends.openssl.x448rN   rO   Z)cryptography.hazmat.backends.openssl.x509rP   rQ   rR   rS   Z$cryptography.hazmat.bindings.opensslrT   Zcryptography.hazmat.primitivesrU   rV   Z)cryptography.hazmat.primitives.asymmetricrW   rX   rY   rZ   r[   Z1cryptography.hazmat.primitives.asymmetric.paddingr\   r]   r^   r_   Z1cryptography.hazmat.primitives.ciphers.algorithmsr`   ra   rb   rc   rd   re   rf   rg   rh   Z,cryptography.hazmat.primitives.ciphers.modesri   rj   rk   rl   rm   rn   ro   rp   Z"cryptography.hazmat.primitives.kdfrq   Z,cryptography.hazmat.primitives.serializationrr   rs   Zcryptography.x509rt   Ú
namedtupleru   Úobjectrw   Zregister_interfaceZregister_interface_ifr€   rƒ   ZCryptography_HAS_SCRYPTr}   rÕ   rØ   rà  r{   r{   r{   r|   Ú<module>   s    <,,,(

 ÿ*                    2	