o
    eS                     @  s  U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z
 d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZ d dlmZ d d	lmZmZmZmZ d d
lm Z m!Z!m"Z"m#Z#m$Z$m%Z% z
d dl&m'Z( dZ)W n e*y   dZ)	ddddZ(Y nw dZ+dZ,dZ-dZ.dZ/dZ0dZ1d Z2d!Z3e4d"Z5d#Z6d$Z7d%Z8d&Z9d'Z:d(Z;d)Z<e4e7d* e8 ej=Z>e?e@eAd+d,ZBeG d-d. d.ZCeCejDd/ejEd)d)ddd0eCejDd/ejFd)d)ddd0eCejDd/ejGd)d1d)dd0d2ZHd3eId4< e.e/e0d5ZJdd8d9ZKdd<d=ZLe7d> e8d> fddBdCZMddFdGZNddHdIZOddMdNZPddQdRZQddSdTZRddVdWZSddXdYZTdd[d\ZUG d]d^ d^ZVG d_d` d`ZWG dadb dbZXG dcdd ddZYG dedf dfZZe,eW e-eX e+eZ e.eYdge[ e/eYdhe\ e0eYdie] iZ^ddkdlZ_ej`ejaejbejcejdf Ze	dddpdqZfddudvZgej`ejhejiejjejkf Zlej`ejhejiejkf ZmG dwdx dxejnZoG dydz dzZpdd~dZq	ddddZrdddZsdddZt	ddddZudddZvej`ejaejbejdf ZwdZxG dd dZydS )    )annotationsN)encodebytes)	dataclass)utilsUnsupportedAlgorithm)hashes)dsaeced25519paddingrsa)AEADDecryptionContextCipher
algorithmsmodes)EncodingKeySerializationEncryptionNoEncryptionPrivateFormatPublicFormat_KeySerializationEncryption)kdfTFpasswordbytessaltdesired_key_bytesintroundsignore_few_roundsboolreturnc                 C  s   t d)NzNeed bcrypt moduler   )r   r   r   r   r    r"   c/var/www/html/venv/lib/python3.10/site-packages/cryptography/hazmat/primitives/serialization/ssh.py_bcrypt_kdf1   s   r$   s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   rsa-sha2-256s   rsa-sha2-512s   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   none
   aes256-ctr   s   (.*?)      c                   @  sF   e Zd ZU ded< ded< ded< ded< ded< d	ed
< ded< dS )
_SSHCipherztyping.Type[algorithms.AES]algr   key_lenzTtyping.Union[typing.Type[modes.CTR], typing.Type[modes.CBC], typing.Type[modes.GCM]]mode	block_leniv_lentyping.Optional[int]tag_lenr    is_aeadN)__name__
__module____qualname____annotations__r"   r"   r"   r#   r)   X   s   
 r)       )r*   r+   r,   r-   r.   r0   r1      )r%   s
   aes256-cbcs   aes256-gcm@openssh.comztyping.Dict[bytes, _SSHCipher]_SSH_CIPHERS)	secp256r1	secp384r1	secp521r1key3typing.Union[SSHPrivateKeyTypes, SSHPublicKeyTypes]c                 C  s   t | tjrt|  }|S t | tjrt| }|S t | tjtjfr't	}|S t | t
jt
jfr4t}|S t | tjtjfrAt}|S td)NUnsupported key type)
isinstancer
   EllipticCurvePrivateKey_ecdsa_key_type
public_keyEllipticCurvePublicKeyr   RSAPrivateKeyRSAPublicKey_SSH_RSAr	   DSAPrivateKeyDSAPublicKey_SSH_DSAr   Ed25519PrivateKeyEd25519PublicKey_SSH_ED25519
ValueError)r<   key_typer"   r"   r#   _get_ssh_key_type   s$   
rO   rB   ec.EllipticCurvePublicKeyc                 C  s*   | j }|jtvrtd|jt|j S )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPErM   )rB   rQ   r"   r"   r#   rA      s   


rA      
dataprefixsuffixc                 C  s   d |t| |gS )N    )join_base64_encode)rU   rV   rW   r"   r"   r#   _ssh_pem_encode   s   r[   r-   Nonec                 C  s    | r
t | | dkrtddS )zRequire data to be full blocksr   zCorrupt data: missing paddingN)lenrM   )rU   r-   r"   r"   r#   _check_block_size   s   r^   c                 C  s   | rt ddS )z!All data should have been parsed.zCorrupt data: unparsed dataN)rM   rU   r"   r"   r#   _check_empty   s   r`   
ciphernametyping.Optional[bytes]5Cipher[typing.Union[modes.CBC, modes.CTR, modes.GCM]]c                 C  sV   |st dt|  }t|||j|j |d}t||d|j |||jd S )z$Generate key + iv and return cipher.zKey is password-protected.TN)rM   r8   r$   r+   r.   r   r*   r,   )ra   r   r   r   ciphseedr"   r"   r#   _init_cipher   s   rf   
memoryviewtyping.Tuple[int, memoryview]c                 C  6   t | dk r
tdtj| dd dd| dd fS )Uint32   Invalid dataNbig	byteorderr]   rM   r   
from_bytesr_   r"   r"   r#   _get_u32      "rr   c                 C  ri   )Uint64   rl   Nrm   rn   rp   r_   r"   r"   r#   _get_u64   rs   rv   $typing.Tuple[memoryview, memoryview]c                 C  s8   t | \}} |t| krtd| d| | |d fS )zBytes with u32 length prefixrl   N)rr   r]   rM   )rU   nr"   r"   r#   _get_sshstr   s   ry   c                 C  s4   t | \}} |r|d dkrtdt|d| fS )zBig integer.r      rl   rm   )ry   rM   r   rq   )rU   valr"   r"   r#   
_get_mpint   s   r|   r{   c                 C  s4   | dk rt d| sdS |  d d }t| |S )z!Storage format for signed bigint.r   znegative mpint not allowedrX   ru   )rM   
bit_lengthr   int_to_bytes)r{   nbytesr"   r"   r#   	_to_mpint   s   r   c                   @  sz   e Zd ZU dZded< 	d#d$d	d
Zd%ddZd&ddZd&ddZd'ddZ	d&ddZ
d(ddZd)d*dd Zd+d!d"ZdS ),	_FragListz,Build recursive structure without data copy.typing.List[bytes]flistNinit#typing.Optional[typing.List[bytes]]r!   r\   c                 C  s   g | _ |r| j | d S d S N)r   extend)selfr   r"   r"   r#   __init__  s   z_FragList.__init__r{   r   c                 C  s   | j | dS )zAdd plain bytesN)r   appendr   r{   r"   r"   r#   put_raw	     z_FragList.put_rawr   c                 C     | j |jddd dS )zBig-endian uint32rk   rm   lengthro   Nr   r   to_bytesr   r"   r"   r#   put_u32     z_FragList.put_u32c                 C  r   )zBig-endian uint64ru   rm   r   Nr   r   r"   r"   r#   put_u64  r   z_FragList.put_u64typing.Union[bytes, _FragList]c                 C  sN   t |tttfr| t| | j| dS | |  | j	|j dS )zBytes prefixed with u32 lengthN)
r?   r   rg   	bytearrayr   r]   r   r   sizer   r   r"   r"   r#   
put_sshstr  s
   z_FragList.put_sshstrc                 C  s   |  t| dS )z*Big-endian bigint prefixed with u32 lengthN)r   r   r   r"   r"   r#   	put_mpint  s   z_FragList.put_mpintc                 C  s   t tt| jS )zCurrent number of bytes)summapr]   r   r   r"   r"   r#   r   "  r   z_FragList.sizer   dstbufrg   posc                 C  s2   | j D ]}t|}||| }}||||< q|S )zWrite into bytearray)r   r]   )r   r   r   fragflenstartr"   r"   r#   render&  s
   
z_FragList.renderc                 C  s"   t t|  }| | | S )zReturn as bytes)rg   r   r   r   tobytes)r   bufr"   r"   r#   r   .  s   
z_FragList.tobytesr   )r   r   r!   r\   )r{   r   r!   r\   )r{   r   r!   r\   )r{   r   r!   r\   r!   r   )r   )r   rg   r   r   r!   r   r!   r   )r2   r3   r4   __doc__r5   r   r   r   r   r   r   r   r   r   r"   r"   r"   r#   r      s   
 




	
r   c                   @  sB   e Zd ZdZdddZddd	ZdddZdddZdddZdS )_SSHFormatRSAzhFormat for RSA keys.

    Public:
        mpint e, n
    Private:
        mpint n, e, d, iqmp, p, q
    rU   rg   c                 C  s$   t |\}}t |\}}||f|fS )zRSA public fieldsr|   )r   rU   erx   r"   r"   r#   
get_public>  s   z_SSHFormatRSA.get_publicr!   *typing.Tuple[rsa.RSAPublicKey, memoryview]c                 C  s.   |  |\\}}}t||}| }||fS )zMake RSA public key from data.)r   r   RSAPublicNumbersrB   )r   rU   r   rx   public_numbersrB   r"   r"   r#   load_publicD  s   z_SSHFormatRSA.load_public+typing.Tuple[rsa.RSAPrivateKey, memoryview]c              	   C  s   t |\}}t |\}}t |\}}t |\}}t |\}}t |\}}||f|kr.tdt||}	t||}
t||}t||||	|
||}| }||fS )zMake RSA private key from data.z Corrupt data: rsa field mismatch)r|   rM   r   rsa_crt_dmp1rsa_crt_dmq1r   RSAPrivateNumbersprivate_key)r   rU   	pubfieldsrx   r   diqmppqdmp1dmq1r   private_numbersr   r"   r"   r#   load_privateM  s    z_SSHFormatRSA.load_privaterB   rsa.RSAPublicKeyf_pubr   r\   c                 C  s$   |  }||j ||j dS )zWrite RSA public keyN)r   r   r   rx   )r   rB   r   pubnr"   r"   r#   encode_publicc  s   z_SSHFormatRSA.encode_publicr   rsa.RSAPrivateKeyf_privc                 C  sZ   |  }|j}||j ||j ||j ||j ||j ||j dS )zWrite RSA private keyN)	r   r   r   rx   r   r   r   r   r   )r   r   r   r   r   r"   r"   r#   encode_privatek  s   z_SSHFormatRSA.encode_privateN)rU   rg   )rU   rg   r!   r   )rU   rg   r!   r   )rB   r   r   r   r!   r\   )r   r   r   r   r!   r\   	r2   r3   r4   r   r   r   r   r   r   r"   r"   r"   r#   r   5  s    


	
r   c                   @  sL   e Zd ZdZdddZd d	d
Zd!ddZd"ddZd#ddZd$ddZ	dS )%_SSHFormatDSAzhFormat for DSA keys.

    Public:
        mpint p, q, g, y
    Private:
        mpint p, q, g, y, x
    rU   rg   r!   &typing.Tuple[typing.Tuple, memoryview]c                 C  s@   t |\}}t |\}}t |\}}t |\}}||||f|fS )zDSA public fieldsr   )r   rU   r   r   gyr"   r"   r#   r     s
   z_SSHFormatDSA.get_public*typing.Tuple[dsa.DSAPublicKey, memoryview]c           	      C  sJ   |  |\\}}}}}t|||}t||}| | | }||fS )zMake DSA public key from data.)r   r	   DSAParameterNumbersDSAPublicNumbers	_validaterB   )	r   rU   r   r   r   r   parameter_numbersr   rB   r"   r"   r#   r     s   
z_SSHFormatDSA.load_public+typing.Tuple[dsa.DSAPrivateKey, memoryview]c                 C  sz   |  |\\}}}}}t|\}}||||f|krtdt|||}t||}	| |	 t||	}
|
 }||fS )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r   r|   rM   r	   r   r   r   DSAPrivateNumbersr   )r   rU   r   r   r   r   r   xr   r   r   r   r"   r"   r#   r     s   
z_SSHFormatDSA.load_privaterB   dsa.DSAPublicKeyr   r   r\   c                 C  sL   |  }|j}| | ||j ||j ||j ||j dS )zWrite DSA public keyN)r   r   r   r   r   r   r   r   )r   rB   r   r   r   r"   r"   r#   r     s   
z_SSHFormatDSA.encode_publicr   dsa.DSAPrivateKeyr   c                 C  s$   |  | | || j dS )zWrite DSA private keyN)r   rB   r   r   r   )r   r   r   r"   r"   r#   r     s   z_SSHFormatDSA.encode_privater   dsa.DSAPublicNumbersc                 C  s    |j }|j dkrtdd S )Ni   z#SSH supports only 1024 bit DSA keys)r   r   r}   rM   )r   r   r   r"   r"   r#   r     s   z_SSHFormatDSA._validateNrU   rg   r!   r   )rU   rg   r!   r   )rU   rg   r!   r   )rB   r   r   r   r!   r\   )r   r   r   r   r!   r\   )r   r   r!   r\   )
r2   r3   r4   r   r   r   r   r   r   r   r"   r"   r"   r#   r   {  s    





r   c                   @  sL   e Zd ZdZd!ddZd"ddZd#ddZd$ddZd%ddZd&ddZ	d S )'_SSHFormatECDSAzFormat for ECDSA keys.

    Public:
        str curve
        bytes point
    Private:
        str curve
        bytes point
        mpint secret
    ssh_curve_namer   rQ   ec.EllipticCurvec                 C  s   || _ || _d S r   )r   rQ   )r   r   rQ   r"   r"   r#   r     s   
z_SSHFormatECDSA.__init__rU   rg   r!   r   c                 C  sJ   t |\}}t |\}}|| jkrtd|d dkrtd||f|fS )zECDSA public fieldszCurve name mismatchr   rk   zNeed uncompressed point)ry   r   rM   NotImplementedError)r   rU   rQ   pointr"   r"   r#   r     s   
z_SSHFormatECDSA.get_public3typing.Tuple[ec.EllipticCurvePublicKey, memoryview]c                 C  s.   |  |\\}}}tj| j| }||fS )z Make ECDSA public key from data.)r   r
   rC   from_encoded_pointrQ   r   )r   rU   
curve_namer   rB   r"   r"   r#   r     s
   
z_SSHFormatECDSA.load_public4typing.Tuple[ec.EllipticCurvePrivateKey, memoryview]c                 C  sH   |  |\\}}}t|\}}||f|krtdt|| j}||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r   r|   rM   r
   derive_private_keyrQ   )r   rU   r   r   r   secretr   r"   r"   r#   r     s   z_SSHFormatECDSA.load_privaterB   rP   r   r   r\   c                 C  s*   | tjtj}|| j || dS )zWrite ECDSA public keyN)public_bytesr   X962r   UncompressedPointr   r   )r   rB   r   r   r"   r"   r#   r     s
   z_SSHFormatECDSA.encode_publicr   ec.EllipticCurvePrivateKeyr   c                 C  s,   |  }| }| || ||j dS )zWrite ECDSA private keyN)rB   r   r   r   private_value)r   r   r   rB   r   r"   r"   r#   r     s   z_SSHFormatECDSA.encode_privateN)r   r   rQ   r   r   )rU   rg   r!   r   )rU   rg   r!   r   )rB   rP   r   r   r!   r\   )r   r   r   r   r!   r\   )
r2   r3   r4   r   r   r   r   r   r   r   r"   r"   r"   r#   r     s    






r   c                   @  sB   e Zd ZdZdddZdd	d
ZdddZdddZdddZdS ) _SSHFormatEd25519z~Format for Ed25519 keys.

    Public:
        bytes point
    Private:
        bytes point
        bytes secret_and_point
    rU   rg   r!   r   c                 C  s   t |\}}|f|fS )zEd25519 public fields)ry   )r   rU   r   r"   r"   r#   r     s   
z_SSHFormatEd25519.get_public2typing.Tuple[ed25519.Ed25519PublicKey, memoryview]c                 C  s(   |  |\\}}tj| }||fS )z"Make Ed25519 public key from data.)r   r   rK   from_public_bytesr   )r   rU   r   rB   r"   r"   r#   r     s
   z_SSHFormatEd25519.load_public3typing.Tuple[ed25519.Ed25519PrivateKey, memoryview]c                 C  sb   |  |\\}}t|\}}|dd }|dd }||ks#|f|kr'tdtj|}||fS )z#Make Ed25519 private key from data.Nr6   z$Corrupt data: ed25519 field mismatch)r   ry   rM   r   rJ   from_private_bytes)r   rU   r   r   keypairr   point2r   r"   r"   r#   r   %  s   z_SSHFormatEd25519.load_privaterB   ed25519.Ed25519PublicKeyr   r   r\   c                 C  s   | tjtj}|| dS )zWrite Ed25519 public keyN)r   r   Rawr   r   )r   rB   r   raw_public_keyr"   r"   r#   r   3  s   z_SSHFormatEd25519.encode_publicr   ed25519.Ed25519PrivateKeyr   c                 C  sR   |  }|tjtjt }|tjtj}t||g}| 	|| |
| dS )zWrite Ed25519 private keyN)rB   private_bytesr   r   r   r   r   r   r   r   r   )r   r   r   rB   raw_private_keyr   	f_keypairr"   r"   r#   r   <  s   z _SSHFormatEd25519.encode_privateNr   )rU   rg   r!   r   )rU   rg   r!   r   )rB   r   r   r   r!   r\   )r   r   r   r   r!   r\   r   r"   r"   r"   r#   r   
  s    
	



	r   s   nistp256s   nistp384s   nistp521rN   c                 C  s4   t | tst|  } | tv rt|  S td| )z"Return valid format or throw errorzUnsupported key type: )r?   r   rg   r   _KEY_FORMATSr   )rN   r"   r"   r#   _lookup_kformatW  s
   
r   backend
typing.AnySSHPrivateKeyTypesc                 C  s  t d|  |durt d| t| }|std|d}|d}t	t
| || } | ts9tdt
| ttd } t| \}} t| \}} t| \}} t| \}	} |	dkrctdt| \}
} t|
\}}
t|}||
\}}
t|
 ||fttfkr| }|tvrtd||tkrtd|t| j}t| j}t| \}} t| jrt| }t||krtd	nt|  t|| t|\}}t|\}}t| t||| |}| }t
||}t| jrt |t!sJ t|"| nt|#  nt| \}} t|  d
}t|| t|\}}t|\}}||kr4tdt|\}}||krCtd|$||\}}t|\}}|t%dt| kr`tdt |t&j'rpt(j)dt j*dd |S )z.Load private key from OpenSSH custom encoding.rU   Nr   zNot OpenSSH private key formatr'   zOnly one key supportedzUnsupported cipher: zUnsupported KDF: z+Corrupt data: invalid tag length for cipherru   zCorrupt data: broken checksumzCorrupt data: key type mismatchzCorrupt data: invalid paddingDSSH DSA keys are deprecated and will be removed in a future release.   
stacklevel)+r   _check_byteslike_check_bytes_PEM_RCsearchrM   r   endbinascii
a2b_base64rg   
startswith	_SK_MAGICr]   ry   rr   r   r   r`   _NONEr   r8   r   _BCRYPTr-   r0   r1   r   r^   rf   	decryptorupdater?   r   finalize_with_tagfinalizer   _PADDINGr	   rG   warningswarnDeprecatedIn40)rU   r   r   mp1p2ra   kdfname
kdfoptionsnkeyspubdatapub_key_typekformatr   ciphername_bytesblklenr0   edatatagr   kbufr   rd   decck1ck2rN   r   commentr"   r"   r#   load_ssh_private_keyh  s   










r#  r   encryption_algorithmr   c                 C  s  t d| t| tjrtjdt jdd t| }t	|}t
 }|rQt}t| j}t}t}	t|tr:|jdur:|j}	td}
||
 ||	 t|||
|	}nt }}d}d}d}td}d	}t
 }|| ||  | t
||g}|| || | || |td|| |    t
 }|t || || || || || || | }| }tt || }|!| || }|dur|" #||| ||d  t$|d| S )
z3Serialize private key with OpenSSH custom encoding.r   ISSH DSA key support is deprecated and will be removed in a future releaserk   r   Nr&   ru   r'   rX   )%r   r   r?   r	   rG   r  r  r  rO   r   r   _DEFAULT_CIPHERr8   r-   r  _DEFAULT_ROUNDSr   _kdf_roundsosurandomr   r   rf   r  r   rB   r   r   r  r   r  rg   r   r   	encryptorupdate_intor[   )r   r   r$  rN   r  f_kdfoptionsra   r  r  r   r   rd   r  checkvalr"  f_public_key	f_secretsf_mainslenmlenr   ofsr"   r"   r#   _serialize_ssh_private_key  sj   
















 r5  c                   @  s   e Zd ZdZdZdS )SSHCertificateTyper'   r   N)r2   r3   r4   USERHOSTr"   r"   r"   r#   r6  *  s    r6  c                   @  s   e Zd Zd9ddZed:ddZd;ddZed<d d!Zed=d#d$Zed:d%d&Z	ed>d'd(Z
ed<d)d*Zed<d+d,Zed?d-d.Zed?d/d0Zd;d1d2Zd:d3d4Zd@d6d7Zd8S )ASSHCertificate_noncerg   _public_keySSHPublicKeyTypes_serialr   _cctype_key_id_valid_principalsr   _valid_after_valid_before_critical_optionstyping.Dict[bytes, bytes]_extensions	_sig_type_sig_key_inner_sig_type
_signature_tbs_cert_body_cert_key_typer   
_cert_bodyc                 C  s   || _ || _|| _zt|| _W n ty   tdw || _|| _|| _|| _	|	| _
|
| _|| _|| _|| _|| _|| _|| _|| _d S )NzInvalid certificate type)r:  r;  r=  r6  _typerM   r?  r@  rA  rB  rC  rE  rF  rG  rH  rI  rK  rL  rJ  )r   r:  r;  r=  r>  r?  r@  rA  rB  rC  rE  rF  rG  rH  rI  rJ  rK  rL  r"   r"   r#   r   0  s*   
zSSHCertificate.__init__r!   c                 C  
   t | jS r   )r   r:  r   r"   r"   r#   nonceY     
zSSHCertificate.nonceSSHCertPublicKeyTypesc                 C  s   t t| jS r   )typingcastrQ  r;  r   r"   r"   r#   rB   ]  s   zSSHCertificate.public_keyc                 C     | j S r   )r=  r   r"   r"   r#   serialb     zSSHCertificate.serialr6  c                 C  rT  r   )rM  r   r"   r"   r#   typef  rV  zSSHCertificate.typec                 C  rN  r   )r   r?  r   r"   r"   r#   key_idj  rP  zSSHCertificate.key_idc                 C  rT  r   )r@  r   r"   r"   r#   valid_principalsn  rV  zSSHCertificate.valid_principalsc                 C  rT  r   )rB  r   r"   r"   r#   valid_beforer  rV  zSSHCertificate.valid_beforec                 C  rT  r   )rA  r   r"   r"   r#   valid_afterv  rV  zSSHCertificate.valid_afterc                 C  rT  r   )rC  r   r"   r"   r#   critical_optionsz  rV  zSSHCertificate.critical_optionsc                 C  rT  r   )rE  r   r"   r"   r#   
extensions~  rV  zSSHCertificate.extensionsc                 C  s&   t | j}|| j\}}t| |S r   )r   rF  r   rG  r`   )r   	sigformatsignature_keysigkey_restr"   r"   r#   r_    s   
zSSHCertificate.signature_keyc                 C  s"   t | jd tjt | jdd S )N    F)newline)r   rK  r  
b2a_base64rL  r   r"   r"   r#   r     s   zSSHCertificate.public_bytesr\   c                 C  s  |   }t|tjr|t| jt| j d S t|tj	rIt
| j\}}t
|\}}t| t||}t|j}||t| jt| d S t|tjsQJ | jtkr[t }n| jtkret }n| jtkslJ t }|t| jt| jt | d S r   )r_  r?   r   rK   verifyr   rI  rJ  r
   rC   r|   r`   
asym_utilsencode_dss_signature_get_ec_hash_algrQ   ECDSAr   rE   rH  rF   r   SHA1_SSH_RSA_SHA256SHA256_SSH_RSA_SHA512SHA512r   PKCS1v15)r   r_  rrU   scomputed_sighash_algr"   r"   r#   verify_cert_signature  s6   




z$SSHCertificate.verify_cert_signatureN)"r:  rg   r;  r<  r=  r   r>  r   r?  rg   r@  r   rA  r   rB  r   rC  rD  rE  rD  rF  rg   rG  rg   rH  rg   rI  rg   rJ  rg   rK  r   rL  rg   r   )r!   rQ  r   )r!   r6  )r!   r   )r!   rD  )r!   r\   )r2   r3   r4   r   propertyrO  rB   rU  rW  rX  rY  rZ  r[  r\  r]  r_  r   rs  r"   r"   r"   r#   r9  /  s0    
)


r9  rQ   r   hashes.HashAlgorithmc                 C  s@   t | tjr
t S t | tjrt S t | tjsJ t S r   )	r?   r
   	SECP256R1r   rk  	SECP384R1SHA384	SECP521R1rm  )rQ   r"   r"   r#   rg    s   rg  /typing.Union[SSHCertificate, SSHPublicKeyTypes]c           "      C  sp  t d|  t| }|std|d }}|d}d}|tr/d}|d tt  }|t	kr9|s9t
dt|}z	tt|}W n ttjfyT   tdw |rY|}	t|\}
}|
|krgtd	|rot|\}}||\}}|r2t|\}}t|\}}t|\}}t|\}}g }|rt|\}}|t| |st|\}}t|\}}t|\}}t|}t|\}}t|}t|\}}t|\}}t|\}}|t	kr|st
d
|	d t|  }t|\}}t| t|\}} |tkr|tttfvs|tkr||krtdt| \}!} t|  t||||||||||||||!|||	S t| |S )NrU   zInvalid line formatr'   r   FTz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)r   r   _SSH_PUBKEY_RCmatchrM   groupendswith_CERT_SUFFIXr]   rI   r   r   rg   r  r  	TypeErrorErrorry   r   rv   rr   r   r   _parse_exts_optsr`   rF   rj  rl  r9  )"rU   _legacy_dsa_allowedr  rN   orig_key_typekey_body	with_certr  rest	cert_bodyinner_key_typerO  rB   rU  cctyperX  
principalsrY  	principalr[  rZ  crit_optionsr\  extsr]  _sig_key_rawsig_typesig_keytbs_cert_bodysignature_rawinner_sig_typesig_rest	signaturer"   r"   r#   _load_ssh_public_identity  s   



r  c                 C  s   t | S r   )r  r_   r"   r"   r#   load_ssh_public_identity  s   r  	exts_optsrD  c                 C  s   i }d }| r_t | \}} t|}||v rtd|d ur$||k r$tdt | \}} t|dkrUzt |\}}W n tyJ   tjdtjdd Y nw t|dkrUtdt|||< |}| s|S )NzDuplicate namezFields not lexically sortedr   z{This certificate has an incorrect encoding for critical options or extensions. This will be an exception in cryptography 42rk   r   z!Unexpected extra data after value)ry   r   rM   r]   r  r  r   DeprecatedIn41)r  result	last_namerR   bnamevalueextrar"   r"   r#   r    s4   
	r  r<  c                 C  sF   t | dd}t|tr| }n|}t|tjr!tjdtj	dd |S )NT)r  r   r   r   )
r  r?   r9  rB   r	   rH   r  r  r   r  )rU   r   cert_or_keyrB   r"   r"   r#   load_ssh_public_key=  s   

r  c                 C  sl   t | tjrtjdtjdd t| }t|}t	 }|
| || | t|  }d|d|gS )z&One-line public key format for OpenSSHr%  rk   r   rX   ra  )r?   r	   rH   r  r  r   r  rO   r   r   r   r   r  rc  r   striprY   )rB   rN   r  r   pubr"   r"   r#   serialize_ssh_public_keyQ  s   
r     c                
   @  s   e Zd Zddddg dddg g f
d>ddZd?ddZd@ddZdAd!d"ZdBd%d&ZdCd(d)Zd*d+ Z	dDd.d/Z
dEd1d2ZdFd5d6ZdFd7d8ZdGd<d=ZdS )HSSHCertificateBuilderNFr;  &typing.Optional[SSHCertPublicKeyTypes]r=  r/   rM  #typing.Optional[SSHCertificateType]r?  rb   r@  r   _valid_for_all_principalsr    rB  rA  rC  'typing.List[typing.Tuple[bytes, bytes]]rE  c                 C  s@   || _ || _|| _|| _|| _|| _|| _|| _|	| _|
| _	d S r   
r;  r=  rM  r?  r@  r  rB  rA  rC  rE  )r   r;  r=  rM  r?  r@  r  rB  rA  rC  rE  r"   r"   r#   r   r  s   
zSSHCertificateBuilder.__init__rB   rQ  r!   c                 C  s^   t |tjtjtjfstd| jd urt	dt
|| j| j| j| j| j| j| j| j| jd
S )Nr>   zpublic_key already setr  )r?   r
   rC   r   rE   r   rK   r  r;  rM   r  r=  rM  r?  r@  r  rB  rA  rC  rE  )r   rB   r"   r"   r#   rB     s,   
z SSHCertificateBuilder.public_keyrU  r   c                 C  sv   t |ts	tdd|  krdk std td| jd ur$tdt| j|| j| j| j	| j
| j| j| j| jd
S )Nzserial must be an integerr               z"serial must be between 0 and 2**64zserial already setr  )r?   r   r  rM   r=  r  r;  rM  r?  r@  r  rB  rA  rC  rE  )r   rU  r"   r"   r#   rU    s(   

zSSHCertificateBuilder.serialrW  r6  c                 C  sR   t |ts	td| jd urtdt| j| j|| j| j	| j
| j| j| j| jd
S )Nz"type must be an SSHCertificateTypeztype already setr  )r?   r6  r  rM  rM   r  r;  r=  r?  r@  r  rB  rA  rC  rE  )r   rW  r"   r"   r#   rW    s    

zSSHCertificateBuilder.typerX  r   c                 C  sR   t |ts	td| jd urtdt| j| j| j|| j	| j
| j| j| j| jd
S )Nzkey_id must be byteszkey_id already setr  )r?   r   r  r?  rM   r  r;  r=  rM  r@  r  rB  rA  rC  rE  )r   rX  r"   r"   r#   rX    s    

zSSHCertificateBuilder.key_idrY  c                 C  s|   | j rtdtdd |D r|std| jrtdt|tkr'tdt| j| j	| j
| j|| j | j| j| j| jd
S )NzDPrincipals can't be set because the cert is valid for all principalsc                 s  s    | ]}t |tV  qd S r   )r?   r   ).0r   r"   r"   r#   	<genexpr>  s    z9SSHCertificateBuilder.valid_principals.<locals>.<genexpr>z5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsr  )r  rM   allr  r@  r]   _SSHKEY_CERT_MAX_PRINCIPALSr  r;  r=  rM  r?  rB  rA  rC  rE  )r   rY  r"   r"   r#   rY    s:   z&SSHCertificateBuilder.valid_principalsc                 C  sJ   | j rtd| jrtdt| j| j| j| j| j d| j| j	| j
| jd
S )Nz@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTr  )r@  rM   r  r  r;  r=  rM  r?  rB  rA  rC  rE  r   r"   r"   r#   valid_for_all_principals  s$   z.SSHCertificateBuilder.valid_for_all_principalsrZ  typing.Union[int, float]c                 C  sv   t |ttfstdt|}|dk s|dkrtd| jd ur$tdt| j| j| j	| j
| j| j|| j| j| jd
S )Nz$valid_before must be an int or floatr   r  zvalid_before must [0, 2**64)zvalid_before already setr  )r?   r   floatr  rM   rB  r  r;  r=  rM  r?  r@  r  rA  rC  rE  )r   rZ  r"   r"   r#   rZ    s&   
z"SSHCertificateBuilder.valid_beforer[  c                 C  sv   t |ttfstdt|}|dk s|dkrtd| jd ur$tdt| j| j| j	| j
| j| j| j|| j| jd
S )Nz#valid_after must be an int or floatr   r  zvalid_after must [0, 2**64)zvalid_after already setr  )r?   r   r  r  rM   rA  r  r;  r=  rM  r?  r@  r  rB  rC  rE  )r   r[  r"   r"   r#   r[  3  s&   
z!SSHCertificateBuilder.valid_afterrR   r  c                 C  sr   t |tr
t |tstd|dd | jD v rtdt| j| j| j| j	| j
| j| j| j| j||fg | jd
S )Nname and value must be bytesc                 S     g | ]\}}|qS r"   r"   r  rR   r  r"   r"   r#   
<listcomp>Q      z=SSHCertificateBuilder.add_critical_option.<locals>.<listcomp>zDuplicate critical option namer  )r?   r   r  rC  rM   r  r;  r=  rM  r?  r@  r  rB  rA  rE  r   rR   r  r"   r"   r#   add_critical_optionK  s    z)SSHCertificateBuilder.add_critical_optionc                 C  sr   t |tr
t |tstd|dd | jD v rtdt| j| j| j| j	| j
| j| j| j| j| j||fg d
S )Nr  c                 S  r  r"   r"   r  r"   r"   r#   r  g  r  z7SSHCertificateBuilder.add_extension.<locals>.<listcomp>zDuplicate extension namer  )r?   r   r  rE  rM   r  r;  r=  rM  r?  r@  r  rB  rA  rC  r  r"   r"   r#   add_extensiona  s    z#SSHCertificateBuilder.add_extensionr   SSHCertPrivateKeyTypesr9  c              	   C  s  t |tjtjtjfstd| jd u rt	d| j
d u rdn| j
}| jd u r+t	d| jd u r2dn| j}| js?| js?t	d| jd u rHt	d| jd u rQt	d| j| jkr[t	d	| jjd
d d | jjdd d t| j}|t }td}t|}t }|| || || j| || || jj || t }	| jD ]}
|	|
 q||	  || j || j t }| jD ]$\}}|| t |dkrt }|| ||  q|| q||  t }| jD ]%\}}|| t |dkrt }|| ||  q|| q||  |d t|}t|}t }|| ||! | ||  t |tjrq|"| }t }|| || ||  nlt |tjrt#|j$}|"| t%|}t&'|\}}t }|| t }|(| |(| ||  ||  n*t |tjsJ t }|t) |"| t*+ t,- }|| ||  t./| 0 }t12t3t4d5|d|gS )NzUnsupported private key typezpublic_key must be setr   ztype must be setrX   zAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforec                 S     | d S Nr   r"   r   r"   r"   r#   <lambda>      z,SSHCertificateBuilder.sign.<locals>.<lambda>)r<   c                 S  r  r  r"   r  r"   r"   r#   r    r  r6   ra  )6r?   r
   r@   r   rD   r   rJ   r  r;  rM   r=  rM  r?  r@  r  rB  rA  rC  sortrE  rO   r  r)  r*  r   r   r   r   r   r   r  r   r]   rB   signrg  rQ   rh  re  decode_dss_signaturer   rl  r   rn  r   rm  r  rc  r  rR  rS  r9  r  rY   )r   r   rU  rX  rN   cert_prefixrO  r  ffprincipalsr   fcritrR   r  foptvalfextfextvalca_typecaformatcafr  fsigrr  ro  rp  fsigblob	cert_datar"   r"   r#   r  w  s   
























zSSHCertificateBuilder.sign)r;  r  r=  r/   rM  r  r?  rb   r@  r   r  r    rB  r/   rA  r/   rC  r  rE  r  )rB   rQ  r!   r  )rU  r   r!   r  )rW  r6  r!   r  )rX  r   r!   r  )rY  r   r!   r  )rZ  r  r!   r  )r[  r  r!   r  )rR   r   r  r   r!   r  )r   r  r!   r9  )r2   r3   r4   r   rB   rU  rW  rX  rY  r  rZ  r[  r  r  r  r"   r"   r"   r#   r  q  s.    




$



r  )F)r   r   r   r   r   r   r   r   r   r    r!   r   )r<   r=   r!   r   )rB   rP   r!   r   )rU   r   rV   r   rW   r   r!   r   )rU   r   r-   r   r!   r\   )rU   r   r!   r\   )
ra   r   r   rb   r   r   r   r   r!   rc   )rU   rg   r!   rh   )rU   rg   r!   rw   )r{   r   r!   r   )rN   r   r   )rU   r   r   rb   r   r   r!   r   )r   r   r   r   r$  r   r!   r   )rQ   r   r!   ru  )rU   r   r!   rz  )r  rg   r!   rD  )rU   r   r   r   r!   r<  )rB   r<  r!   r   )z
__future__r   r  enumr)  rerR  r  base64r   rZ   dataclassesr   cryptographyr   cryptography.exceptionsr   cryptography.hazmat.primitivesr   )cryptography.hazmat.primitives.asymmetricr	   r
   r   r   r   re  &cryptography.hazmat.primitives.ciphersr   r   r   r   ,cryptography.hazmat.primitives.serializationr   r   r   r   r   r   bcryptr   r$   _bcrypt_supportedImportErrorrL   rF   rI   _ECDSA_NISTP256_ECDSA_NISTP384_ECDSA_NISTP521r  rj  rl  compiler{  r  	_SK_START_SK_ENDr  r  r&  r'  DOTALLr   rg   r   ranger  r)   AESCTRCBCGCMr8   r5   rS   rO   rA   r[   r^   r`   rf   rr   rv   ry   r|   r   r   r   r   r   r   rv  rw  ry  r   r   Unionr@   rD   rG   rJ   r   r#  r5  rC   rE   rH   rK   r<  rQ  Enumr6  r9  rg  r  r  r  r  r  r  r  r  r"   r"   r"   r#   <module>   s"   	
		 










8FHGD

	
gM 

_

	