o
    㕢h                     @  s  d dl mZ d dlZd dlZd dlZd dlZd dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZ d dlmZ d dlmZ d dlmZmZmZm Z  d dl!m"Z" d dl#m$Z$ d dl%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1 d dl2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z; d dl<m=Z=m>Z>m?Z?m@Z@mAZA eBdddgZCG dd dZDG dd dZEG dd dZFd!dd ZGeE ZHdS )"    )annotationsN)utilsx509)UnsupportedAlgorithm)aead)_CipherContext)openssl)binding)hashesserialization)AsymmetricPadding)ec)r   )MGF1OAEPPSSPKCS1v15)PrivateKeyTypes)CipherAlgorithm)AESAES128AES256ARC4SM4CamelliaChaCha20	TripleDES_BlowfishInternal_CAST5Internal_IDEAInternal_SEEDInternal)	CBCCFBCFB8CTRECBGCMOFBXTSMode)PBESPKCS12CertificatePKCS12KeyAndCertificatesPKCS12PrivateKeyTypes_PKCS12CATypes
_MemoryBIObiochar_ptrc                   @  s   e Zd ZdS )_RC2N)__name__
__module____qualname__ r5   r5   d/var/www/html/zoom/venv/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/backend.pyr1   G   s    r1   c                   @  s  e Zd ZU dZdZh dZded< efZe	j
e	je	je	je	je	je	je	je	je	je	je	jfZejejejejfZdZdZdd> ZdZ de > Z!dddZ"dddZ#	ddddZ$dddZ%dddZ&dddZ'dd d!Z(dd"d#Z)dd$d%Z*dd&d'Z+dd(d)Z,dd*d+Z-dd0d1Z.dd2d3Z/dd4d5Z0dd7d8Z1dd9d:Z2dd;d<Z3dd>d?Z4ddBdCZ5ddGdHZ6dIdJ Z7ddKdLZ8ddMdNZ9ddQdRZ:ddSdTZ;ddUdVZ<ddWdXZ=ddYdZZ>dd^d_Z?ddadbZ@ddedfZAddhdiZBddldmZCddpdqZDddsdtZEddudvZFddwdxZGddydzZHdd{d|ZIdd}d~ZJdddZKdddZLdddZMeNjOdd ZPdddZQdddZRdddZSdddZTdddZUdS )Backendz)
    OpenSSL API binding interfaces.
    r   >      aes-128-ccm   aes-128-gcm   aes-192-ccm   aes-192-gcm   aes-256-ccm   aes-256-gcmztyping.ClassVar[set[bytes]]
_fips_aeadi   i     returnNonec                 C  s:   t  | _| jj| _| jj| _t | _	i | _
|   d S N)r	   Binding_bindingffi_ffilib_librust_opensslis_fips_enabled_fips_enabled_cipher_registry_register_default_ciphersselfr5   r5   r6   __init__}   s   



zBackend.__init__strc                 C  s   d |  | jtjS )Nz3<OpenSSLBackend(version: {}, FIPS: {}, Legacy: {})>)formatopenssl_version_textrK   rI   _legacy_provider_loadedrN   r5   r5   r6   __repr__   s
   zBackend.__repr__Nokboolerrors&list[rust_openssl.OpenSSLError] | Nonec                 C  s   t j||dS )N)rX   )r	   _openssl_assert)rO   rV   rX   r5   r5   r6   openssl_assert   s   zBackend.openssl_assertc                 C  s$   | j   t sJ t | _d S rB   )rD   _enable_fipsrI   rJ   rK   rN   r5   r5   r6   r\      s   
zBackend._enable_fipsc                 C  s   | j | j| jjdS )z
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        ascii)rF   stringrH   OpenSSL_versionOPENSSL_VERSIONdecoderN   r5   r5   r6   rS      s
   zBackend.openssl_version_textintc                 C  s
   | j  S rB   )rH   OpenSSL_version_numrN   r5   r5   r6   openssl_version_number      
zBackend.openssl_version_number	algorithmhashes.HashAlgorithmc                 C  sB   |j dv r|j  |jd  d}n|j d}| j|}|S )N)blake2bblake2s   r]   )namedigest_sizeencoderH   EVP_get_digestbyname)rO   rf   algevp_mdr5   r5   r6   _evp_md_from_algorithm   s   
zBackend._evp_md_from_algorithmc                 C  s    |  |}| || jjk |S rB   )rq   r[   rF   NULLrO   rf   rp   r5   r5   r6   _evp_md_non_null_from_algorithm   s   
z'Backend._evp_md_non_null_from_algorithmc                 C  s,   | j rt|| jsdS | |}|| jjkS NF)rK   
isinstance_fips_hashesrq   rF   rr   rs   r5   r5   r6   hash_supported   s   
zBackend.hash_supportedc                 C      | j rt|tjrdS | |S ru   rK   rv   r
   SHA1rx   rO   rf   r5   r5   r6   signature_hash_supported   s   
z Backend.signature_hash_supportedc                 C  s   | j rdS | jjdkS )NFr?   )rK   rH   Cryptography_HAS_SCRYPTrN   r5   r5   r6   scrypt_supported   s   zBackend.scrypt_supportedc                 C  ry   )NTrz   r|   r5   r5   r6   hmac_supported   s   
zBackend.hmac_supportedcipherr   moder(   c                 C  s^   | j rt|| jsdS z| jt|t|f }W n
 ty"   Y dS w || ||}| jj|kS ru   )rK   rv   _fips_ciphersrL   typeKeyErrorrF   rr   )rO   r   r   adapter
evp_cipherr5   r5   r6   cipher_supported   s   zBackend.cipher_supportedc                 C  s6   ||f| j v rtd| d| d|| j ||f< d S )NzDuplicate registration for:  .)rL   
ValueError)rO   
cipher_clsmode_clsr   r5   r5   r6   register_cipher_adapter   s
   zBackend.register_cipher_adapterc                 C  s  t ttfD ]}ttttttt	fD ]}| 
||td qqtttttfD ]}| 
t|td q$ttttfD ]}| 
t|td q6| 
tttd | 
ttd t| jjrXdnd | 
t tt tttttt	fD ]}| 
t|td qktjs~| jjsttttfD ]}| 
t|td qttttfD ]}| 
t|td qtttgttttgD ]\}}| 
||td	 q| 
ttd td
 | 
ttd td d S d S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3chachachacha20zsm4-{mode.name}zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}rc4rc2) r   r   r   r    r#   r$   r&   r!   r"   r%   r   GetCipherByNamer   r   r   r   rH   CRYPTOGRAPHY_IS_LIBRESSLr'   _get_xts_cipherr   rI   rT   #CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr   r   	itertoolsproductr   r   r   r1   )rO   r   r   r5   r5   r6   rM      s   



z!Backend._register_default_ciphersr   c                 C     t | ||t jS rB   )r   _ENCRYPTrO   r   r   r5   r5   r6   create_symmetric_encryption_ctx8     z'Backend.create_symmetric_encryption_ctxc                 C  r   rB   )r   _DECRYPTr   r5   r5   r6   create_symmetric_decryption_ctx=  r   z'Backend.create_symmetric_decryption_ctxc                 C  s
   |  |S rB   )r   r|   r5   r5   r6   pbkdf2_hmac_supportedB  re   zBackend.pbkdf2_hmac_supportedlist[rust_openssl.OpenSSLError]c                 C  s   t  S rB   )rI   capture_error_stackrN   r5   r5   r6   _consume_errorsE  s   zBackend._consume_errorspublic_exponentkey_sizec                 C  s   |dko|d@ dko|dkS )N   r?   r   i   r5   )rO   r   r   r5   r5   r6   !generate_rsa_parameters_supportedH  s
   
z)Backend.generate_rsa_parameters_supporteddatabytesr.   c                 C  sH   | j |}| j|t|}| || j jk t| j || jj	|S )z
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
rF   from_bufferrH   BIO_new_mem_buflenr[   rr   r.   gcBIO_free)rO   r   data_ptrr/   r5   r5   r6   _bytes_to_bioQ  s   zBackend._bytes_to_bioc                 C  sP   | j  }| || jjk | j |}| || jjk | j|| j j}|S )z.
        Creates an empty memory BIO.
        )rH   	BIO_s_memr[   rF   rr   BIO_newr   r   )rO   
bio_methodr/   r5   r5   r6   _create_mem_bio_gc^  s   
zBackend._create_mem_bio_gcc                 C  s\   | j d}| j||}| |dk | |d | j jk | j |d |dd }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)rF   newrH   BIO_get_mem_datar[   rr   buffer)rO   r/   bufbuf_lenbio_datar5   r5   r6   _read_mem_bioi  s   zBackend._read_mem_bioc                 C  s4   | j rt|tjrdS t|tjtjtjtjtjfS ru   )rK   rv   r
   r{   SHA224SHA256SHA384SHA512r|   r5   r5   r6   _oaep_hash_supportedt  s   zBackend._oaep_hash_supportedpaddingr   c                 C  s   t |trdS t |tr&t |jtr&| jrt |jjtjrdS | 	|jjS t |t
r>t |jtr>| |jjo=| |jS dS )NTF)rv   r   r   _mgfr   rK   
_algorithmr
   r{   rx   r   r   rO   r   r5   r5   r6   rsa_padding_supported  s   


zBackend.rsa_padding_supportedc                 C  s   | j r
t|tr
dS | |S ru   )rK   rv   r   r   r   r5   r5   r6   rsa_encryption_supported  s   
z Backend.rsa_encryption_supportedc                 C  s   | j j o| j S rB   )rH   CRYPTOGRAPHY_IS_BORINGSSLrK   rN   r5   r5   r6   dsa_supported  s   zBackend.dsa_supportedc                 C  s   |   sdS | |S ru   )r   r}   r|   r5   r5   r6   dsa_hash_supported  s   
zBackend.dsa_hash_supportedc                 C  s   |  |td|j S )N    )r   r    
block_sizer|   r5   r5   r6   cmac_algorithm_supported  s   z Backend.cmac_algorithm_supportedcertx509.Certificate
typing.Anyc                 C  sT   | tjj}| |}| j|j| jj	}| 
|| jj	k | j|| jj}|S rB   )public_bytesr   EncodingDERr   rH   d2i_X509_bior/   rF   rr   r[   r   	X509_free)rO   r   r   mem_bior   r5   r5   r6   
_cert2ossl  s   
zBackend._cert2osslx509_ptrc                 C  s4   |   }| j||}| |dk t| |S Nr?   )r   rH   i2d_X509_bior[   r   load_der_x509_certificater   )rO   r   r/   resr5   r5   r6   
_ossl2cert  s   zBackend._ossl2certkeyr,   c                 C  s\   | tjjtjjt }| |}| j	|j
| jj}| || jjk | j|| jjS rB   )private_bytesr   r   r   PrivateFormatPKCS8NoEncryptionr   rH   d2i_PrivateKey_bior/   rF   rr   r[   r   EVP_PKEY_free)rO   r   r   r   evp_pkeyr5   r5   r6   	_key2ossl  s   
zBackend._key2ossltyping.NoReturnc                   s   |st d|d  jj jjs.|d  jj jjs. jjr2|d  jj jj	r2t dt
 fdd|D rAt dt d|)Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c                 3  s$    | ]}|  jj jjV  qd S rB   )_lib_reason_matchrH   ERR_LIB_EVP'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM).0errorrN   r5   r6   	<genexpr>  s    
z4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.zCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r   r   rH   r   EVP_R_BAD_DECRYPTERR_LIB_PKCS12!PKCS12_R_PKCS12_CIPHERFINAL_ERRORCryptography_HAS_PROVIDERSERR_LIB_PROVPROV_R_BAD_DECRYPTany)rO   rX   r5   rN   r6   _handle_key_loading_error  s:   	
z!Backend._handle_key_loading_errorcurveec.EllipticCurvec                 C  s"   | j rt|| jsdS tj|S ru   )rK   rv   _fips_ecdh_curvesrI   r   curve_supported)rO   r   r5   r5   r6   elliptic_curve_supported  s
   z Backend.elliptic_curve_supportedsignature_algorithm"ec.EllipticCurveSignatureAlgorithmc                 C  s4   t |tjsdS | |ot |jtjp| |jS ru   )rv   r   ECDSAr   rf   
asym_utils	Prehashedrx   )rO   r   r   r5   r5   r6   ,elliptic_curve_signature_algorithm_supported  s   

z4Backend.elliptic_curve_signature_algorithm_supportedec.ECDHc                 C  s   |  |o
t|tjS rB   )r   rv   r   ECDH)rO   rf   r   r5   r5   r6   +elliptic_curve_exchange_algorithm_supported  s   z3Backend.elliptic_curve_exchange_algorithm_supportedc                 C  
   | j j S rB   rH   r   rN   r5   r5   r6   dh_supported  re   zBackend.dh_supportedc                 C  s   | j jdkS r   )rH   Cryptography_HAS_EVP_PKEY_DHXrN   r5   r5   r6   dh_x942_serialization_supported     z'Backend.dh_x942_serialization_supportedc                 C     | j rdS dS NFTrK   rN   r5   r5   r6   x25519_supported     zBackend.x25519_supportedc                 C     | j rdS | jj o| jj S ru   rK   rH   r   r   rN   r5   r5   r6   x448_supported  
   
zBackend.x448_supportedc                 C  r	  r
  r  rN   r5   r5   r6   ed25519_supported&  r  zBackend.ed25519_supportedc                 C  r  ru   r  rN   r5   r5   r6   ed448_supported+  r  zBackend.ed448_supportedc                 C  s   t | |S rB   )r   _aead_cipher_supported)rO   r   r5   r5   r6   aead_cipher_supported3  r  zBackend.aead_cipher_supportedlengthc                 C  s   t |D ]}d||< qd S )Nr   )range)rO   r   r  ir5   r5   r6   
_zero_data6  s   
zBackend._zero_datac                 c  s~    |du r| j jV  dS t|}| j d|d }| j ||| z|V  W | | j d|| dS | | j d|| w )a  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nzchar[]r?   z	uint8_t *)rF   rr   r   r   memmover  cast)rO   r   data_lenr   r5   r5   r6   _zeroed_null_terminated_buf=  s   2z#Backend._zeroed_null_terminated_bufpasswordbytes | NoneNtuple[PrivateKeyTypes | None, x509.Certificate | None, list[x509.Certificate]]c                 C  s2   |  ||}|j|jr|jjnd dd |jD fS )Nc                 S  s   g | ]}|j qS r5   )certificate)r   r   r5   r5   r6   
<listcomp>_  s    zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)load_pkcs12r   r   r!  additional_certs)rO   r   r  pkcs12r5   r5   r6   %load_key_and_certificates_from_pkcs12T  s
   z-Backend.load_key_and_certificates_from_pkcs12r+   c                 C  s  |d ur
t d| | |}| j|j| jj}|| jjkr'|   t	d| j
|| jj}| jd}| jd}| jd}| |}| j|||||}	W d    n1 s\w   Y  |	dkrm|   t	dd }
d }g }|d | jjkr| j
|d | jj}tjjt| jd|d	d
}|d | jjkr| j
|d | jj}| |}d }| j|| jj}|| jjkr| j|}t||}
|d | jjkr;| j
|d | jj}| j|d }| jjs| jjrt|}ntt|}|D ]@}| j ||}| !|| jjk | j
|| jj}| |}d }| j|| jj}|| jjkr2| j|}|"t|| qt#||
|S )Nr  z!Could not deserialize PKCS12 datazEVP_PKEY **zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 data	uintptr_tF)unsafe_skip_rsa_key_validation)$r   _check_bytesliker   rH   d2i_PKCS12_bior/   rF   rr   r   r   r   PKCS12_freer   r  PKCS12_parser   rI   keysprivate_key_from_ptrrb   r  r   r   X509_alias_get0r^   r*   sk_X509_freesk_X509_numr   r   r  reversedsk_X509_valuer[   appendr+   )rO   r   r  r/   p12evp_pkey_ptrr   sk_x509_ptrpassword_bufr   r   r   additional_certificatesr   r   cert_objrk   
maybe_namesk_x509numindicesr  	addl_cert	addl_namer5   r5   r6   r#  b  st   





zBackend.load_pkcs12rk   PKCS12PrivateKeyTypes | Nonex509.Certificate | Nonecaslist[_PKCS12CATypes] | Noneencryption_algorithm(serialization.KeySerializationEncryptionc                 C  s  d }|d urt d| t|tjrd}d}d}	d}
| jj}nt|tjrF| jj	r2| jj
}| jj
}n| jj}| jj}d}	d}
| jj}|j}nst|tjr|jtjju rd}d}d}	d}
|j}|j}|tju ro| jj}| jj}n|tju r| jj	s|td| jj
}| jj
}n|d u sJ |jd ur| jjstd| |j}| || jjk n| jj}|jd ur|j}	ntd|d u st|dkr| jj}n]| j }| j|| jj}g }|D ]J}t|t r|j!}| "|j#}|d u r| j$|| jjd}n
| j$||t|}| |dk n| "|}|%| | j&||}t'|dk q| (|q}| (|A}|r9| "|n| jj}|d urG| )|n| jj}| j*||||||||	|
d
}|| jjkrj| + }td	|W d    n	1 suw   Y  | jjr|| jjkr| j,||d| jjd|
| W d    n	1 sw   Y  | || jjk | j|| jj-}| . }| j/||}| |dk | 0|S )
Nrk   r   i N  r?   z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption typez=Failed to create PKCS12 (does the key match the certificate?))1r   _check_bytesrv   r   r   rF   rr   BestAvailableEncryptionrH   r   NID_aes_256_cbc&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr  _KeySerializationEncryption_formatr   PKCS12_key_cert_algorithmr)   PBESv1SHA1And3KeyTripleDESCBCPBESv2SHA256AndAES256CBCr   
_hmac_hashCryptography_HAS_PKCS12_SET_MACrt   r[   _kdf_roundsr   r   sk_X509_new_nullr   r0  r*   friendly_namer   r!  X509_alias_set1r4  sk_X509_pushbackendr  r   PKCS12_creater   PKCS12_set_macr+  r   i2d_PKCS12_bior   )rO   rk   r   r   rC  rE  r  nid_certnid_keypkcs12_itermac_itermac_alg
keycertalgr<  ossl_cascaca_aliasossl_car   r8  name_buf	ossl_cert	ossl_pkeyr5  rX   r/   r5   r5   r6   (serialize_key_and_certificates_to_pkcs12  s   













+
z0Backend.serialize_key_and_certificates_to_pkcs12c                 C  s*   | j rdS | jjs| jjrdS | jjdkS )NFTr?   )rK   rH   r   r   Cryptography_HAS_POLY1305rN   r5   r5   r6   poly1305_supportedU  s   zBackend.poly1305_supportedc                 C  r  rB   r  rN   r5   r5   r6   pkcs7_supported`  re   zBackend.pkcs7_supported)r@   rA   )r@   rQ   rB   )rV   rW   rX   rY   r@   rA   )r@   rb   )rf   rg   )rf   rg   r@   rW   )r@   rW   )r   r   r   r(   r@   rW   )r   r   r   r(   r@   r   )r@   r   )r   rb   r   rb   r@   rW   )r   r   r@   r.   )r@   r   )r   r   r@   rW   )r   r   r@   r   )r   r   r@   r   )r   r,   r@   r   )rX   r   r@   r   )r   r   r@   rW   )r   r   r   r   r@   rW   )rf   r   r   r   r@   rW   )r  rb   r@   rA   )r   r   r  r  r@   r   )r   r   r  r  r@   r+   )rk   r  r   rA  r   rB  rC  rD  rE  rF  r@   r   )Vr2   r3   r4   __doc__rk   r>   __annotations__r   r   r
   r   r   r   r   
SHA512_224
SHA512_256SHA3_224SHA3_256SHA3_384SHA3_512SHAKE128SHAKE256rw   r   	SECP224R1	SECP256R1	SECP384R1	SECP521R1r   _fips_rsa_min_key_size_fips_rsa_min_public_exponent_fips_dsa_min_modulus_fips_dh_min_key_size_fips_dh_min_modulusrP   rU   r[   r\   rS   rd   rq   rt   rx   r}   r   r   r   r   rM   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r  r  
contextlibcontextmanagerr  r&  r#  rj  rl  rm  r5   r5   r5   r6   r7   K   s   
 











	




J




	











.













L 
(r7   c                   @  s    e Zd ZdddZdddZdS )r   fmtrQ   c                 C  s
   || _ d S rB   )_fmt)rO   r  r5   r5   r6   rP   e  re   zGetCipherByName.__init__rY  r7   r   r   r   r(   c                 C  sd   | j j||d }|j|d}||jjkr,|jjr,|j	|jj|d|jj}|
  |S )N)r   r   r]   )r  rR   lowerrH   EVP_get_cipherbynamerm   rF   rr   Cryptography_HAS_300_EVP_CIPHEREVP_CIPHER_fetchr   )rO   rY  r   r   cipher_namer   r5   r5   r6   __call__h  s   zGetCipherByName.__call__N)r  rQ   )rY  r7   r   r   r   r(   )r2   r3   r4   rP   r  r5   r5   r5   r6   r   d  s    
r   rY  r   r   c                 C  s$   d|j d  d}| j|dS )Nzaes-   z-xtsr]   )r   rH   r  rm   )rY  r   r   r  r5   r5   r6   r   }  s   r   )rY  r7   r   r   )I
__future__r   collectionsr  r   typingcryptographyr   r   cryptography.exceptionsr   $cryptography.hazmat.backends.opensslr   ,cryptography.hazmat.backends.openssl.ciphersr   "cryptography.hazmat.bindings._rustr   rI   $cryptography.hazmat.bindings.opensslr	   cryptography.hazmat.primitivesr
   r   *cryptography.hazmat.primitives._asymmetricr   )cryptography.hazmat.primitives.asymmetricr   r   1cryptography.hazmat.primitives.asymmetric.paddingr   r   r   r   /cryptography.hazmat.primitives.asymmetric.typesr   &cryptography.hazmat.primitives.ciphersr   1cryptography.hazmat.primitives.ciphers.algorithmsr   r   r   r   r   r   r   r   r   r   r   r   ,cryptography.hazmat.primitives.ciphers.modesr    r!   r"   r#   r$   r%   r&   r'   r(   3cryptography.hazmat.primitives.serialization.pkcs12r)   r*   r+   r,   r-   
namedtupler.   r1   r7   r   r   rY  r5   r5   r5   r6   <module>   sB   8,      

