
     h6                        U d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZmZmZmZ d dlm
Z d dlmZmZmZ d dlmZmZmZmZmZm Z  	 d d	l!m"Z# d
Z$n# e%$ r dZ$	 dcde&de&de'de'de(de&fdZ#Y nw xY wdZ)dZ*dZ+dZ,dZ-dZ.dZ/dZ0dZ1 ej2        d          Z3dZ4dZ5dZ6d Z7d!Z8d"Z9d#Z: ej2        e5d$z   e6z   ej;                  Z< e= e> e?d%d&                              Z@ejA        d'ejB        d#fejA        d'ejC        d#fd(ZDejE        e&ejF        ejG        ejA                 e'ejH        ejG        ejB                 ejG        ejC                 f         e'f         f         eId)<   e,e-e.d*ZJd+ejH        d,         de&fd-ZKd.ejL        de&fd/ZMe5d0z   e6d0z   fd1e&d2e&d3e&de&fd4ZNd1e&d5e'ddfd6ZOd1e&ddfd7ZPd8e&dejQ        e&         de&de'deejH        ejC        ejB        f                  f
d9ZRd1e=dejF        e'e=f         fd:ZSd1e=dejF        e'e=f         fd;ZTd1e=dejF        e=e=f         fd<ZUd1e=dejF        e'e=f         fd=ZVd>e'de&fd?ZW G d@ dA          ZX G dB dC          ZY G dD dE          ZZ G dF dG          Z[ G dH dI          Z\e* eY            e+ eZ            e) e\            e, e[dJ ej]                              e- e[dK ej^                              e. e[dL ej_                              iZ`dMe&fdNZaejH        ejb        ejc        ejd        eje        f         Zf	 ddd1e&dejQ        e&         dOejg        deffdPZhdQefde&dRede&fdSZiejH        ejL        ejj        ejk        ejl        f         ZmejH        ejL        ejj        ejl        f         Zn G dT dUejo                  Zp G dV dW          ZqdXejr        dejs        fdYZt	 dcd1e&dejH        eqemf         fdZZud1e&dejH        eqemf         fd[Zvd\e=dejE        e&e&f         fd]Zw	 ddd1e&dOejg        demfd^Zxd.emde&fd_ZyejH        ejb        ejc        eje        f         Zzd`Z{ G da db          Z|dS )e    N)encodebytes)utilsUnsupportedAlgorithm)hashes)dsaeced25519paddingrsa)Cipher
algorithmsmodes)EncodingKeySerializationEncryptionNoEncryptionPrivateFormatPublicFormat_KeySerializationEncryption)kdfTFpasswordsaltdesired_key_bytesroundsignore_few_roundsreturnc                      t          d          )NzNeed bcrypt moduler   )r   r   r   r   r   s        l/var/www/html/Sam_Eipo/venv/lib/python3.11/site-packages/cryptography/hazmat/primitives/serialization/ssh.py_bcrypt_kdfr   *   s     ##7888    s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   rsa-sha2-256s   rsa-sha2-512s   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   none
   aes256-ctr   s   (.*?)          )r!   s
   aes256-cbc_SSH_CIPHERS)	secp256r1	secp384r1	secp521r1key)SSHPrivateKeyTypesSSHPublicKeyTypesc                    t          | t          j                  r"t          |                                           }nt          | t          j                  rt          |           }nt          | t          j        t          j        f          rt          }nkt          | t          j        t          j        f          rt          }n=t          | t          j        t          j        f          rt"          }nt%          d          |S )NUnsupported key type)
isinstancer	   EllipticCurvePrivateKey_ecdsa_key_type
public_keyEllipticCurvePublicKeyr   RSAPrivateKeyRSAPublicKey_SSH_RSAr   DSAPrivateKeyDSAPublicKey_SSH_DSAr
   Ed25519PrivateKeyEd25519PublicKey_SSH_ED25519
ValueError)r*   key_types     r   _get_ssh_key_typer?   f   s     #r122 1"3>>#3#344	C2	3	3 1"3''	C#+S-=>	?	? 	1	C#+S-=>	?	? 1	g')AB
 
 1  /000Or    r2   c                 ~    | j         }|j        t          vrt          d|j                  t          |j                 S )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPEr=   )r2   rA   s     r   r1   r1   {   sE    Ez((DejDD
 
 	
 5:&&r       
dataprefixsuffixc                 L    d                     |t          |           |g          S )Nr    )join_base64_encode)rE   rF   rG   s      r   _ssh_pem_encoderK      s%    
 88V^D116:;;;r    	block_lenc                 T    | rt          |           |z  dk    rt          d          dS )zRequire data to be full blocksr   zCorrupt data: missing paddingN)lenr=   )rE   rL   s     r   _check_block_sizerO      s6     :3t99y(A--8999 .-r    c                 (    | rt          d          dS )z!All data should have been parsed.zCorrupt data: unparsed dataN)r=   rE   s    r   _check_emptyrR      s#     867778 8r    
ciphernamec                     |st          d          t          |          \  }}}}t          ||||z   |d          }t           ||d|                    |||d                             S )z$Generate key + iv and return cipher.zKey is password-protected.TN)r=   r&   r   r   )	rS   r   r   r   algokey_lenmodeiv_lenseeds	            r   _init_cipherrZ      s|      75666".z":D'4xw'7FFD$$tHWH~&&T'((^(<(<===r    c                     t          |           dk     rt          d          t                              | dd         d          | dd         fS )Uint32   Invalid dataNbig	byteorderrN   r=   int
from_bytesrQ   s    r   _get_u32re      J    
4yy1}}(((>>$rr(e>44d122h>>r    c                     t          |           dk     rt          d          t                              | dd         d          | dd         fS )Uint64   r^   Nr_   r`   rb   rQ   s    r   _get_u64rj      rf   r    c                     t          |           \  }} |t          |           k    rt          d          | d|         | |d         fS )zBytes with u32 length prefixr^   N)re   rN   r=   )rE   ns     r   _get_sshstrrm      sI    tnnGAt3t99}}(((8T!""Xr    c                     t          |           \  }} |r|d         dk    rt          d          t                              |d          | fS )zBig integer.r      r^   r_   )rm   r=   rc   rd   )rE   vals     r   
_get_mpintrq      sN    D!!IC
 )s1v}}(((>>#u%%t++r    rp   c                     | dk     rt          d          | sdS |                                 dz   dz  }t          j        | |          S )z!Storage format for signed bigint.r   znegative mpint not allowedr    ri   )r=   
bit_lengthr   int_to_bytes)rp   nbytess     r   	_to_mpintrv      sS    
Qww5666 snn"q(Fc6***r    c                      e Zd ZU dZej        e         ed<   	 ddej        ej        e                  ddfdZ	deddfdZ
deddfd	Zdeddfd
Zdej        ed f         ddfdZdeddfdZdefdZddededefdZdefdZdS )	_FragListz,Build recursive structure without data copy.flistNinitr   c                 P    g | _         |r| j                             |           d S d S N)ry   extend)selfrz   s     r   __init__z_FragList.__init__   s9     
 	$Jd#####	$ 	$r    rp   c                 :    | j                             |           dS )zAdd plain bytesN)ry   appendr~   rp   s     r   put_rawz_FragList.put_raw   s    
#r    c                 d    | j                             |                    dd                     dS )zBig-endian uint32r]   r_   lengthra   Nry   r   to_bytesr   s     r   put_u32z_FragList.put_u32   .    
#,,a5,AABBBBBr    c                 d    | j                             |                    dd                     dS )zBig-endian uint64ri   r_   r   Nr   r   s     r   put_u64z_FragList.put_u64   r   r    c                 R   t          |t          t          t          f          r>|                     t          |                     | j                            |           dS |                     |                                           | j        	                    |j                   dS )zBytes prefixed with u32 lengthN)
r/   bytes
memoryview	bytearrayr   rN   ry   r   sizer}   r   s     r   
put_sshstrz_FragList.put_sshstr   s    cE:y9:: 	)LLS"""Jc"""""LL$$$Jci(((((r    c                 J    |                      t          |                     dS )z*Big-endian bigint prefixed with u32 lengthN)r   rv   r   s     r   	put_mpintz_FragList.put_mpint   s     	#'''''r    c                 P    t          t          t          | j                            S )zCurrent number of bytes)summaprN   ry   r~   s    r   r   z_FragList.size   s    3sDJ''(((r    r   dstbufposc                 T    | j         D ]}t          |          }|||z   }}||||<    |S )zWrite into bytearray)ry   rN   )r~   r   r   fragflenstarts         r   renderz_FragList.render   sA    J 	% 	%Dt99DcDj3E $F59
r    c                     t          t          |                                                     }|                     |           |                                S )zReturn as bytes)r   r   r   r   tobytes)r~   bufs     r   r   z_FragList.tobytes  s?    499;;//00C{{}}r    r|   )r   )__name__
__module____qualname____doc__typingListr   __annotations__Optionalr   r   rc   r   r   Unionr   r   r   r   r   r    r    r   rx   rx      s        66;u ;?$ $OFK$67$	$ $ $ $5 T    C3 C4 C C C CC3 C4 C C C C)fl5++=> )4 ) ) ) )(S (T ( ( ( ()c ) ) ) ) Z c #          r    rx   c                       e Zd ZdZdefdZdedej        ej	        ef         fdZ
dedej        ej        ef         fdZdej	        dedd	fd
Zdej        dedd	fdZd	S )_SSHFormatRSAzhFormat for RSA keys.

    Public:
        mpint e, n
    Private:
        mpint n, e, d, iqmp, p, q
    rE   c                 V    t          |          \  }}t          |          \  }}||f|fS )zRSA public fieldsrq   )r~   rE   erl   s       r   
get_publicz_SSHFormatRSA.get_public  s2    T""4T""41vt|r    r   c                     |                      |          \  \  }}}t          j        ||          }|                                }||fS )zMake RSA public key from data.)r   r   RSAPublicNumbersr2   )r~   rE   r   rl   public_numbersr2   s         r   load_publicz_SSHFormatRSA.load_public  sK     t,,A-a33#..00
4r    c           	         t          |          \  }}t          |          \  }}t          |          \  }}t          |          \  }}t          |          \  }}t          |          \  }}||f|k    rt          d          t          j        ||          }	t          j        ||          }
t          j        ||          }t          j        ||||	|
||          }|                                }||fS )zMake RSA private key from data.z Corrupt data: rsa field mismatch)rq   r=   r   rsa_crt_dmp1rsa_crt_dmq1r   RSAPrivateNumbersprivate_key)r~   rE   	pubfieldsrl   r   diqmppqdmp1dmq1r   private_numbersr   s                 r   load_privatez_SSHFormatRSA.load_private   s     T""4T""4T""4%%
dT""4T""4q6Y?@@@1%%1%%-a33/q!T4~
 
 &1133D  r    r2   f_pubNc                     |                                 }|                    |j                   |                    |j                   dS )zWrite RSA public keyN)r   r   r   rl   )r~   r2   r   pubns       r   encode_publicz_SSHFormatRSA.encode_public6  sC     ((**r    r   f_privc                 t   |                                 }|j        }|                    |j                   |                    |j                   |                    |j                   |                    |j                   |                    |j                   |                    |j                   dS )zWrite RSA private keyN)	r   r   r   rl   r   r   r   r   r   )r~   r   r   r   r   s        r   encode_privatez_SSHFormatRSA.encode_private>  s     &5577(7)***)****+++-...*+++*+++++r    )r   r   r   r   r   r   r   Tupler   r5   r   r4   r   rx   r   r   r   r    r   r   r     s         z      	c&
2	3       !!	c'3	4! ! ! !, * 3< 	       ,,,6?,	, , , , , ,r    r   c                      e Zd ZdZdedej        ej        ef         fdZdedej        ej	        ef         fdZ
dedej        ej        ef         fdZdej	        dedd	fd
Zdej        dedd	fdZdej        dd	fdZd	S )_SSHFormatDSAzhFormat for DSA keys.

    Public:
        mpint p, q, g, y
    Private:
        mpint p, q, g, y, x
    rE   r   c                     t          |          \  }}t          |          \  }}t          |          \  }}t          |          \  }}||||f|fS )zDSA public fieldsr   )r~   rE   r   r   gys         r   r   z_SSHFormatDSA.get_publicW  s[     T""4T""4T""4T""41a|T!!r    c                     |                      |          \  \  }}}}}t          j        |||          }t          j        ||          }|                     |           |                                }||fS )zMake DSA public key from data.)r   r   DSAParameterNumbersDSAPublicNumbers	_validater2   )	r~   rE   r   r   r   r   parameter_numbersr   r2   s	            r   r   z_SSHFormatDSA.load_publica  sx     "__T22Aq!d3Aq!<<-a1BCC~&&&#..00
4r    c                 l   |                      |          \  \  }}}}}t          |          \  }}||||f|k    rt          d          t          j        |||          }t          j        ||          }	|                     |	           t          j        ||	          }
|
                                }||fS )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r   rq   r=   r   r   r   r   DSAPrivateNumbersr   )r~   rE   r   r   r   r   r   xr   r   r   r   s               r   r   z_SSHFormatDSA.load_privatel  s     "__T22Aq!dT""4q!Q<9$$?@@@3Aq!<<-a1BCC~&&&/>BB%1133D  r    r2   r   Nc                 6   |                                 }|j        }|                     |           |                    |j                   |                    |j                   |                    |j                   |                    |j                   dS )zWrite DSA public keyN)r   r   r   r   r   r   r   r   )r~   r2   r   r   r   s        r   r   z_SSHFormatDSA.encode_public|  s     $2244*<~&&&)+,,,)+,,,)+,,,()))))r    r   r   c                     |                      |                                |           |                    |                                j                   dS )zWrite DSA private keyN)r   r2   r   r   r   )r~   r   r   s      r   r   z_SSHFormatDSA.encode_private  sO     	;1133V<<<4466899999r    r   c                 l    |j         }|j                                        dk    rt          d          d S )Ni   z#SSH supports only 1024 bit DSA keys)r   r   rs   r=   )r~   r   r   s      r   r   z_SSHFormatDSA._validate  s<    *<))++t33BCCC 43r    )r   r   r   r   r   r   r   r   r   r8   r   r7   r   rx   r   r   r   r   r   r    r   r   r   N  sA        ""	flJ.	/" " " "	 	 	c&
2	3	  	  	  	 !!	c'3	4! ! ! ! ***3<*	* * * *:,:6?:	: : : :D(< D D D D D D Dr    r   c                      e Zd ZdZdedej        fdZdede	j
        e	j
        ef         fdZdede	j
        ej        ef         fdZdede	j
        ej        ef         fd	Zd
ej        deddfdZdej        deddfdZdS )_SSHFormatECDSAzFormat for ECDSA keys.

    Public:
        str curve
        bytes point
    Private:
        str curve
        bytes point
        mpint secret
    ssh_curve_namerA   c                 "    || _         || _        d S r|   )r   rA   )r~   r   rA   s      r   r   z_SSHFormatECDSA.__init__  s    ,


r    rE   r   c                     t          |          \  }}t          |          \  }}|| j        k    rt          d          |d         dk    rt          d          ||f|fS )zECDSA public fieldszCurve name mismatchr   r]   zNeed uncompressed point)rm   r   r=   NotImplementedError)r~   rE   rA   points       r   r   z_SSHFormatECDSA.get_public  sn     "$''t!$''tD'''23338q==%&?@@@u~t##r    c                     |                      |          \  \  }}}t          j                            | j        |                                          }||fS )z Make ECDSA public key from data.)r   r	   r3   from_encoded_pointrA   r   )r~   rE   
curve_namer   r2   s        r   r   z_SSHFormatECDSA.load_public  sS     %)OOD$9$9!UT.AAJ
 

 4r    c                     |                      |          \  \  }}}t          |          \  }}||f|k    rt          d          t          j        || j                  }||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r   rq   r=   r	   derive_private_keyrA   )r~   rE   r   r   r   secretr   s          r   r   z_SSHFormatECDSA.load_private  sn     %)OOD$9$9!UT!$'')++ABBB+FDJ??D  r    r2   r   Nc                     |                     t          j        t          j                  }|                    | j                   |                    |           dS )zWrite ECDSA public keyN)public_bytesr   X962r   UncompressedPointr   r   )r~   r2   r   r   s       r   r   z_SSHFormatECDSA.encode_public  sV     ''M<9
 
 	,---r    r   r   c                     |                                 }|                                }|                     ||           |                    |j                   dS )zWrite ECDSA private keyN)r2   r   r   r   private_value)r~   r   r   r2   r   s        r   r   z_SSHFormatECDSA.encode_private  sY     !++--
%5577:v...677777r    )r   r   r   r   r   r	   EllipticCurver   r   r   r   r   r3   r   r0   r   rx   r   r   r   r    r   r   r     s9       	 	u R5E    
$
$	flJ.	/
$ 
$ 
$ 
$  	b/;	<       
!
!	b0*<	=
! 
! 
! 
! 3 <E 	       858?H8	8 8 8 8 8 8r    r   c                       e Zd ZdZdedej        ej        ef         fdZdedej        ej	        ef         fdZ
dedej        ej        ef         fdZdej	        dedd	fd
Zdej        dedd	fdZd	S )_SSHFormatEd25519z~Format for Ed25519 keys.

    Public:
        bytes point
    Private:
        bytes point
        bytes secret_and_point
    rE   r   c                 0    t          |          \  }}|f|fS )zEd25519 public fields)rm   )r~   rE   r   s      r   r   z_SSHFormatEd25519.get_public  s!     "$''tx~r    c                     |                      |          \  \  }}t          j                            |                                          }||fS )z"Make Ed25519 public key from data.)r   r
   r;   from_public_bytesr   )r~   rE   r   r2   s       r   r   z_SSHFormatEd25519.load_public  sK     ..$-??MMOO
 

 4r    c                     |                      |          \  \  }}t          |          \  }}|dd         }|dd         }||k    s|f|k    rt          d          t          j                            |          }||fS )z#Make Ed25519 private key from data.Nr%   z$Corrupt data: ed25519 field mismatch)r   rm   r=   r
   r:   from_private_bytes)r~   rE   r   r   keypairr   point2r   s           r   r   z_SSHFormatEd25519.load_private  s     ..$#D))"F??uh)33CDDD/BB6JJD  r    r2   r   Nc                     |                     t          j        t          j                  }|                    |           dS )zWrite Ed25519 public keyN)r   r   Rawr   r   )r~   r2   r   raw_public_keys       r   r   z_SSHFormatEd25519.encode_public  s?     $00L,*
 
 	(((((r    r   r   c                 h   |                                 }|                    t          j        t          j        t                                }|                    t          j        t          j                  }t          ||g          }| 	                    ||           |
                    |           dS )zWrite Ed25519 private keyN)r2   private_bytesr   r   r   r   r   r   rx   r   r   )r~   r   r   r2   raw_private_keyr   	f_keypairs          r   r   z _SSHFormatEd25519.encode_private  s     !++--
%33L-+\^^
 
 $00L,*
 
 ?@@	:v...)$$$$$r    )r   r   r   r   r   r   r   r   r
   r;   r   r:   r   rx   r   r   r   r    r   r   r     s        	flJ.	/     	g.
:	;       !!	g/;	<! ! ! !)!2);D)	) ) ) )%"4%>G%	% % % % % %r    r   s   nistp256s   nistp384s   nistp521r>   c                     t          | t                    s!t          |                                           } | t          v rt          |          S t          d|           )z"Return valid format or throw errorzUnsupported key type: )r/   r   r   r   _KEY_FORMATSr   )r>   s    r   _lookup_kformatr  *  sZ    h&& 2h''//11<H%%
DDD
E
EEr    backendc                    t          j        d|            |t          j        d|           t                              |           }|st          d          |                    d          }|                    d          }t          j	        t          |           ||                   } |                     t                    st          d          t          |           t          t                    d         } t          |           \  }} t          |           \  }} t          |           \  }} t          |           \  }	} |	dk    rt          d          t          |           \  }
} t          |
          \  }}
t!          |          }|                    |
          \  }}
t%          |
           t          |           \  }} t%          |            ||ft&          t&          fk    r|                                }|t*          vrt-          d|          |t.          k    rt-          d|          t*          |         d	         }t1          ||           t          |          \  }}t          |          \  }}t%          |           t3          |||                                |          }t          |                                                    |                    }nd
}t1          ||           t          |          \  }}t          |          \  }}||k    rt          d          t          |          \  }}||k    rt          d          |                    ||          \  }}t          |          \  }}|t:          dt          |                   k    rt          d          t=          |t>          j                   r!tC          j"        dt           j#        d           |S )z.Load private key from OpenSSH custom encoding.rE   Nr   zNot OpenSSH private key formatr#   zOnly one key supportedzUnsupported cipher: zUnsupported KDF:    ri   zCorrupt data: broken checksumzCorrupt data: key type mismatchzCorrupt data: invalid paddingDSSH DSA keys are deprecated and will be removed in a future release.   
stacklevel)$r   _check_byteslike_check_bytes_PEM_RCsearchr=   r   endbinascii
a2b_base64r   
startswith	_SK_MAGICrN   rm   re   r  r   rR   _NONEr   r&   r   _BCRYPTrO   rZ   	decryptorupdater   _PADDINGr/   r   r7   warningswarnDeprecatedIn40)rE   r   r  mp1p2rS   kdfname
kdfoptionsnkeyspubdatapub_key_typekformatr   edataciphername_bytesblklenr   kbufr   ciphck1ck2r>   r   comments                             r   load_ssh_private_keyr-  ;  s    
64(((:x000tA ;9:::	
B	
qBz$//2677D??9%% ;9:::dC	NN,,-D #4((J%%MGT"4((J4..KE4zz1222  %%MGT'00L'l++G ++G44Iw d##KE4G..%--//<//&;'7;;   g&'F7'F'FGGG./2%((( ,,
d~~T,hOO4>>++22599::%(((%JC%JC
czz8999 "%((OHe<:;;; --eY??K ''NGU 3u::&&&8999+s011 
 		
 	
 	
 	
 r    r   encryption_algorithmc                    t          j        d|           t          | t          j                  r!t          j        dt           j        d           t          |           }t          |          }t                      }|rt          }t          |         d         }t          }t          }	t          |t                    r|j        |j        }	t#          j        d          }
|                    |
           |                    |	           t+          |||
|	          }nt,          x}}d}d}d	}t#          j        d          }d
}t                      }|                    |           |                    |                                 |           t          ||g          }|                    |           |                    | |           |                    |           |                    t6          d||                                |z  z
                      t                      }|                    t:                     |                    |           |                    |           |                    |           |                    |           |                    |           |                    |           |                                }|                                }t=          t?          ||z                       }|                     |           ||z
  }|8|!                                "                    |||         ||d                    tG          |d|                   S )z3Serialize private key with OpenSSH custom encoding.r   ISSH DSA key support is deprecated and will be removed in a future releaser]   r	  r  Nr"   ri   r#   r    )$r   r  r/   r   r7   r  r  r  r?   r  rx   _DEFAULT_CIPHERr&   r  _DEFAULT_ROUNDSr   _kdf_roundsosurandomr   r   rZ   r  r   r2   r   r   r  r   r  r   r   r   	encryptorupdate_intorK   )r   r   r.  r>   r$  f_kdfoptionsrS   r'  r  r   r   r)  r!  checkvalr,  f_public_key	f_secretsf_mainslenmlenr   ofss                         r   _serialize_ssh_private_keyr@    s1    
z8,,,+s011 
* 		
 	
 	
 	
 !--Hh''G ;;L $
j)!, +-HII	6$0<)5Fz"~~%%%V$$$J$??$$
WEz!}}HG ;;LH%%%+0022LAAA8X.//I""";	222!!!hE9>>+;+;f+D!EEFGGG [[F
NN9
j!!!
g
l###
NN5
l###
i    >>D;;==D
Ytf}--
.
.C
MM#
+C $$ST]CI>>>3uu:&&&r    c                       e Zd ZdZdZdS )SSHCertificateTyper#   r  N)r   r   r   USERHOSTr   r    r   rB  rB    s        DDDDr    rB  c            "          e Zd Zdedededededej        e         deded	ej	        eef         d
ej	        eef         dededededededef"dZ
edefd            ZdefdZedefd            Zedefd            Zedefd            Zedej        e         fd            Zedefd            Zedefd            Zedej	        eef         fd            Zedej	        eef         fd            ZdefdZdefdZd"d!Zd S )#SSHCertificate_nonce_public_key_serial_cctype_key_id_valid_principals_valid_after_valid_before_critical_options_extensions	_sig_type_sig_key_inner_sig_type
_signature_tbs_cert_body_cert_key_type
_cert_bodyc                 L   || _         || _        || _        	 t          |          | _        n# t
          $ r t          d          w xY w|| _        || _        || _        || _	        |	| _
        |
| _        || _        || _        || _        || _        || _        || _        || _        d S )NzInvalid certificate type)rG  rH  rI  rB  _typer=   rK  rL  rM  rN  rO  rP  rQ  rR  rS  rT  rV  rW  rU  )r~   rG  rH  rI  rJ  rK  rL  rM  rN  rO  rP  rQ  rR  rS  rT  rU  rV  rW  s                     r   r   zSSHCertificate.__init__  s    ( &	9+G44DJJ 	9 	9 	97888	9!2(*!2&" .$,$,s	   , Ar   c                 *    t          | j                  S r|   )r   rG  r   s    r   noncezSSHCertificate.nonce  s    T[!!!r    c                 @    t          j        t          | j                  S r|   )r   castSSHCertPublicKeyTypesrH  r   s    r   r2   zSSHCertificate.public_key  s     {0$2BCCCr    c                     | j         S r|   )rI  r   s    r   serialzSSHCertificate.serial#  s
    |r    c                     | j         S r|   )rY  r   s    r   typezSSHCertificate.type'  s
    zr    c                 *    t          | j                  S r|   )r   rK  r   s    r   key_idzSSHCertificate.key_id+  s    T\"""r    c                     | j         S r|   )rL  r   s    r   valid_principalszSSHCertificate.valid_principals/      %%r    c                     | j         S r|   )rN  r   s    r   valid_beforezSSHCertificate.valid_before3  s    !!r    c                     | j         S r|   )rM  r   s    r   valid_afterzSSHCertificate.valid_after7  s      r    c                     | j         S r|   )rO  r   s    r   critical_optionszSSHCertificate.critical_options;  rg  r    c                     | j         S r|   )rP  r   s    r   
extensionszSSHCertificate.extensions?  s    r    c                     t          | j                  }|                    | j                  \  }}t	          |           |S r|   )r  rQ  r   rR  rR   )r~   	sigformatsignature_keysigkey_rests       r   rr  zSSHCertificate.signature_keyC  s?    #DN33	%.%:%:4=%I%I"{[!!!r    c                     t          | j                  dz   t          j        t          | j                  d          z   S )N    F)newline)r   rV  r  
b2a_base64rW  r   s    r   r   zSSHCertificate.public_bytesI  s@    $%&&!%"8"8%HHHI	
r    Nc                    |                                  }t          |t          j                  r<|                    t          | j                  t          | j                             d S t          |t          j	                  rt          | j                  \  }}t          |          \  }}t          |           t          j        ||          }t          |j                  }|                    |t          | j                  t          j        |                     d S t          |t"          j                  sJ | j        t(          k    rt+          j                    }nI| j        t.          k    rt+          j                    }n%| j        t2          k    sJ t+          j                    }|                    t          | j                  t          | j                  t7          j                    |           d S r|   )rr  r/   r
   r;   verifyr   rT  rU  r	   r3   rq   rR   
asym_utilsencode_dss_signature_get_ec_hash_algrA   ECDSAr   r5   rS  r6   r   SHA1_SSH_RSA_SHA256SHA256_SSH_RSA_SHA512SHA512r   PKCS1v15)r~   rr  rrE   scomputed_sighash_algs          r   verify_cert_signaturez$SSHCertificate.verify_cert_signatureP  s   **,,mW%=>> 	  do&&d.A(B(B     r'@AA 	 11GAt &&GAt%:1a@@L'(;<<H  eD$788"(8:L:L     mS-=>>>>>#x//!;==%88!=??+>>>>!=??  do&&d)** ""	    r    )r   N)r   r   r   r   r,   rc   r   r   r   Dictr   propertyr[  r^  r2   r`  rB  rb  rd  rf  ri  rk  rm  ro  rr  r   r  r   r    r   rF  rF    s       '-'- ''- 	'-
 '- '- ";u-'- '- '- ";ue|4'- [.'- '- '- $'- '-  #!'-" #'-$ %'- '- '- '-R "u " " " X"D1 D D D D
     X (    X # # # # X# &&+e"4 & & & X& "c " " " X" !S ! ! ! X! &&+eUl"; & & & X&  FKu5       X 4    
e 
 
 
 
     r    rF  rA   c                    t          | t          j                  rt          j                    S t          | t          j                  rt          j                    S t          | t          j                  sJ t          j                    S r|   )	r/   r	   	SECP256R1r   r  	SECP384R1SHA384	SECP521R1r  )rA   s    r   r|  r|  q  sf    %&& }	E2<	(	( }%.....}r    c                     t          j        d|            t                              |           }|st	          d          |                    d          x}}|                    d          }d}|                    t                    rd}|d t          t                              }|t          k    r|st          d          t          |          }	 t          t          j        |                    }n)# t          t          j        f$ r t	          d          w xY w|r|}	t#          |          \  }
}|
|k    rt	          d	          |rt#          |          \  }}|                    |          \  }}|rt'          |          \  }}t)          |          \  }}t#          |          \  }}t#          |          \  }}g }|r6t#          |          \  }}|                    t-          |                     |6t'          |          \  }}t'          |          \  }}t#          |          \  }}t/          |          }t#          |          \  }}t/          |          }t#          |          \  }}t#          |          \  }}t#          |          \  }}|t          k    r|st          d
          |	d t          |                    }t#          |          \  }}t1          |           t#          |          \  }} |t2          k    r|t4          t6          t2          fvs|t2          k    r||k    rt	          d          t#          |           \  }!} t1          |            t9          ||||||||||||||!|||	          S t1          |           |S )NrE   zInvalid line formatr#   r  FTz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)r   r  _SSH_PUBKEY_RCmatchr=   groupendswith_CERT_SUFFIXrN   r9   r   r  r   r  r  	TypeErrorErrorrm   r   rj   re   r   r   _parse_exts_optsrR   r6   r  r  rF  )"rE   _legacy_dsa_allowedr  r>   orig_key_typekey_body	with_certr$  rest	cert_bodyinner_key_typer[  r2   r`  cctyperd  
principalsrf  	principalrk  ri  crit_optionsrm  extsro  _sig_key_rawsig_typesig_keytbs_cert_bodysignature_rawinner_sig_typesig_rest	signatures"                                     r   _load_ssh_public_identityr  {  s    
64(((T""A 0./// wwqzz)H}wwqzzHI&& 2	0s<000018$7";
 
 	
 h''G+(-h7788x~& + + +)***+  	&t,,ND&&-... (!$''t**400J :~~~~"4((&t,,
D 	6$/
$;$;!Iz##E)$4$4555  	6 %TNNT%d^^d(..d+L99 &&
d%d++
d##4'--T'44'x(;&E   ",SYYJ,/)$//tT#.}#=#=    #_h?@ @(""~'A'A@AAA)(33	8X#
 
 	
( 	Ts   !C6 6&Dc                      t          |           S r|   )r  rQ   s    r   load_ssh_public_identityr    s     %T***r    	exts_optsc                     i }d }| rst          |           \  }} t          |          }||v rt          d          |||k     rt          d          t          |           \  }} t          |          ||<   |}| s|S )NzDuplicate namezFields not lexically sorted)rm   r   r=   )r  result	last_namerB   bnamevalues         r   r  r    s    (*FI
 	%i00iT{{F??-... UY%6%6:;;;&y11yeu	  	 Mr    c                     t          | d          }t          |t                    r|                                }n|}t          |t          j                  r!t          j        dt          j	        d           |S )NT)r  r  r  r	  )
r  r/   rF  r2   r   r8   r  r  r   r  )rE   r  cert_or_keyr2   s       r   load_ssh_public_keyr    s     ,DdKKKK+~.. ! ++--

 
*c.// 
 		
 	
 	
 	
 r    c                    t          | t          j                  r!t          j        dt
          j        d           t          |           }t          |          }t                      }|
                    |           |                    | |           t          j        |                                                                          }d                    |d|g          S )z&One-line public key format for OpenSSHr0  r]   r	  r    ru  )r/   r   r8   r  r  r   r  r?   r  rx   r   r   r  rw  r   striprI   )r2   r>   r$  r   pubs        r   serialize_ssh_public_keyr    s    *c.// 
* 		
 	
 	
 	
 !,,Hh''GKKE	X*e,,,

emmoo
.
.
4
4
6
6C88XtS)***r       c                   F   e Zd Zddddg dddg g f
dej        e         dej        e         dej        e         dej        e         dej	        e         de
d	ej        e         d
ej        e         dej	        ej        eef                  dej	        ej        eef                  fdZdedd fdZdedd fdZdedd fdZdedd fdZdej	        e         dd fdZd Zdej        eef         dd fdZdej        eef         dd fdZdededd fd Zdededd fd!Zd"edefd#ZdS )$SSHCertificateBuilderNFrH  rI  rY  rK  rL  _valid_for_all_principalsrN  rM  rO  rP  c                     || _         || _        || _        || _        || _        || _        || _        || _        |	| _        |
| _	        d S r|   
rH  rI  rY  rK  rL  r  rN  rM  rO  rP  )r~   rH  rI  rY  rK  rL  r  rN  rM  rO  rP  s              r   r   zSSHCertificateBuilder.__init__%  sW     '
!2)B&*(!2&r    r2   r   c                 :   t          |t          j        t          j        t
          j        f          st          d          | j        t          d          t          || j        | j        | j        | j        | j        | j        | j        | j        | j        
  
        S )Nr.   zpublic_key already setr  )r/   r	   r3   r   r5   r
   r;   r  rH  r=   r  rI  rY  rK  rL  r  rN  rM  rO  rP  )r~   r2   s     r   r2   z SSHCertificateBuilder.public_key=  s     ) (
 
 	4 2333'5666$"L*L"4&*&D,*"4(
 
 
 	
r    r`  c                 >   t          |t                    st          d          d|cxk    rdk     sn t          d          | j        t          d          t          | j        || j        | j        | j	        | j
        | j        | j        | j        | j        
  
        S )Nzserial must be an integerr               z"serial must be between 0 and 2**64zserial already setr  )r/   rc   r  r=   rI  r  rH  rY  rK  rL  r  rN  rM  rO  rP  )r~   r`  s     r   r`  zSSHCertificateBuilder.serialY  s    &#&& 	97888F""""U""""ABBB<#1222$(*L"4&*&D,*"4(
 
 
 	
r    rb  c                    t          |t                    st          d          | j        t	          d          t          | j        | j        || j        | j	        | j
        | j        | j        | j        | j        
  
        S )Nz"type must be an SSHCertificateTypeztype already setr  )r/   rB  r  rY  r=   r  rH  rI  rK  rL  r  rN  rM  rO  rP  )r~   rb  s     r   rb  zSSHCertificateBuilder.typen  s    $ 233 	B@AAA:!/000$(LL"4&*&D,*"4(
 
 
 	
r    rd  c                    t          |t                    st          d          | j        t	          d          t          | j        | j        | j        || j	        | j
        | j        | j        | j        | j        
  
        S )Nzkey_id must be byteszkey_id already setr  )r/   r   r  rK  r=   r  rH  rI  rY  rL  r  rN  rM  rO  rP  )r~   rd  s     r   rd  zSSHCertificateBuilder.key_id  s    &%(( 	42333<#1222$(L*"4&*&D,*"4(
 
 
 	
r    rf  c                    | j         rt          d          t          d |D                       r|st          d          | j        rt          d          t          |          t          k    rt          d          t          | j        | j	        | j
        | j        || j         | j        | j        | j        | j        
  
        S )NzDPrincipals can't be set because the cert is valid for all principalsc              3   @   K   | ]}t          |t                    V  d S r|   )r/   r   ).0r   s     r   	<genexpr>z9SSHCertificateBuilder.valid_principals.<locals>.<genexpr>  s,      CCQJq%((CCCCCCr    z5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsr  )r  r=   allr  rL  rN   _SSHKEY_CERT_MAX_PRINCIPALSr  rH  rI  rY  rK  rN  rM  rO  rP  )r~   rf  s     r   rf  z&SSHCertificateBuilder.valid_principals  s     ) 	%  
 CC2BCCCCC	#	 G   ! 	=;<<<  #>>>L   %(L*L.&*&D,*"4(
 
 
 	
r    c                     | j         rt          d          | j        rt          d          t          | j        | j        | j        | j        | j         d| j        | j	        | j
        | j        
  
        S )Nz@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTr  )rL  r=   r  r  rH  rI  rY  rK  rN  rM  rO  rP  r   s    r   valid_for_all_principalsz.SSHCertificateBuilder.valid_for_all_principals  s    ! 	+   ) 	ECDDD$(L*L"4&*,*"4(
 
 
 	
r    ri  c                 d   t          |t          t          f          st          d          t          |          }|dk     s|dk    rt	          d          | j        t	          d          t          | j        | j        | j	        | j
        | j        | j        || j        | j        | j        
  
        S )Nz$valid_before must be an int or floatr   r  zvalid_before must [0, 2**64)zvalid_before already setr  )r/   rc   floatr  r=   rN  r  rH  rI  rY  rK  rL  r  rM  rO  rP  )r~   ri  s     r   ri  z"SSHCertificateBuilder.valid_before  s     ,e55 	DBCCC<((!|u44;<<<)7888$(L*L"4&*&D&*"4(
 
 
 	
r    rk  c                 d   t          |t          t          f          st          d          t          |          }|dk     s|dk    rt	          d          | j        t	          d          t          | j        | j        | j	        | j
        | j        | j        | j        || j        | j        
  
        S )Nz#valid_after must be an int or floatr   r  zvalid_after must [0, 2**64)zvalid_after already setr  )r/   rc   r  r  r=   rM  r  rH  rI  rY  rK  rL  r  rN  rO  rP  )r~   rk  s     r   rk  z!SSHCertificateBuilder.valid_after  s     +U|44 	CABBB+&&??kU22:;;;(6777$(L*L"4&*&D,$"4(
 
 
 	
r    rB   r  c                 Z   t          |t                    rt          |t                    st          d          |d | j        D             v rt	          d          t          | j        | j        | j        | j	        | j
        | j        | j        | j        | j        ||fgz   | j        
  
        S )Nname and value must be bytesc                     g | ]\  }}|S r   r   r  rB   r  s      r   
<listcomp>z=SSHCertificateBuilder.add_critical_option.<locals>.<listcomp>  s    ???WT1D???r    zDuplicate critical option namer  )r/   r   r  rO  r=   r  rH  rI  rY  rK  rL  r  rN  rM  rP  r~   rB   r  s      r   add_critical_optionz)SSHCertificateBuilder.add_critical_option  s     $&& 	<j.F.F 	<:;;;??(>?????=>>>$(L*L"4&*&D,*"4uF(
 
 
 	
r    c                 Z   t          |t                    rt          |t                    st          d          |d | j        D             v rt	          d          t          | j        | j        | j        | j	        | j
        | j        | j        | j        | j        | j        ||fgz   
  
        S )Nr  c                     g | ]\  }}|S r   r   r  s      r   r  z7SSHCertificateBuilder.add_extension.<locals>.<listcomp>  s    999WT1D999r    zDuplicate extension namer  )r/   r   r  rP  r=   r  rH  rI  rY  rK  rL  r  rN  rM  rO  r  s      r   add_extensionz#SSHCertificateBuilder.add_extension  s     $&& 	<j.F.F 	<:;;;99(8999997888$(L*L"4&*&D,*"4(T5M?:
 
 
 	
r    r   c           
      6   t          |t          j        t          j        t
          j        f          st          d          | j        t          d          | j
        dn| j
        }| j        t          d          | j        dn| j        }| j        s| j        st          d          | j        t          d          | j        t          d          | j        | j        k    rt          d	          | j                            d
            | j                            d            t)          | j                  }|t*          z   }t-          j        d          }t1          |          }t3                      }|                    |           |                    |           |                    | j        |           |                    |           |                    | j        j                   |                    |           t3                      }	| j        D ]}
|	                    |
           |                    |	                                           |                    | j                   |                    | j                   t3                      }| j        D ]/\  }}|                    |           |                    |           0|                    |                                           t3                      }| j        D ]/\  }}|                    |           |                    |           0|                    |                                           |                    d           t)          |          }t1          |          }t3                      }|                    |           |                    |                                 |           |                    |                                           t          |t
          j                  r|!                    |                                          }t3                      }|                    |           |                    |           |                    |                                           nt          |t          j                  rtE          |j#                  }|!                    |                                t          j$        |                    }tK          j&        |          \  }}t3                      }|                    |           t3                      }|'                    |           |'                    |           |                    |                                           |                    |                                           nt          |t          j                  sJ t3                      }|                    tP                     |!                    |                                tS          j*                    tW          j,                              }|                    |           |                    |                                           t[          j.        |                                          /                                }ta          j1        td          tg          d4                    |d|g                              S )NzUnsupported private key typezpublic_key must be setr   ztype must be setr    zAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforec                     | d         S Nr   r   r   s    r   <lambda>z,SSHCertificateBuilder.sign.<locals>.<lambda>U  s
    !A$ r    )r*   c                     | d         S r  r   r  s    r   r  z,SSHCertificateBuilder.sign.<locals>.<lambda>V  s
    AaD r    r%   ru  )5r/   r	   r0   r   r4   r
   r:   r  rH  r=   rI  rY  rK  rL  r  rN  rM  rO  sortrP  r?   r  r4  r5  r  rx   r   r   r   r   r  r   r2   signr|  rA   r}  rz  decode_dss_signaturer   r  r   r  r   r  r  rw  r  r   r]  rF  r  rI   )r~   r   r`  rd  r>   cert_prefixr[  r$  ffprincipalsr   fcritrB   r  fextca_typecaformatcafr  fsigr  r  r  fsigblob	cert_datas                            r   r  zSSHCertificateBuilder.sign*  s   *!)
 
 	< :;;;#5666 l*:/000 ,$, % 	d.L 	  
 %7888$6777t111LMMM 	###777..111$T%566- 
2!(++KK	[!!!	Ud.222			&			$*"###	Vkk' 	& 	&A""1%%%%	[((**+++			$#$$$			$$%%%1 	$ 	$KD%T"""U####	U]]__%%%{{+ 	# 	#KD%OOD!!!OOE""""	T\\^^$$$	S#K00"7++kkw{5577===	S[[]]### k7#<== 	)#((55I;;DOOG$$$OOI&&&LL((((R%?@@ 	)'(9::H#((bhx6H6HIII29==DAq;;DOOG$$$ {{Hq!!!q!!!OOH,,..///LL(((( k3+<=====
 ;;DOOO,,,#((		W-// I OOI&&&LL((('		44::<<	 {$SXX{D).L%M%MNN
 
 	
r    )r   r   r   r   r   r^  rc   rB  r   r   boolr   r   r2   r`  rb  rd  rf  r  r   r  ri  rk  r  r  SSHCertPrivateKeyTypesrF  r  r   r    r   r  r  $  s        ?C(,59*.02*/.2-1EG?A' '_%:;' %' 12	'
 '' ";u-' $(' s+' oc*' ";v|E5L'AB' [eUl!;<' ' ' '0
/
	 
 
 
 
8
S 
%< 
 
 
 
*
+ 
0G 
 
 
 
&
U 
'> 
 
 
 
&"
 &E 2"
	 "
 "
 "
 "
H
 
 
,
"Le4
	 
 
 
 
0
!<U
3
	 
 
 
 
0

"'
	 
 
 
 
,

"'
	 
 
 
 
,}
 6 }
> }
 }
 }
 }
 }
 }
r    r  )Fr|   )}r  enumr4  rer   r  base64r   rJ   cryptographyr   cryptography.exceptionsr   cryptography.hazmat.primitivesr   )cryptography.hazmat.primitives.asymmetricr   r	   r
   r   r   rz  &cryptography.hazmat.primitives.ciphersr   r   r   ,cryptography.hazmat.primitives.serializationr   r   r   r   r   r   bcryptr   r   _bcrypt_supportedImportErrorr   rc   r  r<   r6   r9   _ECDSA_NISTP256_ECDSA_NISTP384_ECDSA_NISTP521r  r  r  compiler  r  	_SK_START_SK_ENDr  r  r1  r2  DOTALLr  r   r   ranger  AESCTRCBCr&   r  r   Typer   r   rC   r?   r3   r1   rK   rO   rR   r   rZ   re   rj   rm   rq   rv   rx   r   r   r   r   r  r  r  r  r  r0   r4   r7   r:   r+   Anyr-  r@  r5   r8   r;   r,   r^  EnumrB  rF  r   HashAlgorithmr|  r  r  r  r  r  r  r  r  r   r    r   <module>r     s	     				 				   0 0 0 0 0 0       8 8 8 8 8 8 1 1 1 1 1 1              J I I I I I L L L L L L L L L L               9)))))) 
9 
9 
9 #(9 999 9 	9
  9 
9 9 9 9 9 9
9 (((' "!233	2	
.
 "*Y)G3RY
?
? :iia 0 01122 NB	26NB	26  fk	
LJN#V[+V[-CCD	    !   	?	@
   *' 9 'e ' ' ' ' %eO< <
<< < 	< < < <:E :c :d : : : :8u 8 8 8 8 8>>oe$> > 	>
 FLEI-./> > > >?: ?&,sJ"? ? ? ? ??: ?&,sJ"? ? ? ? ?j V\*j2H%I    ,Z ,FLj$A , , , ,+3 +5 + + + +5 5 5 5 5 5 5 5pC, C, C, C, C, C, C, C,LED ED ED ED ED ED ED EDPD8 D8 D8 D8 D8 D8 D8 D8N@% @% @% @% @% @% @% @%H mmoommoo##%%__[,",..AA__[,",..AA__[,",..AAFe F F F F \  R R
Roe$R ZR 	R R R RjJ'#J'J' 5J' 	J' J' J' J'Z L          
~ ~ ~ ~ ~ ~ ~ ~BB, 1E     \ \
\ \."334\ \ \ \~+
+\."334+ + + +
 v{5%</H    " (, 
 *   (+): +u + + + +(    " C
 C
 C
 C
 C
 C
 C
 C
 C
 C
s   !A* *BB