HEX

File: //var/opt/nydus/ops/oscrypto/__pycache__/_asymmetric.cpython-39.pyc
a

�,�h�x�@sjddlmZmZmZmZddlZddlZddlZddlZddl	m
Z
mZmZm
Z
mZmZmZmZmZmZmZmZmZmZmZddlmZmZmZddlmZmZm Z m!Z!m"Z"ddl#m$Z$ddl%m&Z&dd	l'm(Z(m)Z)m*Z*Gd
d�d�Z+Gdd
�d
�Z,Gdd�d�Z-dd�Z.dd�Z/e e!ee"ed�Z0dd�Z1dd�Z2d%dd�Z3d&dd�Z4dd�Z5dd �Z6d!d"�Z7d#d$�Z8dS)'�)�unicode_literals�division�absolute_import�print_functionN�)�CertBag�Certificate�
DSAPrivateKey�ECPrivateKey�
EncryptedData�EncryptedPrivateKeyInfo�Integer�OctetString�Pfx�PrivateKeyInfo�
PublicKeyInfo�
RSAPrivateKey�RSAPublicKey�SafeContents�unarmor)�pbkdf1�pbkdf2�
pkcs12_kdf)�aes_cbc_pkcs7_decrypt�des_cbc_pkcs5_decrypt�rc2_cbc_pkcs5_decrypt�rc4_decrypt�tripledes_cbc_pkcs5_decrypt)�constant_compare)�pretty_message)�byte_cls�str_cls�	type_namec@sLeZdZdZdZdd�Zedd��Zedd��Zedd	��Z	ed
d��Z
dS)�_PrivateKeyBaseNcCs�|jdkr|jdjS|jdkr^|jdd}td|d|d|d	|j��|jdjd
��S|jdkr�|jdj}|jdd|d<|j��|d<|Sd
S)a.
        Unwraps the private key into an asn1crypto.keys.RSAPrivateKey,
        asn1crypto.keys.DSAPrivateKey or asn1crypto.keys.ECPrivateKey object

        :return:
            An asn1crypto.keys.RSAPrivateKey, asn1crypto.keys.DSAPrivateKey or
            asn1crypto.keys.ECPrivateKey object
        �rsa�private_key�dsa�private_key_algorithm�
parametersr�p�q�g��versionr)r*r+�
public_keyr%�ecr.N)�	algorithm�asn1�parsedr	r.�unwrap)�self�params�output�r7�E/opt/nydus/tmp/pip-target-wkfpz8uv/lib/python/oscrypto/_asymmetric.pyr3-s"



�	
z_PrivateKeyBase.unwrapcCs|jjS�zO
        :return:
            A unicode string of "rsa", "dsa" or "ec"
        �r1r0�r4r7r7r8r0Ksz_PrivateKeyBase.algorithmcCs|jjdS��H
        :return:
            A unicode string of EC curve name
        r�r1�curver;r7r7r8r?Tsz_PrivateKeyBase.curvecCs|jjS�zS
        :return:
            The number of bits in the key, as an integer
        �r1�bit_sizer;r7r7r8rB]sz_PrivateKeyBase.bit_sizecCs|jjS�zT
        :return:
            The number of bytes in the key, as an integer
        �r1�	byte_sizer;r7r7r8rEfsz_PrivateKeyBase.byte_size)�__name__�
__module__�__qualname__r1�_fingerprintr3�propertyr0r?rBrEr7r7r7r8r#(s


r#c@sXeZdZdZdZdd�Zedd��Zedd��Zedd	��Z	ed
d��Z
edd
��ZdS)�_PublicKeyBaseNcCs |jdkr|jdS|jdjS)a7
        Unwraps a public key into an asn1crypto.keys.RSAPublicKey,
        asn1crypto.core.Integer (for DSA) or asn1crypto.keys.ECPointBitString
        object

        :return:
            An asn1crypto.keys.RSAPublicKey, asn1crypto.core.Integer or
            asn1crypto.keys.ECPointBitString object
        r/r.)r0r1r2r;r7r7r8r3us

z_PublicKeyBase.unwrapcCs|jdurt|jd�|_|jS)aZ
        Creates a fingerprint that can be compared with a private key to see if
        the two form a pair.

        This fingerprint is not compatible with fingerprints generated by any
        other software.

        :return:
            A byte string that is a sha256 hash of selected components (based
            on the key type)
        N)rIr1r;r7r7r8�fingerprint�s
z_PublicKeyBase.fingerprintcCs|jjSr9r:r;r7r7r8r0�sz_PublicKeyBase.algorithmcCs|jjdSr<r>r;r7r7r8r?�sz_PublicKeyBase.curvecCs|jjSr@rAr;r7r7r8rB�sz_PublicKeyBase.bit_sizecCs|jjSrCrDr;r7r7r8rE�sz_PublicKeyBase.byte_size)rFrGrHr1rIr3rJrLr0r?rBrEr7r7r7r8rKps



rKc@s@eZdZdZedd��Zedd��Zedd��Zedd	��ZdS)
�_CertificateBaseNcCs|jjSr9)r.r0r;r7r7r8r0�sz_CertificateBase.algorithmcCs|jjS)r=)r.r?r;r7r7r8r?�sz_CertificateBase.curvecCs|jjS)zZ
        :return:
            The number of bits in the public key, as an integer
        )r.rBr;r7r7r8rB�sz_CertificateBase.bit_sizecCs|jjS)z[
        :return:
            The number of bytes in the public key, as an integer
        )r.rEr;r7r7r8rE�sz_CertificateBase.byte_size)	rFrGrHr1rJr0r?rBrEr7r7r7r8rM�s


rMcCs�|j}|dks|dkr |djS|dkrz|dd}|dj}td|d|d	|d
tt|d
j|j|dj��|d��S|dkr�|dj}|dd|d<|Std
|j��dS)a�
    Unwraps an asn1crypto.keys.PrivateKeyInfo object into an
    asn1crypto.keys.RSAPrivateKey, asn1crypto.keys.DSAPrivateKey
    or asn1crypto.keys.ECPrivateKey.

    :param key_info:
        An asn1crypto.keys.PrivateKeyInfo object

    :return:
        One of:
         - asn1crypto.keys.RSAPrivateKey
         - asn1crypto.keys.DSAPrivateKey
         - asn1crypto.keys.ECPrivateKey
    r$Z
rsassa_pssr%r&r'r(rr)r*r+r,r/z#Unsupported key_info.algorithm "%s"N)r0r2r	r
�pow�native�
ValueError)�key_infoZkey_algr5r2r7r7r8�_unwrap_private_key_info�s.

��

rRcCst|t��r|dj}|jdkr:d|dj|djf}n�|jdkr�|dd}tt|d	j|djj|d
j��}d|d
j|dj|d	j|jf}nT|jd
kr�|dj}|dur�||�j}|jdjj}d|j	d}|�
d�}||7}t|t��r|�
d�}t�
|���St|t��r�|jdk�rN|dj}d|dj|djf}n~|jdk�r�|dj}|dd}d|d
j|dj|d	j|jf}n6|jd
k�r�|dj}d|j	d}|�
d�}||7}t|t��r�|�
d�}t�
|���Sttdt|����dS)a5
    Returns a fingerprint used for correlating public keys and private keys

    :param key_object:
        An asn1crypto.keys.PrivateKeyInfo or asn1crypto.keys.PublicKeyInfo

    :raises:
        ValueError - when the key_object is not of the proper type

    ;return:
        A byte string fingerprint
    r%r$z%d:%d�modulusZpublic_exponentr&r'r(r+r)z%d:%d:%d:%dr*r/r.Nz%s:rzutf-8r0z�
        key_object must be an instance of the
        asn1crypto.keys.PrivateKeyInfo or asn1crypto.keys.PublicKeyInfo
        classes, not %s
        )�
isinstancerr2r0rOr
rNr.r1r?�encoder!�hashlib�sha256�digestrrPrr")Z
key_object�load_private_key�keyZto_hashr5r.Zpublic_key_objectr7r7r8rIsv

�

��





�
�


�rI)�rc2�rc4�des�	tripledes�aescCs"t|t�sttdt|����d}t�d|�durft|�\}}}|dkrRttd���|dkrft	�
|d�S|dusv|dkr�zt	�|�}|j|WSty�Yn0zt
�|�}|jt	�
|d�WSty�Yn0|dus�|dk�rzt�|�}|d	d
}|WSt�yYn0td��dS)a�
    Loads a public key from a DER or PEM-formatted file. Supports RSA, DSA and
    EC public keys. For RSA keys, both the old RSAPublicKey and
    SubjectPublicKeyInfo structures are supported. Also allows extracting a
    public key from an X.509 certificate.

    :param data:
        A byte string to load the public key from

    :raises:
        ValueError - when the data does not appear to contain a public key

    :return:
        An asn1crypto.keys.PublicKeyInfo object
    �<
            data must be a byte string, not %s
            N�\s*-----�private keyz�
                The data specified does not appear to be a public key or
                certificate, but rather a private key
                r$�
public key�certificate�tbs_certificate�subject_public_key_infozQThe data specified does not appear to be a known public key or certificate format)rTr �	TypeErrorrr"�re�match�_unarmor_pemrPr�wrap�loadrOrr)�data�key_type�algo�pkiZrpkZparsed_certrQr7r7r8�parse_public~sF
��



rqcCs�t|t�sttdt|����d}t�d|�durft|�\}}}|dkrRttd���|dkrfttd���|dusv|dkr�zt	�
|�WSty�Yn0ttd	���dS)
a@
    Loads a certificate from a DER or PEM-formatted file. Supports X.509
    certificates only.

    :param data:
        A byte string to load the certificate from

    :raises:
        ValueError - when the data does not appear to contain a certificate

    :return:
        An asn1crypto.x509.Certificate object
    r`Nrarbz�
                The data specified does not appear to be a certificate, but
                rather a private key
                rcz�
                The data specified does not appear to be a certificate, but
                rather a public key
                rdzU
        The data specified does not appear to be a known certificate format
        )rTr rgrr"rhrirjrPrrl)rmrn�_r7r7r8�parse_certificate�s0
����rsc
Cs�t|t�sttdt|����|durBt|t�sFttdt|����nd}t�d|�dur�t||�\}}}|dkrzttd���|dkr�ttd	���zt	�
|�}|j|WSty�Yn0z>t�
|�}|d
}|dj}t
|||�}t	�
|�}|j|WSt�y
Yn0zt�
|�}	|	jt	�|	d�WSt�y>Yn0zt�
|�}	|	jt	�|	d
�WSt�yrYn0zt�
|�}	|	jt	�|	d�WSt�y�Yn0ttd���dS)a%
    Loads a private key from a DER or PEM-formatted file. Supports RSA, DSA and
    EC private keys. Works with the follow formats:

     - RSAPrivateKey (PKCS#1)
     - ECPrivateKey (SECG SEC1 V2)
     - DSAPrivateKey (OpenSSL)
     - PrivateKeyInfo (RSA/DSA/EC - PKCS#8)
     - EncryptedPrivateKeyInfo (RSA/DSA/EC - PKCS#8)
     - Encrypted RSAPrivateKey (PEM only, OpenSSL)
     - Encrypted DSAPrivateKey (PEM only, OpenSSL)
     - Encrypted ECPrivateKey (PEM only, OpenSSL)

    :param data:
        A byte string to load the private key from

    :param password:
        The password to unencrypt the private key

    :raises:
        ValueError - when the data does not appear to contain a private key, or the password is invalid

    :return:
        An asn1crypto.keys.PrivateKeyInfo object
    r`N�H
                password must be a byte string, not %s
                �rarcz�
                The data specified does not appear to be a private key, but
                rather a public key
                rdz�
                The data specified does not appear to be a private key, but
                rather a certificate
                �encryption_algorithm�encrypted_datar$r&r/zU
        The data specified does not appear to be a known private key format
        )rTr rgrr"rhrirjrPrrlrOr�_decrypt_encrypted_datarrkr	r
)
rm�passwordrnrrrpZparsed_wrapper�encryption_algorithm_inforwZdecrypted_datar2r7r7r8�
parse_privatesv
�
���






�r{c
Cs�t|�\}}}d}t�||�}|s.ttd���|�d�}|��}|tgd��vrp|�d���}d|t	|||�fS|��}	d}|	dkr�d}	n|	d	kr�d
}	d}|	||fS)a3
    Removes PEM-encoding from a public key, private key or certificate. If the
    private key is encrypted, the password will be used to decrypt it.

    :param data:
        A byte string of the PEM-encoded data

    :param password:
        A byte string of the encryption password, or None

    :return:
        A 3-element tuple in the format: (key_type, algorithm, der_bytes). The
        key_type will be a unicode string of "public key", "private key" or
        "certificate". The algorithm will be a unicode string of "rsa", "dsa"
        or "ec".
    zc^((DSA|EC|RSA) PRIVATE KEY|ENCRYPTED PRIVATE KEY|PRIVATE KEY|PUBLIC KEY|RSA PUBLIC KEY|CERTIFICATE)zx
            data does not seem to contain a PEM-encoded certificate, private
            key or public key
            r)zRSA PRIVATE KEYzDSA PRIVATE KEYzEC PRIVATE KEY�rbNzencrypted private keyzrsa public keyrcr$)
rrhrirPr�group�strip�set�lower�_unarmor_pem_openssl_private)
rmryZobject_type�headersZ	der_bytesZ
type_regexZ
armor_typeZ
pem_headerrornr7r7r8rjvs(�
rjcCsDd}d}d}d|vrB|d}|�d�dkr>|���d�\}}nd}|sJ|S|r^t�|�d��}|��}ddddd	d	dd
dd
dddddddd
d
d�|}t�||d
d
���	�}|t
|�kr�|t�|||d
d
���	�7}q�|d
|�}dddddddddddddddddddd�|}	t|	}
|	dk�r8|
||�S|
|||�S)a�
    Parses a PKCS#1 private key, or encrypted private key

    :param headers:
        A dict of "Name: Value" lines from right after the PEM header

    :param data:
        A byte string of the DER-encoded PKCS#1 private key

    :param password:
        A byte string of the password to use if the private key is encrypted

    :return:
        A byte string of the DER-encoded private key
    NzDEK-Info�,���ZRC4�ascii��� ��)zaes-128-cbczaes-128zaes-192-cbczaes-192zaes-256-cbczaes-256r\zrc4-64zrc4-40z
rc2-64-cbcz
rc2-40-cbczrc2-cbcr[zdes-ede3-cbczdes-ede3Zdes3zdes-ede-cbczdes-cbcr]rr_r\r[r^r])�findr~�split�binascii�	unhexlifyrUr�rV�md5rX�len�crypto_funcs)r�rmryZenc_algoZ
enc_iv_hex�enc_ivr5Zenc_key_length�enc_keyZ
enc_algo_name�decrypt_funcr7r7r8r��s���$��

r�cs�t|t�sttdt|����|durBt|t�sFttdt|����nd}i�i}t�|�}|d}|djdkrzttd���|j	}|d	}|�r|d
ddj}d
ddddddd�|}	t
|||dj|dj|	d�}
tt|�}t
�|
|dj|���}|d
dj}
t||
��std��|D]~}|d}t|t��rJt|j�|||�nPt|t��r�|d}|d}|dj}t|||�}t|�|||�nttd����qt|���}t����}tt||@��}d}d}g}t|�dk�r|d�|�}��}��fdd ��D�}|||fSt|�dk�r@tt|����d}||}t��dk�rptt�����d}�|}�|=t��dk�r�tt����d!d"�d#�}|||fS)$aY
    Parses a PKCS#12 ANS.1 DER-encoded structure and extracts certs and keys

    :param data:
        A byte string of a DER-encoded PKCS#12 file

    :param password:
        A byte string of the password to any encrypted data

    :param load_private_key:
        A callable that will accept a byte string and return an
        oscrypto.asymmetric.PrivateKey object

    :raises:
        ValueError - when any of the parameters are of the wrong type or value
        OSError - when an error is returned by one of the OS decryption functions

    :return:
        A three-element tuple of:
         1. An asn1crypto.keys.PrivateKeyInfo object
         2. An asn1crypto.x509.Certificate object
         3. A list of zero or more asn1crypto.x509.Certificate objects that are
            "extra" certificates, possibly intermediates from the cert chain
    r`Nrtru�	auth_safe�content_typermzV
            Only password-protected PKCS12 files are currently supported
            �mac_data�macZdigest_algorithmr0��r��0�@)�sha1�sha224rW�sha384�sha512Z
sha512_224Z
sha512_256Zmac_saltZ
iterations��contentrXzPassword provided is invalid�encrypted_content_infoZcontent_encryption_algorithm�encrypted_contentz[
                Public-key-based PKCS12 files are not currently supported
                rrcsg|]}|�kr�|�qSr7r7)�.0�f��certsrLr7r8�
<listcomp>|ruz!_parse_pkcs12.<locals>.<listcomp>cSs|jjS)N)�subjectZhuman_friendly)�cr7r7r8�<lambda>�ruz_parse_pkcs12.<locals>.<lambda>)rZ)rTr rgrr"rrlrOrP�authenticated_safer�getattrrV�hmac�new�contentsrXrr�_parse_safe_contentsrrxr�keys�sorted�listr��values)rmryrY�private_keys�pfxr�r�r�Zmac_algo�
key_lengthZmac_keyZhash_modZ
computed_hmacZstored_hmacZcontent_infor�r�rzr�Zdecrypted_contentZkey_fingerprintsZcert_fingerprintsZcommon_fingerprintsrZ�certZother_certsZ	first_keyr7r�r8�
_parse_pkcs12s�
�
�
���	�

�

r�c
Cs�t|t�rt�|�}|D]�}|d}t|t�rh|djdkr�|dj}|dd}|dj|t|d�<qt|t�r�||t||�<qt|t	�r�|d}	|d	j}
t
|	|
|�}t�|�}||t||�<qt|t�rt|||||�qqdS)
a&
    Parses a SafeContents PKCS#12 ANS.1 structure and extracts certs and keys

    :param safe_contents:
        A byte string of ber-encoded SafeContents, or a asn1crypto.pkcs12.SafeContents
        parsed object

    :param certs:
        A dict to store certificates in

    :param keys:
        A dict to store keys in

    :param password:
        A byte string of the password to any encrypted data

    :param load_private_key:
        A callable that will accept a byte string and return an
        oscrypto.asymmetric.PrivateKey object
    �	bag_valueZcert_id�x509Z
cert_valuererfNrvrw)rTr rrlrrOr2rIrrrxr�)
Z
safe_contentsr�r�ryrYZsafe_bagr�r�Zpublic_key_inforzZencrypted_key_bytesZdecrypted_key_bytesr%r7r7r8r��s(








r�cCst|j}|jdkrV|jdkr*ttd���t|j||j|j|j	�}|j
}||||�}n�|jdkr�t|j||j|j|j	d�}|dd�}|dd�}||||�}nb|jdk�rt|j||j|j|j	d	�}|jd
kr�|||�}n&t|j||j|j|j
d�}||||�}|S)al
    Decrypts encrypted ASN.1 data

    :param encryption_algorithm_info:
        An instance of asn1crypto.pkcs5.Pkcs5EncryptionAlgorithm

    :param encrypted_content:
        A byte string of the encrypted content

    :param password:
        A byte string of the encrypted content's password

    :return:
        A byte string of the decrypted plaintext
    rZrc5zc
                PBES2 encryption scheme utilizing RC5 encryption is not supported
                rr�rr�rrr\r|)r�Zencryption_cipher�kdfrPrrZkdf_hmacZkdf_saltZkdf_iterationsr�Z
encryption_ivrrZencryption_block_size)rzr�ryr�r�r��	plaintextZderived_outputr7r7r8rx�s^


��
��

�rx)N)N)9�
__future__rrrrrVr�rhr�Z_asn1rrr	r
rrr
rrrrrrrrr�rrrZ	symmetricrrrrr�utilr�_errorsr�_typesr r!r"r#rKrMrRrIr�rqrsr{rjr�r�r�rxr7r7r7r8�<module>s<DHK)-e�	I:
u
3[4