o
    ˷es]                     @   s  U d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ z
d dlmZ d	ZW n eym   d
Z	
d`dedededede defddZY nw dZ!dZ"dZ#dZ$dZ%dZ&dZ'e(dZ)dZ*dZ+dZ,dZ-dZ.d Z/d!Z0d"Z1e(e+d# e, ej2Z3e4e5e6d$d%Z7ej8d&ej9d!fej8d&ej:d!fd'Z;ej<eej=ej>ej8 eej?ej>ej9 ej>ej: f ef f e@d(< e$e%e&d)ZAd*ejBdefd+d,ZCe+d- e,d- fd.ed/ed0edefd1d2ZDd.ed3eddfd4d5ZEd.eddfd6d7ZFd8edejGe dededeej?ej:ej9f  f
d9d:ZHd.e4dej=ee4f fd;d<ZId.e4dej=ee4f fd=d>ZJd.e4dej=e4e4f fd?d@ZKd.e4dej=ee4f fdAdBZLdCedefdDdEZMG dFdG dGZNG dHdI dIZOG dJdK dKZPG dLdM dMZQG dNdO dOZRe"eO e#eP e!eR e$eQdPeS e%eQdQeT e&eQdReU iZVdSefdTdUZWej?ejXejYejZej[f Z\	dad.edejGe dVej]de\fdWdXZ^	dadYe\dejGe defdZd[Z_ej?ejBej`ejaejbf Zc	dad.edVej]decfd\d]Zdd*ecdefd^d_ZedS )b    N)encodebytes)utilsUnsupportedAlgorithm)dsaeced25519rsa)Cipher
algorithmsmodes)EncodingNoEncryptionPrivateFormatPublicFormat)kdfTFpasswordsaltdesired_key_bytesroundsignore_few_roundsreturnc                 C   s   t d)NzNeed bcrypt moduler   )r   r   r   r   r    r   g/var/www/ideatree/venv/lib/python3.10/site-packages/cryptography/hazmat/primitives/serialization/ssh.py_bcrypt_kdf   s   r   s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   none
   aes256-ctr   H   s   (.*?)          )r   s
   aes256-cbc_SSH_CIPHERS)	secp256r1	secp384r1	secp521r1
public_keyc                 C   s*   | j }|jtvrtd|jt|j S )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPE
ValueError)r%   r&   r   r   r   _ecdsa_key_typeV   s   


r*      
dataprefixsuffixc                 C   s   d |t| |gS )N    )join_base64_encode)r,   r-   r.   r   r   r   _ssh_pem_encode`   s   r2   	block_lenc                 C   s    | r
t | | dkrtddS )zRequire data to be full blocksr   zCorrupt data: missing paddingN)lenr)   )r,   r3   r   r   r   _check_block_sizeh   s   r5   c                 C   s   | rt ddS )z!All data should have been parsed.zCorrupt data: unparsed dataN)r)   r,   r   r   r   _check_emptyn   s   r7   
ciphernamec           	      C   sR   |st dt|  \}}}}t|||| |d}t||d| |||d S )z$Generate key + iv and return cipher.zKey is password-protected.TN)r)   r!   r   r
   )	r8   r   r   r   algokey_lenmodeiv_lenseedr   r   r   _init_ciphert   s
   "r>   c                 C   6   t | dk r
tdtj| dd dd| dd fS )Uint32   Invalid dataNbig	byteorderr4   r)   int
from_bytesr6   r   r   r   _get_u32      "rI   c                 C   r?   )Uint64   rB   NrC   rD   rF   r6   r   r   r   _get_u64   rJ   rM   c                 C   s8   t | \}} |t| krtd| d| | |d fS )zBytes with u32 length prefixrB   N)rI   r4   r)   )r,   nr   r   r   _get_sshstr   s   rO   c                 C   s4   t | \}} |r|d dkrtdt|d| fS )zBig integer.r      rB   rC   )rO   r)   rG   rH   )r,   valr   r   r   
_get_mpint   s   rR   rQ   c                 C   s4   | dk rt d| sdS |  d d }t| |S )z!Storage format for signed bigint.r   znegative mpint not allowedr/   rL   )r)   
bit_lengthr   int_to_bytes)rQ   nbytesr   r   r   	_to_mpint   s   rV   c                   @   s   e Zd ZU dZeje ed< ddeje ddfddZdeddfd	d
Z	de
ddfddZdejed f ddfddZde
ddfddZde
fddZddede
de
fddZdefddZdS )	_FragListz,Build recursive structure without data copy.flistNinitr   c                 C   s   g | _ |r| j | d S d S N)rX   extend)selfrY   r   r   r   __init__   s   z_FragList.__init__rQ   c                 C   s   | j | dS )zAdd plain bytesN)rX   appendr\   rQ   r   r   r   put_raw      z_FragList.put_rawc                 C   s   | j |jddd dS )zBig-endian uint32rA   rC   )lengthrE   N)rX   r^   to_bytesr_   r   r   r   put_u32   s   z_FragList.put_u32c                 C   sN   t |tttfr| t| | j| dS | |  | j	|j dS )zBytes prefixed with u32 lengthN)

isinstancebytes
memoryview	bytearrayrd   r4   rX   r^   sizer[   r_   r   r   r   
put_sshstr   s
   z_FragList.put_sshstrc                 C   s   |  t| dS )z*Big-endian bigint prefixed with u32 lengthN)rj   rV   r_   r   r   r   	put_mpint   s   z_FragList.put_mpintc                 C   s   t tt| jS )zCurrent number of bytes)summapr4   rX   )r\   r   r   r   ri      ra   z_FragList.sizer   dstbufposc                 C   s2   | j D ]}t|}||| }}||||< q|S )zWrite into bytearray)rX   r4   )r\   rn   ro   fragflenstartr   r   r   render   s
   
z_FragList.renderc                 C   s"   t t|  }| | | S )zReturn as bytes)rg   rh   ri   rs   tobytes)r\   bufr   r   r   rt      s   
z_FragList.tobytesrZ   )r   )__name__
__module____qualname____doc__typingListrf   __annotations__r]   r`   rG   rd   Unionrj   rk   ri   rg   rs   rt   r   r   r   r   rW      s   
 	rW   c                   @   s   e Zd ZdZdefddZdedejej	ef fddZ
dedejejef fdd	Zd
ej	deddfddZdejdeddfddZdS )_SSHFormatRSAzhFormat for RSA keys.

    Public:
        mpint e, n
    Private:
        mpint n, e, d, iqmp, p, q
    r,   c                 C   s$   t |\}}t |\}}||f|fS )zRSA public fieldsrR   )r\   r,   erN   r   r   r   
get_public   s   z_SSHFormatRSA.get_publicr   c                 C   s.   |  |\\}}}t||}| }||fS )zMake RSA public key from data.)r   r	   RSAPublicNumbersr%   )r\   r,   r   rN   public_numbersr%   r   r   r   load_public   s   z_SSHFormatRSA.load_publicc              	   C   s   t |\}}t |\}}t |\}}t |\}}t |\}}t |\}}||f|kr.tdt||}	t||}
t||}t||||	|
||}| }||fS )zMake RSA private key from data.z Corrupt data: rsa field mismatch)rR   r)   r	   rsa_crt_dmp1rsa_crt_dmq1r   RSAPrivateNumbersprivate_key)r\   r,   	pubfieldsrN   r   diqmppqdmp1dmq1r   private_numbersr   r   r   r   load_private   s    z_SSHFormatRSA.load_privater%   f_pubNc                 C   s$   |  }||j ||j dS )zWrite RSA public keyN)r   rk   r   rN   )r\   r%   r   pubnr   r   r   encode_public  s   z_SSHFormatRSA.encode_publicr   f_privc                 C   sZ   |  }|j}||j ||j ||j ||j ||j ||j dS )zWrite RSA private keyN)	r   r   rk   rN   r   r   r   r   r   )r\   r   r   r   r   r   r   r   encode_private  s   z_SSHFormatRSA.encode_private)rv   rw   rx   ry   rg   r   rz   Tupler	   RSAPublicKeyr   RSAPrivateKeyr   rW   r   r   r   r   r   r   r~      s6    
	

r~   c                   @   s   e Zd ZdZdedejejef fddZdedejej	ef fddZ
dedejejef fdd	Zd
ej	deddfddZdejdeddfddZdejddfddZdS )_SSHFormatDSAzhFormat for DSA keys.

    Public:
        mpint p, q, g, y
    Private:
        mpint p, q, g, y, x
    r,   r   c                 C   s@   t |\}}t |\}}t |\}}t |\}}||||f|fS )zDSA public fieldsr   )r\   r,   r   r   gyr   r   r   r   ,  s
   z_SSHFormatDSA.get_publicc           	      C   sJ   |  |\\}}}}}t|||}t||}| | | }||fS )zMake DSA public key from data.)r   r   DSAParameterNumbersDSAPublicNumbers	_validater%   )	r\   r,   r   r   r   r   parameter_numbersr   r%   r   r   r   r   6  s   
z_SSHFormatDSA.load_publicc                 C   sz   |  |\\}}}}}t|\}}||||f|krtdt|||}t||}	| |	 t||	}
|
 }||fS )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r   rR   r)   r   r   r   r   DSAPrivateNumbersr   )r\   r,   r   r   r   r   r   xr   r   r   r   r   r   r   r   A  s   
z_SSHFormatDSA.load_privater%   r   Nc                 C   sL   |  }|j}| | ||j ||j ||j ||j dS )zWrite DSA public keyN)r   r   r   rk   r   r   r   r   )r\   r%   r   r   r   r   r   r   r   Q  s   
z_SSHFormatDSA.encode_publicr   r   c                 C   s$   |  | | || j dS )zWrite DSA private keyN)r   r%   rk   r   r   )r\   r   r   r   r   r   r   ^  s   z_SSHFormatDSA.encode_privater   c                 C   s    |j }|j dkrtdd S )Ni   z#SSH supports only 1024 bit DSA keys)r   r   rS   r)   )r\   r   r   r   r   r   r   e  s   z_SSHFormatDSA._validate)rv   rw   rx   ry   rg   rz   r   r   r   DSAPublicKeyr   DSAPrivateKeyr   rW   r   r   r   r   r   r   r   r   r   #  s@    





r   c                   @   s   e Zd ZdZdedejfddZdede	j
e	j
ef fdd	Zdede	j
ejef fd
dZdede	j
ejef fddZdejdeddfddZdejdeddfddZdS )_SSHFormatECDSAzFormat for ECDSA keys.

    Public:
        str curve
        bytes point
    Private:
        str curve
        bytes point
        mpint secret
    ssh_curve_namer&   c                 C   s   || _ || _d S rZ   )r   r&   )r\   r   r&   r   r   r   r]   w  s   
z_SSHFormatECDSA.__init__r,   r   c                 C   sJ   t |\}}t |\}}|| jkrtd|d dkrtd||f|fS )zECDSA public fieldszCurve name mismatchr   rA   zNeed uncompressed point)rO   r   r)   NotImplementedError)r\   r,   r&   pointr   r   r   r   {  s   
z_SSHFormatECDSA.get_publicc                 C   s.   |  |\\}}}tj| j| }||fS )z Make ECDSA public key from data.)r   r   EllipticCurvePublicKeyfrom_encoded_pointr&   rt   )r\   r,   
curve_namer   r%   r   r   r   r     s
   
z_SSHFormatECDSA.load_publicc                 C   sH   |  |\\}}}t|\}}||f|krtdt|| j}||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r   rR   r)   r   derive_private_keyr&   )r\   r,   r   r   r   secretr   r   r   r   r     s   z_SSHFormatECDSA.load_privater%   r   Nc                 C   s*   | tjtj}|| j || dS )zWrite ECDSA public keyN)public_bytesr   X962r   UncompressedPointrj   r   )r\   r%   r   r   r   r   r   r     s
   z_SSHFormatECDSA.encode_publicr   r   c                 C   s,   |  }| }| || ||j dS )zWrite ECDSA private keyN)r%   r   r   rk   private_value)r\   r   r   r%   r   r   r   r   r     s   z_SSHFormatECDSA.encode_private)rv   rw   rx   ry   rf   r   EllipticCurver]   rg   rz   r   r   r   r   EllipticCurvePrivateKeyr   rW   r   r   r   r   r   r   r   k  s@    





r   c                   @   s   e Zd ZdZdedejejef fddZdedejej	ef fddZ
dedejejef fdd	Zd
ej	deddfddZdejdeddfddZdS )_SSHFormatEd25519z~Format for Ed25519 keys.

    Public:
        bytes point
    Private:
        bytes point
        bytes secret_and_point
    r,   r   c                 C   s   t |\}}|f|fS )zEd25519 public fields)rO   )r\   r,   r   r   r   r   r     s   
z_SSHFormatEd25519.get_publicc                 C   s(   |  |\\}}tj| }||fS )z"Make Ed25519 public key from data.)r   r   Ed25519PublicKeyfrom_public_bytesrt   )r\   r,   r   r%   r   r   r   r     s
   z_SSHFormatEd25519.load_publicc                 C   sb   |  |\\}}t|\}}|dd }|dd }||ks#|f|kr'tdtj|}||fS )z#Make Ed25519 private key from data.Nr    z$Corrupt data: ed25519 field mismatch)r   rO   r)   r   Ed25519PrivateKeyfrom_private_bytes)r\   r,   r   r   keypairr   point2r   r   r   r   r     s   z_SSHFormatEd25519.load_privater%   r   Nc                 C   s   | tjtj}|| dS )zWrite Ed25519 public keyN)r   r   Rawr   rj   )r\   r%   r   raw_public_keyr   r   r   r     s   z_SSHFormatEd25519.encode_publicr   r   c                 C   sR   |  }|tjtjt }|tjtj}t||g}| 	|| |
| dS )zWrite Ed25519 private keyN)r%   private_bytesr   r   r   r   r   r   rW   r   rj   )r\   r   r   r%   raw_private_keyr   	f_keypairr   r   r   r     s   z _SSHFormatEd25519.encode_private)rv   rw   rx   ry   rg   rz   r   r   r   r   r   r   r   rW   r   r   r   r   r   r   r     s>    	




	r   s   nistp256s   nistp384s   nistp521key_typec                 C   s4   t | tst|  } | tv rt|  S td| )z"Return valid format or throw errorzUnsupported key type: )re   rf   rg   rt   _KEY_FORMATSr   )r   r   r   r   _lookup_kformat  s
   
r   backendc                 C   sB  t d|  |durt d| t| }|std|d}|d}t	t
| || } | ts9tdt
| ttd } t| \}} t| \}} t| \}} t| \}	} |	dkrctdt| \}
} t|
\}}
t|}||
\}}
t|
 t| \}} t|  ||fttfkr| }|tvrtd||tkrtd|t| d	 }t|| t|\}}t|\}}t| t||| |}t
| |}nd
}t|| t|\}}t|\}}||krtdt|\}}||krtd|||\}}t|\}}|tdt| krtd|S )z.Load private key from OpenSSH custom encoding.r,   Nr   zNot OpenSSH private key formatr   zOnly one key supportedzUnsupported cipher: zUnsupported KDF:    rL   zCorrupt data: broken checksumzCorrupt data: key type mismatchzCorrupt data: invalid padding)r   _check_byteslike_check_bytes_PEM_RCsearchr)   rr   endbinascii
a2b_base64rg   
startswith	_SK_MAGICr4   rO   rI   r   r   r7   _NONErt   r!   r   _BCRYPTr5   r>   	decryptorupdater   _PADDING)r,   r   r   mp1p2r8   kdfname
kdfoptionsnkeyspubdatapub_key_typekformatr   edataciphername_bytesblklenr   kbufr   ciphck1ck2r   r   commentr   r   r   load_ssh_private_key  sl   






r   r   c                 C   s4  |dur
t d| |rt|tkrtdt| tjr#t| 	 }nt| t
jr,t}nt| tjr5t}nt| tjr>t}ntdt|}t }|rnt}t| d }t}t}td}	||	 || t|||	|}
nt }}d}d}
d}td	}d
}t }|| || 	 | t||g}|| | | | || |!t"d||# |    t }|!t$ || || || || || || |# }|# }t%t&|| }|'| || }|
dur|
( )||| ||d  t*|d| }t&||||< |S )z3Serialize private key with OpenSSH custom encoding.Nr   zNPasswords longer than 72 bytes are not supported by OpenSSH private key formatUnsupported key typer   r   rL   r   rA   r/   )+r   r   r4   _MAX_PASSWORDr)   re   r   r   r*   r%   r	   r   _SSH_RSAr   r   _SSH_DSAr   r   _SSH_ED25519r   rW   _DEFAULT_CIPHERr!   r   _DEFAULT_ROUNDSosurandomrj   rd   r>   r   r   r   r`   r   ri   r   rg   rh   rs   	encryptorupdate_intor2   )r   r   r   r   f_kdfoptionsr8   r   r   r   r   r   r   checkvalr   f_public_key	f_secretsf_mainslenmlenru   ofstxtr   r   r   serialize_ssh_private_key]  st   















 r   c              	   C   sp  t d|  t| }|std|d }}|d}d}t|tt d kr5d}|dtt  }t|}z	t	t
|}W n tt
jfyP   tdw t|\}	}|	|kr_td|rgt|\}
}||\}}|rt|\}}t|\}}t|\}}t|\}}t|\}}t|\}}t|\}}t|\}}t|\}}t|\}}t|\}}t| |S )	z-Load public key from OpenSSH one-line format.r,   zInvalid line formatr      FNTzInvalid key format)r   r   _SSH_PUBKEY_RCmatchr)   group_CERT_SUFFIXr4   r   rg   r   r   	TypeErrorErrorrO   r   rM   rI   r7   )r,   r   r   r   orig_key_typekey_body	with_certr   restinner_key_typenoncer%   serialcctypekey_id
principalsvalid_aftervalid_beforecrit_options
extensionsreservedsig_key	signaturer   r   r   load_ssh_public_key  sH   

r  c                 C   s   t | tjrt| }nt | tjrt}nt | tjrt	}nt | t
jr&t}ntdt|}t }|| || | t|  }d|d|gS )z&One-line public key format for OpenSSHr   r/       )re   r   r   r*   r	   r   r   r   r   r   r   r   r   r)   r   rW   rj   r   r   
b2a_base64rt   stripr0   )r%   r   r   r   pubr   r   r   serialize_ssh_public_key  s   

r  )FrZ   )fr   r   rerz   base64r   r1   cryptographyr   cryptography.exceptionsr   )cryptography.hazmat.primitives.asymmetricr   r   r   r	   &cryptography.hazmat.primitives.ciphersr
   r   r   ,cryptography.hazmat.primitives.serializationr   r   r   r   bcryptr   r   _bcrypt_supportedImportErrorrf   rG   boolr   r   r   _ECDSA_NISTP256_ECDSA_NISTP384_ECDSA_NISTP521r   compiler   r   	_SK_START_SK_ENDr   r   r   r   r   DOTALLr   rg   rh   ranger   AESCTRCBCr!   Dictr   Typer}   r|   r(   r   r*   r2   r5   r7   Optionalr>   rI   rM   rO   rR   rV   rW   r~   r   r   r   	SECP256R1	SECP384R1	SECP521R1r   r   r   r   r   r   _SSH_PRIVATE_KEY_TYPESAnyr   r   r   r   r   _SSH_PUBLIC_KEY_TYPESr  r  r   r   r   r   <module>   s,  





2FHGD
	
O
Q	
,