U ڲg@sUddlmZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl mZddlmZddlmZddlmZmZmZmZmZddlmZdd lmZmZmZmZdd lm Z m!Z!m"Z"m#Z#m$Z$m%Z%zdd l&m'Z(d Z)Wn4e*k r"d Z)ddddddddddZ(YnXdZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3dZ4dZ5e6dZ7d Z8d!Z9d"Z:d#Z;d$Ze6e9d'e:ej?Z@eAeBeCd(d)ZDe Gd*d+d+ZEeEejFd,ejGd&d&dd d-eEejFd,ejHd&d&dd d-eEejFd,ejId&d.d&d d-d/ZJd0eKd1<e.e/e0d2ZLd3dd4d5d6ZMd7dd8d9d:ZNe9d;e:d;fddddd<d=d>ZOddd?d@dAdBZPdd?dCdDdEZQddFdddGdHdIdJZRdKdLdCdMdNZSdKdLdCdOdPZTdKdQdCdRdSZUdKdLdCdTdUZVdddVdWdXZWGdYdZdZZXGd[d\d\ZYGd]d^d^ZZGd_d`d`Z[GdadbdbZ\dQdcdddeZ]GdfdgdgZ^GdhdidiZ_e,eYe-eZe+e\e.e[dje`e/e[dkeae0e[dlebe2e^e3e_iZcddmdndoZdejeejfejgejhejifZjdddFdpdqdrdsdtZkdqdduddvdwdxZlejeejmejnejoejpfZqejeejmejnejpfZrGdydzdzejsZtGd{d|d|Zud}d~dddZvddddCddZwdddCddZxdKddddZydddpddddZzddd8ddZ{ejeejfejgejifZ|dZ}GdddZ~dS)) annotationsN) encodebytes) dataclass)utilsUnsupportedAlgorithm)hashes)dsaeced25519paddingrsa)AEADDecryptionContextCipher algorithmsmodes)EncodingKeySerializationEncryption NoEncryption PrivateFormat PublicFormat_KeySerializationEncryption)kdfTFbytesintbool)passwordsaltdesired_key_bytesroundsignore_few_roundsreturncCs tddS)NzNeed bcrypt moduler)rrrrr r"T/tmp/pip-unpacked-wheel-orgc96xl/cryptography/hazmat/primitives/serialization/ssh.py _bcrypt_kdf1sr$s ssh-ed25519sssh-rsasssh-dsssecdsa-sha2-nistp256secdsa-sha2-nistp384secdsa-sha2-nistp521s-cert-v01@openssh.comssk-ssh-ed25519@openssh.coms"sk-ecdsa-sha2-nistp256@openssh.coms rsa-sha2-256s rsa-sha2-512s\A(\S+)[ \t]+(\S+)sopenssh-key-v1s#-----BEGIN OPENSSH PRIVATE KEY-----s!-----END OPENSSH PRIVATE KEY-----sbcryptsnone aes256-ctrs(.*?)c@sFeZdZUded<ded<ded<ded<ded<d ed <d ed <d S) _SSHCipherztype[algorithms.AES]algrkey_lenz3type[modes.CTR] | type[modes.CBC] | type[modes.GCM]mode block_leniv_len int | Nonetag_lenris_aeadN)__name__ __module__ __qualname____annotations__r"r"r"r#r)\s r) )r*r+r,r-r.r0r1 )r%s aes256-cbcsaes256-gcm@openssh.comzdict[bytes, _SSHCipher] _SSH_CIPHERS)Z secp256r1Z secp384r1Z secp521r1z&SSHPrivateKeyTypes | SSHPublicKeyTypes)keyr!cCst|tjrt|}nft|tjr0t|}nPt|tjtjfrHt }n8t|t j t j fr`t }n t|tjtjfrxt}ntd|S)NUnsupported key type) isinstancer EllipticCurvePrivateKey_ecdsa_key_type public_keyEllipticCurvePublicKeyr RSAPrivateKey RSAPublicKey_SSH_RSAr DSAPrivateKey DSAPublicKey_SSH_DSAr Ed25519PrivateKeyEd25519PublicKey _SSH_ED25519 ValueError)r9key_typer"r"r#_get_ssh_key_types    rKec.EllipticCurvePublicKeyr>r!cCs*|j}|jtkr td|jt|jS)z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPErI)r>rNr"r"r#r=s   r= )dataprefixsuffixr!cCsd|t||gS)N)join_base64_encode)rRrSrTr"r"r#_ssh_pem_encodesrXNone)rRr-r!cCs |rt||dkrtddS)zRequire data to be full blocksrzCorrupt data: missing paddingN)lenrI)rRr-r"r"r#_check_block_sizesr[rRr!cCs|r tddS)z!All data should have been parsed.zCorrupt data: unparsed dataN)rIrRr"r"r# _check_emptysr^ bytes | Nonez)Cipher[modes.CBC | modes.CTR | modes.GCM]) ciphernamerrrr!cCsV|s tdt|}t|||j|j|d}t||d|j|||jdS)z$Generate key + iv and return cipher.zKey is password-protected.TN)rIr8r$r+r.rr*r,)r`rrrciphseedr"r"r# _init_ciphers rc memoryviewztuple[int, memoryview]cCs6t|dkrtdtj|dddd|ddfS)ZUint32 Invalid dataNbig byteorderrZrIr from_bytesr]r"r"r#_get_u32s rlcCs6t|dkrtdtj|dddd|ddfS)ZUint64rfNrgrhrjr]r"r"r#_get_u64s rnztuple[memoryview, memoryview]cCs8t|\}}|t|kr td|d|||dfS)zBytes with u32 length prefixrfN)rlrZrI)rRnr"r"r# _get_sshstrs  rpcCs4t|\}}|r$|ddkr$tdt|d|fS)z Big integer.rrfrg)rprIrrk)rRvalr"r"r# _get_mpints rsrrr!cCs4|dkrtd|sdS|dd}t||S)z!Storage format for signed bigint.rznegative mpint not allowedrUrm)rI bit_lengthrZ int_to_bytes)rrnbytesr"r"r# _to_mpints rwc@seZdZUdZded<d"ddddd Zd dd d d Zddd ddZddd ddZddd ddZ ddd ddZ ddddZ d#ddddddZ d dd d!Z dS)$ _FragListz,Build recursive structure without data copy. list[bytes]flistNzlist[bytes] | NonerY)initr!cCsg|_|r|j|dSN)rzextend)selfr{r"r"r#__init__sz_FragList.__init__rrtcCs|j|dS)zAdd plain bytesN)rzappendr~rrr"r"r#put_rawsz_FragList.put_rawrcCs|j|jddddS)zBig-endian uint32rerglengthriNrzrto_bytesrr"r"r#put_u32 sz_FragList.put_u32cCs|j|jddddS)zBig-endian uint64rmrgrNrrr"r"r#put_u64 sz_FragList.put_u64zbytes | _FragListcCsLt|tttfr,|t||j|n|||j |jdS)zBytes prefixed with u32 lengthN) r;rrd bytearrayrrZrzrsizer}rr"r"r# put_sshstrs z_FragList.put_sshstrcCs|t|dS)z*Big-endian bigint prefixed with u32 lengthN)rrwrr"r"r# put_mpintsz_FragList.put_mpintr!cCsttt|jS)zCurrent number of bytes)summaprZrzr~r"r"r#rsz_FragList.sizerrd)dstbufposr!cCs2|jD]&}t|}|||}}||||<q|S)zWrite into bytearray)rzrZ)r~rrfragZflenstartr"r"r#render"s  z_FragList.rendercCs"tt|}|||S)zReturn as bytes)rdrrrtobytes)r~bufr"r"r#r*s z_FragList.tobytes)N)r)r2r3r4__doc__r5rrrrrrrrrr"r"r"r#rxs  rxc@sdeZdZdZdddddZddddd Zdd dd d Zd dddddZddddddZdS) _SSHFormatRSAzhFormat for RSA keys. Public: mpint e, n Private: mpint n, e, d, iqmp, p, q rdz"tuple[tuple[int, int], memoryview]r\cCs$t|\}}t|\}}||f|fS)zRSA public fieldsrs)r~rReror"r"r# get_public:s  z_SSHFormatRSA.get_publicz#tuple[rsa.RSAPublicKey, memoryview]cCs.||\\}}}t||}|}||fS)zMake RSA public key from data.)rr RSAPublicNumbersr>)r~rRrropublic_numbersr>r"r"r# load_publicBs z_SSHFormatRSA.load_publicz$tuple[rsa.RSAPrivateKey, memoryview]c Cst|\}}t|\}}t|\}}t|\}}t|\}}t|\}}||f|kr\tdt||} t||} t||} t|||| | || } | } | |fS)zMake RSA private key from data.z Corrupt data: rsa field mismatch)rsrIr Z rsa_crt_dmp1Z rsa_crt_dmq1rZRSAPrivateNumbers private_key)r~rR pubfieldsrordiqmppqZdmp1Zdmq1rprivate_numbersrr"r"r# load_privateKs,          z_SSHFormatRSA.load_privatezrsa.RSAPublicKeyrxrYr>f_pubr!cCs$|}||j||jdS)zWrite RSA public keyN)rrrro)r~r>rZpubnr"r"r# encode_publicas z_SSHFormatRSA.encode_publiczrsa.RSAPrivateKeyrf_privr!cCsZ|}|j}||j||j||j||j||j||jdS)zWrite RSA private keyN) rrrrorrrrr)r~rrrrr"r"r#encode_privateis     z_SSHFormatRSA.encode_privateN r2r3r4rrrrrrr"r"r"r#r1s  rc@steZdZdZdddddZddddd Zdd dd d Zd dddddZddddddZdddddZ dS) _SSHFormatDSAzhFormat for DSA keys. Public: mpint p, q, g, y Private: mpint p, q, g, y, x rdztuple[tuple, memoryview]r\cCs@t|\}}t|\}}t|\}}t|\}}||||f|fS)zDSA public fieldsr)r~rRrrgyr"r"r#rs     z_SSHFormatDSA.get_publicz#tuple[dsa.DSAPublicKey, memoryview]c CsJ||\\}}}}}t|||}t||}|||}||fS)zMake DSA public key from data.)rr DSAParameterNumbersDSAPublicNumbers _validater>) r~rRrrrrparameter_numbersrr>r"r"r#rs   z_SSHFormatDSA.load_publicz$tuple[dsa.DSAPrivateKey, memoryview]c Csz||\\}}}}}t|\}}||||f|kr:tdt|||}t||} || t|| } | } | |fS)zMake DSA private key from data.z Corrupt data: dsa field mismatch) rrsrIr rrrZDSAPrivateNumbersr) r~rRrrrrrxrrrrr"r"r#rs    z_SSHFormatDSA.load_privatezdsa.DSAPublicKeyrxrYrcCsL|}|j}||||j||j||j||jdS)zWrite DSA public keyN)rrrrrrrr)r~r>rrrr"r"r#rs    z_SSHFormatDSA.encode_publiczdsa.DSAPrivateKeyrcCs$|||||jdS)zWrite DSA private keyN)rr>rrr)r~rrr"r"r#rsz_SSHFormatDSA.encode_privatezdsa.DSAPublicNumbers)rr!cCs |j}|jdkrtddS)Niz#SSH supports only 1024 bit DSA keys)rrrurI)r~rrr"r"r#rsz_SSHFormatDSA._validateN) r2r3r4rrrrrrrr"r"r"r#rys  rc@steZdZdZdddddZddd d d Zdd d d dZddd ddZddddddZddddddZ dS)_SSHFormatECDSAzFormat for ECDSA keys. Public: str curve bytes point Private: str curve bytes point mpint secret rec.EllipticCurvessh_curve_namerNcCs||_||_dSr|r)r~rrNr"r"r#rsz_SSHFormatECDSA.__init__rdz0tuple[tuple[memoryview, memoryview], memoryview]r\cCsJt|\}}t|\}}||jkr*td|ddkr>td||f|fS)zECDSA public fieldszCurve name mismatchrrezNeed uncompressed point)rprrINotImplementedError)r~rRrNpointr"r"r#rs    z_SSHFormatECDSA.get_public,tuple[ec.EllipticCurvePublicKey, memoryview]cCs.||\\}}}tj|j|}||fSz Make ECDSA public key from data.)rr r?Zfrom_encoded_pointrNr)r~rR_rr>r"r"r#rs z_SSHFormatECDSA.load_publicz-tuple[ec.EllipticCurvePrivateKey, memoryview]cCsH||\\}}}t|\}}||f|kr2tdt||j}||fS)z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)rrsrIr Zderive_private_keyrN)r~rRrZ curve_namersecretrr"r"r#rs   z_SSHFormatECDSA.load_privaterLrxrYrcCs*|tjtj}||j||dS)zWrite ECDSA public keyN) public_bytesrZX962rZUncompressedPointrr)r~r>rrr"r"r#rs  z_SSHFormatECDSA.encode_publiczec.EllipticCurvePrivateKeyrcCs,|}|}|||||jdS)zWrite ECDSA private keyN)r>rrrZ private_value)r~rrr>rr"r"r#rs z_SSHFormatECDSA.encode_privateN) r2r3r4rrrrrrrr"r"r"r#rs     rc@sdeZdZdZdddddZddddd Zdd dd d Zd dddddZddddddZdS)_SSHFormatEd25519z~Format for Ed25519 keys. Public: bytes point Private: bytes point bytes secret_and_point rdz$tuple[tuple[memoryview], memoryview]r\cCst|\}}|f|fS)zEd25519 public fields)rp)r~rRrr"r"r#rs z_SSHFormatEd25519.get_public+tuple[ed25519.Ed25519PublicKey, memoryview]cCs(||\\}}tj|}||fSz"Make Ed25519 public key from data.)rr rGZfrom_public_bytesr)r~rRrr>r"r"r#rs z_SSHFormatEd25519.load_publicz,tuple[ed25519.Ed25519PrivateKey, memoryview]cCsb||\\}}t|\}}|dd}|dd}||ksF|f|krNtdtj|}||fS)z#Make Ed25519 private key from data.Nr6z$Corrupt data: ed25519 field mismatch)rrprIr rFZfrom_private_bytes)r~rRrrZkeypairrZpoint2rr"r"r#r!s    z_SSHFormatEd25519.load_privatezed25519.Ed25519PublicKeyrxrYrcCs|tjtj}||dS)zWrite Ed25519 public keyN)rrRawrr)r~r>rraw_public_keyr"r"r#r/s z_SSHFormatEd25519.encode_publiczed25519.Ed25519PrivateKeyrcCsR|}|tjtjt}|tjtj}t||g}| ||| |dS)zWrite Ed25519 private keyN) r>Z private_bytesrrrrrrrxrr)r~rrr>Zraw_private_keyrZ f_keypairr"r"r#r8s  z _SSHFormatEd25519.encode_privateNrr"r"r"r#rs    rrcCs2t|\}}|ds*td|d||fS)z! U2F application strings sssh:z4U2F application string does not start with b'ssh:' ())rpr startswithrI)rRZ applicationr"r"r#load_applicationIs   rc@s eZdZdZdddddZdS)_SSHFormatSKEd25519z The format of a sk-ssh-ed25519@openssh.com public key is: string "sk-ssh-ed25519@openssh.com" string public key string application (user-specified, but typically "ssh:") rdrr\cCs&tt|\}}t|\}}||fSr)_lookup_kformatrHrrr~rRr>rr"r"r#r_s z_SSHFormatSKEd25519.load_publicNr2r3r4rrr"r"r"r#rVsrc@s eZdZdZdddddZdS)_SSHFormatSKECDSAz The format of a sk-ecdsa-sha2-nistp256@openssh.com public key is: string "sk-ecdsa-sha2-nistp256@openssh.com" string curve name ec_point Q string application (user-specified, but typically "ssh:") rdrr\cCs&tt|\}}t|\}}||fSr)r_ECDSA_NISTP256rrrr"r"r#rrs z_SSHFormatSKECDSA.load_publicNrr"r"r"r#rhs rsnistp256snistp384snistp521rJcCs8t|tst|}|tkr&t|Std|dS)z"Return valid format or throw errorzUnsupported key type: N)r;rrdr _KEY_FORMATSrrr"r"r#rs   rz typing.AnySSHPrivateKeyTypes)rRrbackendr!cCstd||dk r td|t|}|s6td|d}|d}t t |||}| t srtdt |t t d}t|\}}t|\}}t|\}}t|\} }| dkrtdt|\} }t| \} } t| } | | \} } t| ||fttfkr&|}|tkr.td||tkrFtd|t|j}t|j}t|\}}t|jrt|}t ||krtd nt|t||t|\}}t|\}}t|t||||}|}t ||}t|jrt |t!st"t|#|n t|$n"t|\}}t|d }t||t|\}}t|\}}||krrtd t|\}}|| krtd | %|| \}}t|\}}|t&dt |krtd t |t'j(rt)j*dtj+dd|S)z.Load private key from OpenSSH custom encoding.rRNrzNot OpenSSH private key formatr'zOnly one key supportedzUnsupported cipher: zUnsupported KDF: z+Corrupt data: invalid tag length for cipherrmzCorrupt data: broken checksumzCorrupt data: key type mismatchzCorrupt data: invalid paddingDSSH DSA keys are deprecated and will be removed in a future release. stacklevel),r_check_byteslike _check_bytes_PEM_RCsearchrIrendbinascii a2b_base64rdr _SK_MAGICrZrprlrrr^_NONErr8r_BCRYPTr-r0r1rr[rcZ decryptorupdater;rAssertionErrorZfinalize_with_tagfinalizer_PADDINGr rCwarningswarnDeprecatedIn40)rRrrmp1p2r`kdfnameZ kdfoptionsnkeysZpubdataZ pub_key_typekformatrZciphername_bytesblklenr0ZedatatagrZkbufrradecZck1Zck2rJrrr"r"r#load_ssh_private_keys                               rr)rrencryption_algorithmr!cCstd|t|tjr*tjdtjddt|}t |}t }|rt }t |j }t}t} t|trt|jdk rt|j} td} || || t||| | } nt}}d}d} d} td} d }t }|||||t | | g}||||||||td|||t }|t|||||||| |||||}|}tt ||}|!|||}| dk r| "#|||||dt$|d|S) z3Serialize private key with OpenSSH custom encoding.rISSH DSA key support is deprecated and will be removed in a future releasererNr&rmr'rU)%rrr;r rCrrrrKrrx_DEFAULT_CIPHERr8r-r_DEFAULT_ROUNDSrZ _kdf_roundsosurandomrrrcrrr>rrrrrrdrrZ encryptorZ update_intorX)rrrrJrZ f_kdfoptionsr`rrrrrarZcheckvalcommentZ f_public_keyZ f_secretsZf_mainslenmlenrZofsr"r"r#_serialize_ssh_private_keysl                      rc@seZdZdZdZdS)SSHCertificateTyper'rN)r2r3r4USERZHOSTr"r"r"r#r[src@seZdZdddddddddddddddddddd Zedd d d Zd d ddZedd ddZedd ddZedd ddZ edd ddZ edd ddZ edd ddZ edd ddZ edd dd Zd d d!d"Zdd d#d$Zd%d d&d'Zd(S))SSHCertificaterdSSHPublicKeyTypesrrydict[bytes, bytes]r)_nonce _public_key_serial_cctype_key_id_valid_principals _valid_after _valid_before_critical_options _extensions _sig_type_sig_key_inner_sig_type _signature_tbs_cert_body_cert_key_type _cert_bodycCs||_||_||_zt||_Wntk r<tdYnX||_||_||_||_ | |_ | |_ | |_ | |_ | |_||_||_||_||_dS)NzInvalid certificate type)rrrr_typerIrrrr r r r r rrrrr)r~rrrrrrrr r r r r rrrrrr"r"r#ras(zSSHCertificate.__init__rcCs t|jSr|)rrrr"r"r#nonceszSSHCertificate.nonceSSHCertPublicKeyTypescCstt|jSr|)typingcastrrrr"r"r#r>szSSHCertificate.public_keycCs|jSr|)rrr"r"r#serialszSSHCertificate.serialrcCs|jSr|)rrr"r"r#typeszSSHCertificate.typecCs t|jSr|)rrrr"r"r#key_idszSSHCertificate.key_idcCs|jSr|)rrr"r"r#valid_principalsszSSHCertificate.valid_principalscCs|jSr|)r rr"r"r# valid_beforeszSSHCertificate.valid_beforecCs|jSr|)rrr"r"r# valid_afterszSSHCertificate.valid_aftercCs|jSr|)r rr"r"r#critical_optionsszSSHCertificate.critical_optionscCs|jSr|)r rr"r"r# extensionsszSSHCertificate.extensionscCs&t|j}||j\}}t||Sr|)rr rr r^)r~Z sigformat signature_keyZ sigkey_restr"r"r#r s zSSHCertificate.signature_keycCs"t|jdtjt|jddS)N F)newline)rrr b2a_base64rrr"r"r#rs zSSHCertificate.public_bytesrYcCs|}t|tjr.|t|jt|jnt|tj rt |j\}}t |\}}t |t ||}t|j}||t|jt|nnt|tjst|jtkrt}n*|jtkrt}n|jtkstt}|t|jt|jt|dSr|)r r;r rGverifyrrrr r?rsr^ asym_utilsZencode_dss_signature_get_ec_hash_algrNECDSAr rArrrBrSHA1_SSH_RSA_SHA256SHA256_SSH_RSA_SHA512SHA512r PKCS1v15)r~r rrRsZ computed_sighash_algr"r"r#verify_cert_signatures<         z$SSHCertificate.verify_cert_signatureN)r2r3r4rpropertyrr>rrrrrrrrr rr1r"r"r"r#r`s..)rrzhashes.HashAlgorithm)rNr!cCsDt|tjrtSt|tjr(tSt|tjs8tt SdSr|) r;r SECP256R1rr* SECP384R1SHA384 SECP521R1rr,)rNr"r"r#r&s   r&z"SSHCertificate | SSHPublicKeyTypesc"Cstd|t|}|s"td|d}}|d}d}|tr^d}|dtt }|t krr|srt dt |}zt t |}Wn"tt jfk rtdYnX|r|} t|\} }| |krtd |rt|\} }||\} }|rpt|\} }t|\}}t|\}}t|\}}g}|rPt|\}}|t|q,t|\}}t|\}}t|\}}t|}t|\}}t|}t|\}}t|\}}t|\}}|t kr|st d | dt| }t|\}}t|t|\}} |tkr|tttfks,|tkr4||kr4td t| \}!} t| t| | | |||||||||||!||| St|| SdS) NrRzInvalid line formatr'rFTz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)rr_SSH_PUBKEY_RCmatchrIgroupendswith _CERT_SUFFIXrZrErrrdrr TypeErrorErrorrprrnrlrr_parse_exts_optsr^rBr)r+r)"rR_legacy_dsa_allowedrrJZ orig_key_typeZkey_bodyZ with_certrrestZ cert_bodyZinner_key_typerr>rZcctyperZ principalsrZ principalrrZ crit_optionsrextsrrZ sig_key_rawZsig_typeZsig_keyZ tbs_cert_bodyZ signature_rawZinner_sig_typeZsig_rest signaturer"r"r#_load_ssh_public_identitys                      rCcCst|Sr|)rCr]r"r"r#load_ssh_public_identityJsrDr) exts_optsr!cCsi}d}|rt|\}}t|}||kr0td|dk rH||krHtdt|\}}t|dkrt|\}}t|dkrtdt|||<|}q|S)NzDuplicate namezFields not lexically sortedrz!Unexpected extra data after value)rprrIrZ)rEresult last_namerOZbnamevalueextrar"r"r#r>Ps"      r>r)rRrr!cCsFt|dd}t|tr |}n|}t|tjrBtjdtj dd|S)NT)r?rrr) rCr;rr>r rDrrrr)rRrZ cert_or_keyr>r"r"r#load_ssh_public_keyds    rJcCslt|tjrtjdtjddt|}t|}t }| || ||t |}d|d|gS)z&One-line public key format for OpenSSHrrerrUr!)r;r rDrrrrrKrrxrrrr#rstriprV)r>rJrrZpubr"r"r#serialize_ssh_public_keyxs   rLc @seZdZddddgdddggf ddddddddd d d d d Zd ddddZdddddZdddddZdddddZdddddZd d!Z d"dd#d$d%Z d"dd&d'd(Z dddd)d*d+Z dddd)d,d-Z d.d/d0d1d2ZdS)3SSHCertificateBuilderNFzSSHCertPublicKeyTypes | Noner/zSSHCertificateType | Noner_ryrzlist[tuple[bytes, bytes]] rrrrr_valid_for_all_principalsr rr r c Cs@||_||_||_||_||_||_||_||_| |_| |_ dSr|rO) r~rrrrrrPr rr r r"r"r#rs zSSHCertificateBuilder.__init__rrMc Cs^t|tjtjtjfstd|jdk r0t dt ||j |j |j |j|j|j|j|j|jd S)Nr:zpublic_key already setrO)r;r r?r rAr rGr<rrIrNrrrrrPr rr r )r~r>r"r"r#r>s, z SSHCertificateBuilder.public_keyr)rr!c Cspt|tstdd|kr&dks0ntd|jdk rBtdt|j||j|j|j |j |j |j |j |jd S)Nzserial must be an integerrz"serial must be between 0 and 2**64zserial already setrO)r;rr<rIrrNrrrrrPr rr r )r~rr"r"r#rs$  zSSHCertificateBuilder.serialr)rr!c CsRt|tstd|jdk r$tdt|j|j||j|j |j |j |j |j |jd S)Nz"type must be an SSHCertificateTypeztype already setrO)r;rr<rrIrNrrrrrPr rr r )r~rr"r"r#rs   zSSHCertificateBuilder.typer)rr!c CsRt|tstd|jdk r$tdt|j|j|j||j |j |j |j |j |jd S)Nzkey_id must be byteszkey_id already setrO)r;rr<rrIrNrrrrrPr rr r )r~rr"r"r#rs   zSSHCertificateBuilder.key_id)rr!c Cs||jrtdtdd|Dr$|s,td|jr:tdt|tkrNtdt|j|j |j |j ||j|j |j |j|jd S)NzDPrincipals can't be set because the cert is valid for all principalscss|]}t|tVqdSr|)r;r).0rr"r"r# sz9SSHCertificateBuilder.valid_principals..z5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsrO)rPrIallr<rrZ_SSHKEY_CERT_MAX_PRINCIPALSrNrrrrr rr r )r~rr"r"r#rs: z&SSHCertificateBuilder.valid_principalsc CsJ|jrtd|jrtdt|j|j|j|j|jd|j|j |j |j d S)Nz@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTrO) rrIrPrNrrrrr rr r rr"r"r#valid_for_all_principals,s$z.SSHCertificateBuilder.valid_for_all_principalsz int | float)rr!c Csvt|ttfstdt|}|dks.|dkr6td|jdk rHtdt|j|j|j |j |j |j ||j |j|jd S)Nz$valid_before must be an int or floatrrQzvalid_before must [0, 2**64)zvalid_before already setrO)r;rfloatr<rIr rNrrrrrrPrr r )r~rr"r"r#rBs& z"SSHCertificateBuilder.valid_before)rr!c Csvt|ttfstdt|}|dks.|dkr6td|jdk rHtdt|j|j|j |j |j |j |j ||j|jd S)Nz#valid_after must be an int or floatrrQzvalid_after must [0, 2**64)zvalid_after already setrO)r;rrWr<rIrrNrrrrrrPr r r )r~rr"r"r#rXs& z!SSHCertificateBuilder.valid_after)rOrHr!c Csrt|trt|tstd|dd|jDkr8tdt|j|j|j|j |j |j |j |j |j||ff|jd S)Nname and value must be bytescSsg|] \}}|qSr"r"rRrOrr"r"r# tsz=SSHCertificateBuilder.add_critical_option..zDuplicate critical option namerO)r;rr<r rIrNrrrrrrPr rr r~rOrHr"r"r#add_critical_optionns z)SSHCertificateBuilder.add_critical_optionc Csrt|trt|tstd|dd|jDkr8tdt|j|j|j|j |j |j |j |j |j|j||ffd S)NrXcSsg|] \}}|qSr"r"rYr"r"r#rZsz7SSHCertificateBuilder.add_extension..zDuplicate extension namerO)r;rr<r rIrNrrrrrrPr rr r[r"r"r# add_extensions z#SSHCertificateBuilder.add_extensionSSHCertPrivateKeyTypesr)rr!c Cst|tjtjtjfstd|jdkr0t d|j dkr>dn|j }|j dkrVt d|j dkrddn|j }|j s~|js~t d|jdkrt d|jdkrt d|j|jkrt d |jjd d d |jjd d d t|j}|t}td}t|}t}||||||j|||||j j||t} |j D]} | | qT|| ||j||jt} |jD]L\} } | | t | dkrt}|| | |n | | q|| t}|jD]L\} } || t | dkr@t}|| ||n || q|||dt|}t|}t}||||!|||t|tjr|"|}t}||||||nt|tjrnt#|j$}|"|t%|}t&'|\}}t}||t}|(||(|||||nTt|tjst)t}|t*|"|t+,t-.}||||t/0|1}t23t4t5d6|d|gS)NzUnsupported private key typezpublic_key must be setrztype must be setrUzAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforecSs|dSNrr"rr"r"r#rUz,SSHCertificateBuilder.sign..)r9cSs|dSr_r"r`r"r"r#rarUr6r!)7r;r r<r r@r rFr<rrIrrrrrPr rr sortr rKr;rrrrxrrrrrHrrZr>signr&rNr'r%Zdecode_dss_signaturerrr+r r-rr,rr#rKrrrrDrV)r~rrrrJZ cert_prefixrrfZ fprincipalsrZfcritrOrHZfoptvalZfextZfextvalZca_typeZcaformatZcafrBZfsigr0r.r/ZfsigblobZ cert_datar"r"r#rcs                             zSSHCertificateBuilder.sign)r2r3r4rr>rrrrrVrrr\r]rcr"r"r"r#rNs,"$rN)F)N)F)N) __future__rrenumrrerrbase64rrWZ dataclassesrZ cryptographyrZcryptography.exceptionsrZcryptography.hazmat.primitivesrZ)cryptography.hazmat.primitives.asymmetricr r r r r r%Z&cryptography.hazmat.primitives.ciphersrrrrZ,cryptography.hazmat.primitives.serializationrrrrrrZbcryptrr$Z_bcrypt_supported ImportErrorrHrBrErZ_ECDSA_NISTP384Z_ECDSA_NISTP521r;Z_SK_SSH_ED25519Z_SK_SSH_ECDSA_NISTP256r)r+compiler7rZ _SK_STARTZ_SK_ENDrrrrDOTALLrrdrrangerr)ZAESZCTRZCBCZGCMr8r5rPrKr=rXr[r^rcrlrnrprsrwrxrrrrrrrr3r4r6rrUnionr<r@rCrFrrrr?rArDrGrrEnumrrr&rCrDr>rJrLr^rUrNr"r"r"r#s>                 6HFGC       hM _