a ϏPf@sUddlmZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl mZddlmZddlmZddlmZmZmZmZmZddlmZdd lmZmZmZmZdd lm Z m!Z!m"Z"m#Z#m$Z$m%Z%zdd l&m'Z(d Z)Wn2e*y d Z)ddddddddddZ(Yn0dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3e4dZ5dZ6dZ7d Z8d!Z9d"Z:d#Z;d$Ze?e@eAd&d'ZBe Gd(d)d)ZCeCejDd*ejEd$d$dd d+eCejDd*ejFd$d$dd d+eCejDd*ejGd$d,d$d d+d-ZHd.eId/<e.e/e0d0ZJd1dd2d3d4ZKd5dd6d7d8ZLe7d9e8d9fddddd:d;d<ZMddd=d>d?d@ZNdd=dAdBdCZOddDdddEdFdGdHZPdIdJdAdKdLZQdIdJdAdMdNZRdIdOdAdPdQZSdIdJdAdRdSZTdddTdUdVZUGdWdXdXZVGdYdZdZZWGd[d\d\ZXGd]d^d^ZYGd_d`d`ZZe,eWe-eXe+eZe.eYdae[e/eYdbe\e0eYdce]iZ^ddddedfZ_ej`ejaejbejcejdfZedddDdgdhdidjdkZfdhddlddmdndoZgej`ejhejiejjejkfZlej`ejhejiejkfZmGdpdqdqejnZoGdrdsdsZpdtdudvdwdxZqdddydAdzd{ZrddydAd|d}ZsdId~dddZtdddgddddZuddd6ddZvej`ejaejbejdfZwdZxGdddZydS)) annotationsN) encodebytes) dataclass)utilsUnsupportedAlgorithm)hashes)dsaeced25519paddingrsa)AEADDecryptionContextCipher algorithmsmodes)EncodingKeySerializationEncryption NoEncryption PrivateFormat PublicFormat_KeySerializationEncryption)kdfTFbytesintbool)passwordsaltdesired_key_bytesroundsignore_few_roundsreturncCs tddS)NzNeed bcrypt moduler)rrrrr r"q/var/www/html/python-backend/venv/lib/python3.9/site-packages/cryptography/hazmat/primitives/serialization/ssh.py _bcrypt_kdf1sr$s ssh-ed25519sssh-rsasssh-dsssecdsa-sha2-nistp256secdsa-sha2-nistp384secdsa-sha2-nistp521s-cert-v01@openssh.coms rsa-sha2-256s rsa-sha2-512s\A(\S+)[ \t]+(\S+)sopenssh-key-v1s#-----BEGIN OPENSSH PRIVATE KEY-----s!-----END OPENSSH PRIVATE KEY-----sbcryptsnone aes256-ctrs(.*?)c@sFeZdZUded<ded<ded<ded<ded<d ed <d ed <d S) _SSHCipherztype[algorithms.AES]algrkey_lenz3type[modes.CTR] | type[modes.CBC] | type[modes.GCM]mode block_leniv_len int | Nonetag_lenris_aeadN)__name__ __module__ __qualname____annotations__r"r"r"r#r)Xs r) )r*r+r,r-r.r0r1 )r%s aes256-cbcsaes256-gcm@openssh.comzdict[bytes, _SSHCipher] _SSH_CIPHERS)Z secp256r1Z secp384r1Z secp521r1z&SSHPrivateKeyTypes | SSHPublicKeyTypes)keyr!cCst|tjrt|}nft|tjr0t|}nPt|tjtjfrHt }n8t|t j t j fr`t }n t|tjtjfrxt}ntd|S)NUnsupported key type) isinstancer EllipticCurvePrivateKey_ecdsa_key_type public_keyEllipticCurvePublicKeyr RSAPrivateKey RSAPublicKey_SSH_RSAr DSAPrivateKey DSAPublicKey_SSH_DSAr Ed25519PrivateKeyEd25519PublicKey _SSH_ED25519 ValueError)r9key_typer"r"r#_get_ssh_key_types    rKec.EllipticCurvePublicKeyr>r!cCs*|j}|jtvr td|jt|jS)z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPErI)r>rNr"r"r#r=s   r= )dataprefixsuffixr!cCsd|t||gS)N)join_base64_encode)rRrSrTr"r"r#_ssh_pem_encodesrXNone)rRr-r!cCs |rt||dkrtddS)zRequire data to be full blocksrzCorrupt data: missing paddingN)lenrI)rRr-r"r"r#_check_block_sizesr[rRr!cCs|r tddS)z!All data should have been parsed.zCorrupt data: unparsed dataN)rIrRr"r"r# _check_emptysr^ bytes | Nonez)Cipher[modes.CBC | modes.CTR | modes.GCM]) ciphernamerrrr!cCsV|s tdt|}t|||j|j|d}t||d|j|||jdS)z$Generate key + iv and return cipher.zKey is password-protected.TN)rIr8r$r+r.rr*r,)r`rrrciphseedr"r"r# _init_ciphersrc memoryviewztuple[int, memoryview]cCs6t|dkrtdtj|dddd|ddfS)ZUint32 Invalid dataNbig byteorderrZrIr from_bytesr]r"r"r#_get_u32s rlcCs6t|dkrtdtj|dddd|ddfS)ZUint64rfNrgrhrjr]r"r"r#_get_u64s rnztuple[memoryview, memoryview]cCs8t|\}}|t|kr td|d|||dfS)zBytes with u32 length prefixrfN)rlrZrI)rRnr"r"r# _get_sshstrs  rpcCs4t|\}}|r$|ddkr$tdt|d|fS)z Big integer.rrfrg)rprIrrk)rRvalr"r"r# _get_mpints rsrrr!cCs4|dkrtd|sdS|dd}t||S)z!Storage format for signed bigint.rznegative mpint not allowedrUrm)rI bit_lengthrZ int_to_bytes)rrnbytesr"r"r# _to_mpints rwc@seZdZUdZded<d"ddddd Zd dd d d Zddd ddZddd ddZddd ddZ ddd ddZ ddddZ d#ddddddZ d dd d!Z dS)$ _FragListz,Build recursive structure without data copy. list[bytes]flistNzlist[bytes] | NonerY)initr!cCsg|_|r|j|dSN)rzextend)selfr{r"r"r#__init__sz_FragList.__init__rrtcCs|j|dS)zAdd plain bytesN)rzappendr~rrr"r"r#put_rawsz_FragList.put_rawrcCs|j|jddddS)zBig-endian uint32rerglengthriNrzrto_bytesrr"r"r#put_u32sz_FragList.put_u32cCs|j|jddddS)zBig-endian uint64rmrgrNrrr"r"r#put_u64 sz_FragList.put_u64zbytes | _FragListcCsLt|tttfr,|t||j|n|||j |jdS)zBytes prefixed with u32 lengthN) r;rrd bytearrayrrZrzrsizer}rr"r"r# put_sshstr s z_FragList.put_sshstrcCs|t|dS)z*Big-endian bigint prefixed with u32 lengthN)rrwrr"r"r# put_mpintsz_FragList.put_mpintr!cCsttt|jS)zCurrent number of bytes)summaprZrzr~r"r"r#rsz_FragList.sizerrd)dstbufposr!cCs2|jD]&}t|}|||}}||||<q|S)zWrite into bytearray)rzrZ)r~rrfragZflenstartr"r"r#renders  z_FragList.rendercCs"tt|}|||S)zReturn as bytes)rdrrrtobytes)r~bufr"r"r#r&s z_FragList.tobytes)N)r)r2r3r4__doc__r5rrrrrrrrrr"r"r"r#rxs  rxc@sbeZdZdZddddZddddd Zdd dd d Zd dddddZddddddZdS) _SSHFormatRSAzhFormat for RSA keys. Public: mpint e, n Private: mpint n, e, d, iqmp, p, q rdr]cCs$t|\}}t|\}}||f|fS)zRSA public fieldsrs)r~rReror"r"r# get_public6s  z_SSHFormatRSA.get_publicz#tuple[rsa.RSAPublicKey, memoryview]r\cCs.||\\}}}t||}|}||fS)zMake RSA public key from data.)rr RSAPublicNumbersr>)r~rRrropublic_numbersr>r"r"r# load_public<s z_SSHFormatRSA.load_publicz$tuple[rsa.RSAPrivateKey, memoryview]c Cst|\}}t|\}}t|\}}t|\}}t|\}}t|\}}||f|kr\tdt||} t||} t||} t|||| | || } | } | |fS)zMake RSA private key from data.z Corrupt data: rsa field mismatch)rsrIr Z rsa_crt_dmp1Z rsa_crt_dmq1rZRSAPrivateNumbers private_key)r~rR pubfieldsrordiqmppqZdmp1Zdmq1rprivate_numbersrr"r"r# load_privateEs           z_SSHFormatRSA.load_privatezrsa.RSAPublicKeyrxrYr>f_pubr!cCs$|}||j||jdS)zWrite RSA public keyN)rrrro)r~r>rZpubnr"r"r# encode_public[s z_SSHFormatRSA.encode_publiczrsa.RSAPrivateKeyrf_privr!cCsZ|}|j}||j||j||j||j||j||jdS)zWrite RSA private keyN) rrrrorrrrr)r~rrrrr"r"r#encode_privatecs     z_SSHFormatRSA.encode_privateN r2r3r4rrrrrrr"r"r"r#r-s  rc@steZdZdZdddddZddddd Zdd dd d Zd dddddZddddddZdddddZ dS) _SSHFormatDSAzhFormat for DSA keys. Public: mpint p, q, g, y Private: mpint p, q, g, y, x rdtuple[tuple, memoryview]r\cCs@t|\}}t|\}}t|\}}t|\}}||||f|fS)zDSA public fieldsr)r~rRrrgyr"r"r#r|s     z_SSHFormatDSA.get_publicz#tuple[dsa.DSAPublicKey, memoryview]c CsJ||\\}}}}}t|||}t||}|||}||fS)zMake DSA public key from data.)rr DSAParameterNumbersDSAPublicNumbers _validater>) r~rRrrrrparameter_numbersrr>r"r"r#rs   z_SSHFormatDSA.load_publicz$tuple[dsa.DSAPrivateKey, memoryview]c Csz||\\}}}}}t|\}}||||f|kr:tdt|||}t||} || t|| } | } | |fS)zMake DSA private key from data.z Corrupt data: dsa field mismatch) rrsrIr rrrZDSAPrivateNumbersr) r~rRrrrrrxrrrrr"r"r#rs    z_SSHFormatDSA.load_privatezdsa.DSAPublicKeyrxrYrcCsL|}|j}||||j||j||j||jdS)zWrite DSA public keyN)rrrrrrrr)r~r>rrrr"r"r#rs    z_SSHFormatDSA.encode_publiczdsa.DSAPrivateKeyrcCs$|||||jdS)zWrite DSA private keyN)rr>rrr)r~rrr"r"r#rsz_SSHFormatDSA.encode_privatezdsa.DSAPublicNumbers)rr!cCs |j}|jdkrtddS)Niz#SSH supports only 1024 bit DSA keys)rrrurI)r~rrr"r"r#rsz_SSHFormatDSA._validateN) r2r3r4rrrrrrrr"r"r"r#rss  rc@steZdZdZdddddZddd d d Zdd d d dZddd ddZddddddZddddddZ dS)_SSHFormatECDSAzFormat for ECDSA keys. Public: str curve bytes point Private: str curve bytes point mpint secret rec.EllipticCurvessh_curve_namerNcCs||_||_dSr|r)r~rrNr"r"r#rsz_SSHFormatECDSA.__init__rdrr\cCsJt|\}}t|\}}||jkr*td|ddkr>td||f|fS)zECDSA public fieldszCurve name mismatchrrezNeed uncompressed point)rprrINotImplementedError)r~rRrNpointr"r"r#rs    z_SSHFormatECDSA.get_publicz,tuple[ec.EllipticCurvePublicKey, memoryview]cCs.||\\}}}tj|j|}||fS)z Make ECDSA public key from data.)rr r?Zfrom_encoded_pointrNr)r~rR_rr>r"r"r#rs  z_SSHFormatECDSA.load_publicz-tuple[ec.EllipticCurvePrivateKey, memoryview]cCsH||\\}}}t|\}}||f|kr2tdt||j}||fS)z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)rrsrIr Zderive_private_keyrN)r~rRrZ curve_namersecretrr"r"r#rs   z_SSHFormatECDSA.load_privaterLrxrYrcCs*|tjtj}||j||dS)zWrite ECDSA public keyN) public_bytesrZX962rZUncompressedPointrr)r~r>rrr"r"r#rs  z_SSHFormatECDSA.encode_publiczec.EllipticCurvePrivateKeyrcCs,|}|}|||||jdS)zWrite ECDSA private keyN)r>rrrZ private_value)r~rrr>rr"r"r#rs z_SSHFormatECDSA.encode_privateN) r2r3r4rrrrrrrr"r"r"r#rs     rc@sdeZdZdZdddddZddddd Zdd dd d Zd dddddZddddddZdS)_SSHFormatEd25519z~Format for Ed25519 keys. Public: bytes point Private: bytes point bytes secret_and_point rdrr\cCst|\}}|f|fS)zEd25519 public fields)rp)r~rRrr"r"r#rs z_SSHFormatEd25519.get_publicz+tuple[ed25519.Ed25519PublicKey, memoryview]cCs(||\\}}tj|}||fS)z"Make Ed25519 public key from data.)rr rGZfrom_public_bytesr)r~rRrr>r"r"r#r s z_SSHFormatEd25519.load_publicz,tuple[ed25519.Ed25519PrivateKey, memoryview]cCsb||\\}}t|\}}|dd}|dd}||ksF|f|krNtdtj|}||fS)z#Make Ed25519 private key from data.Nr6z$Corrupt data: ed25519 field mismatch)rrprIr rFZfrom_private_bytes)r~rRrrZkeypairrZpoint2rr"r"r#rs    z_SSHFormatEd25519.load_privatezed25519.Ed25519PublicKeyrxrYrcCs|tjtj}||dS)zWrite Ed25519 public keyN)rrRawrr)r~r>rraw_public_keyr"r"r#r%sz_SSHFormatEd25519.encode_publiczed25519.Ed25519PrivateKeyrcCsR|}|tjtjt}|tjtj}t||g}| ||| |dS)zWrite Ed25519 private keyN) r>Z private_bytesrrrrrrrxrr)r~rrr>Zraw_private_keyrZ f_keypairr"r"r#r.s   z _SSHFormatEd25519.encode_privateNrr"r"r"r#rs    rsnistp256snistp384snistp521rJcCs8t|tst|}|tvr&t|Std|dS)z"Return valid format or throw errorzUnsupported key type: N)r;rrdr _KEY_FORMATSrrr"r"r#_lookup_kformatIs   rz typing.AnySSHPrivateKeyTypes)rRrbackendr!cCstd||dur td|t|}|s6td|d}|d}t t |||}| t srtdt |t t d}t|\}}t|\}}t|\}}t|\} }| dkrtdt|\} }t| \} } t| } | | \} } t| ||fttfkr&|}|tvr.td||tkrFtd|t|j}t|j}t|\}}t|jrt|}t ||krtd nt|t||t|\}}t|\}}t|t||||}|}t ||}t|jrt |t!sJt|"|n t|#n"t|\}}t|d }t||t|\}}t|\}}||krrtd t|\}}|| krtd | $|| \}}t|\}}|t%dt |krtd t |t&j'rt(j)dtj*dd|S)z.Load private key from OpenSSH custom encoding.rRNrzNot OpenSSH private key formatr'zOnly one key supportedzUnsupported cipher: zUnsupported KDF: z+Corrupt data: invalid tag length for cipherrmzCorrupt data: broken checksumzCorrupt data: key type mismatchzCorrupt data: invalid paddingDSSH DSA keys are deprecated and will be removed in a future release. stacklevel)+r_check_byteslike _check_bytes_PEM_RCsearchrIrendbinascii a2b_base64rd startswith _SK_MAGICrZrprlrrr^_NONErr8r_BCRYPTr-r0r1rr[rcZ decryptorupdater;rZfinalize_with_tagfinalizer_PADDINGr rCwarningswarnDeprecatedIn40)rRrrmp1p2r`kdfnameZ kdfoptionsnkeysZpubdataZ pub_key_typekformatrZciphername_bytesblklenr0ZedatatagrZkbufrradecZck1Zck2rJrrr"r"r#load_ssh_private_keyZs                               rr)rrencryption_algorithmr!cCstd|t|tjr*tjdtjddt|}t |}t }|rt }t |j }t}t} t|trt|jdurt|j} td} || || t||| | } nt}}d}d} d} td} d }t }|||||t | | g}||||||||td|||t }|t|||||||| |||||}|}tt ||}|!|||}| dur| "#|||||dt$|d|S) z3Serialize private key with OpenSSH custom encoding.rISSH DSA key support is deprecated and will be removed in a future releasererNr&rmr'rU)%rrr;r rCrrrrKrrx_DEFAULT_CIPHERr8r-r_DEFAULT_ROUNDSrZ _kdf_roundsosurandomrrrcrrr>rrrrrrdrrZ encryptorZ update_intorX)rrrrJrZ f_kdfoptionsr`rrrrrarZcheckvalcommentZ f_public_keyZ f_secretsZf_mainslenmlenrZofsr"r"r#_serialize_ssh_private_keysl                      rc@seZdZdZdZdS)SSHCertificateTyper'rN)r2r3r4USERZHOSTr"r"r"r#rsrc@seZdZdddddddddddddddddddd Zedd d d Zd d ddZedd ddZedd ddZedd ddZ edd ddZ edd ddZ edd ddZ edd ddZ edd dd Zd d d!d"Zdd d#d$Zd%d d&d'Zd(S))SSHCertificaterdSSHPublicKeyTypesrrydict[bytes, bytes]r)_nonce _public_key_serial_cctype_key_id_valid_principals _valid_after _valid_before_critical_options _extensions _sig_type_sig_key_inner_sig_type _signature_tbs_cert_body_cert_key_type _cert_bodycCs||_||_||_zt||_Wnty:tdYn0||_||_||_||_ | |_ | |_ | |_ | |_ | |_||_||_||_||_dS)NzInvalid certificate type)rrrr_typerIrrrrrrrrrrrrr)r~rrrrrrrrrrrrrrrrrr"r"r#r#s( zSSHCertificate.__init__rcCs t|jSr|)rrrr"r"r#nonceLszSSHCertificate.nonceSSHCertPublicKeyTypescCstt|jSr|)typingcastr rrr"r"r#r>PszSSHCertificate.public_keycCs|jSr|)rrr"r"r#serialUszSSHCertificate.serialrcCs|jSr|)rrr"r"r#typeYszSSHCertificate.typecCs t|jSr|)rrrr"r"r#key_id]szSSHCertificate.key_idcCs|jSr|)rrr"r"r#valid_principalsaszSSHCertificate.valid_principalscCs|jSr|)rrr"r"r# valid_beforeeszSSHCertificate.valid_beforecCs|jSr|)rrr"r"r# valid_afteriszSSHCertificate.valid_aftercCs|jSr|)rrr"r"r#critical_optionsmszSSHCertificate.critical_optionscCs|jSr|)rrr"r"r# extensionsqszSSHCertificate.extensionscCs&t|j}||j\}}t||Sr|)rrrrr^)r~Z sigformat signature_keyZ sigkey_restr"r"r#rus zSSHCertificate.signature_keycCs"t|jdtjt|jddS)N F)newline)rrr b2a_base64rrr"r"r#r{s zSSHCertificate.public_bytesrYcCs|}t|tjr.|t|jt|jnt|tj rt |j\}}t |\}}t |t ||}t|j}||t|jt|nnt|tjsJ|jtkrt}n*|jtkrt}n|jtksJt}|t|jt|jt|dSr|)rr;r rGverifyrrrr r?rsr^ asym_utilsZencode_dss_signature_get_ec_hash_algrNECDSAr rArrBrSHA1_SSH_RSA_SHA256SHA256_SSH_RSA_SHA512SHA512r PKCS1v15)r~rrrRsZ computed_sighash_algr"r"r#verify_cert_signatures6         z$SSHCertificate.verify_cert_signatureN)r2r3r4rpropertyr r>r rrrrrrrrrr&r"r"r"r#r"s..)rrzhashes.HashAlgorithm)rNr!cCsDt|tjrtSt|tjr(tSt|tjs8JtSdSr|) r;r SECP256R1rr SECP384R1SHA384 SECP521R1r!)rNr"r"r#rs   rz"SSHCertificate | SSHPublicKeyTypesc"Cs~td|t|}|s"td|d}}|d}d}|tr^d}|dtt }|t krr|srt dt |}zt t |}Wn tt jfytdYn0|r|} t|\} }| |krtd |rt|\} }||\} }|rnt|\} }t|\}}t|\}}t|\}}g}|rNt|\}}|t|q*t|\}}t|\}}t|\}}t|}t|\}}t|}t|\}}t|\}}t|\}}|t kr|st d | dt| }t|\}}t|t|\}} |tkr|tttfvs*|tkr2||kr2td t| \}!} t| t| | | |||||||||||!||| St|| SdS) NrRzInvalid line formatr'rFTz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)rr_SSH_PUBKEY_RCmatchrIgroupendswith _CERT_SUFFIXrZrErrrdrr TypeErrorErrorrprrnrlrr_parse_exts_optsr^rBrr r)"rR_legacy_dsa_allowedrrJZ orig_key_typeZkey_bodyZ with_certrrestZ cert_bodyZinner_key_typer r>r ZcctyperZ principalsrZ principalrrZ crit_optionsrextsrrZ sig_key_rawZsig_typeZsig_keyZ tbs_cert_bodyZ signature_rawZinner_sig_typeZsig_rest signaturer"r"r#_load_ssh_public_identitys                      r8cCst|Sr|)r8r]r"r"r#load_ssh_public_identity sr9r) exts_optsr!cCsi}d}|rt|\}}t|}||vr0td|durH||krHtdt|\}}t|dkrt|\}}t|dkrtdt|||<|}q|S)NzDuplicate namezFields not lexically sortedrz!Unexpected extra data after value)rprrIrZ)r:result last_namerOZbnamevalueextrar"r"r#r3s"      r3r)rRrr!cCsFt|dd}t|tr |}n|}t|tjrBtjdtj dd|S)NT)r4rrr) r8r;rr>r rDrrrr)rRrZ cert_or_keyr>r"r"r#load_ssh_public_key&s    r?cCslt|tjrtjdtjddt|}t|}t }| || ||t |}d|d|gS)z&One-line public key format for OpenSSHrrerrUr)r;r rDrrrrrKrrxrrrrrstriprV)r>rJrrZpubr"r"r#serialize_ssh_public_key:s   rAc @seZdZddddgdddggf ddddddddd d d d d Zd ddddZdddddZdddddZdddddZdddddZd d!Z d"dd#d$d%Z d"dd&d'd(Z dddd)d*d+Z dddd)d,d-Z d.d/d0d1d2ZdS)3SSHCertificateBuilderNFzSSHCertPublicKeyTypes | Noner/zSSHCertificateType | Noner_ryrzlist[tuple[bytes, bytes]] rrrrr_valid_for_all_principalsrrrrc Cs@||_||_||_||_||_||_||_||_| |_| |_ dSr|rD) r~rrrrrrErrrrr"r"r#r[s zSSHCertificateBuilder.__init__r rMc Cs^t|tjtjtjfstd|jdur0t dt ||j |j |j |j|j|j|j|j|jd S)Nr:zpublic_key already setrD)r;r r?r rAr rGr1rrIrCrrrrrErrrr)r~r>r"r"r#r>ss, z SSHCertificateBuilder.public_keyr)r r!c Cspt|tstdd|kr&dks0ntd|jdurBtdt|j||j|j|j |j |j |j |j |jd S)Nzserial must be an integerrz"serial must be between 0 and 2**64zserial already setrD)r;rr1rIrrCrrrrrErrrr)r~r r"r"r#r s$  zSSHCertificateBuilder.serialr)rr!c CsRt|tstd|jdur$tdt|j|j||j|j |j |j |j |j |jd S)Nz"type must be an SSHCertificateTypeztype already setrD)r;rr1rrIrCrrrrrErrrr)r~rr"r"r#rs   zSSHCertificateBuilder.typer)rr!c CsRt|tstd|jdur$tdt|j|j|j||j |j |j |j |j |jd S)Nzkey_id must be byteszkey_id already setrD)r;rr1rrIrCrrrrrErrrr)r~rr"r"r#rs   zSSHCertificateBuilder.key_id)rr!c Cs||jrtdtdd|Dr$|s,td|jr:tdt|tkrNtdt|j|j |j |j ||j|j |j |j|jd S)NzDPrincipals can't be set because the cert is valid for all principalscss|]}t|tVqdSr|)r;r).0rr"r"r# rUz9SSHCertificateBuilder.valid_principals..z5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsrD)rErIallr1rrZ_SSHKEY_CERT_MAX_PRINCIPALSrCrrrrrrrr)r~rr"r"r#rs: z&SSHCertificateBuilder.valid_principalsc CsJ|jrtd|jrtdt|j|j|j|j|jd|j|j |j |j d S)Nz@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTrD) rrIrErCrrrrrrrrrr"r"r#valid_for_all_principalss$z.SSHCertificateBuilder.valid_for_all_principalsz int | float)rr!c Csvt|ttfstdt|}|dks.|dkr6td|jdurHtdt|j|j|j |j |j |j ||j |j|jd S)Nz$valid_before must be an int or floatrrFzvalid_before must [0, 2**64)zvalid_before already setrD)r;rfloatr1rIrrCrrrrrrErrr)r~rr"r"r#rs& z"SSHCertificateBuilder.valid_before)rr!c Csvt|ttfstdt|}|dks.|dkr6td|jdurHtdt|j|j|j |j |j |j |j ||j|jd S)Nz#valid_after must be an int or floatrrFzvalid_after must [0, 2**64)zvalid_after already setrD)r;rrLr1rIrrCrrrrrrErrr)r~rr"r"r#rs& z!SSHCertificateBuilder.valid_after)rOr=r!c Cstt|trt|tstd|dd|jDvr8tdt|j|j|j|j |j |j |j |j g|j||f|jd S)Nname and value must be bytescSsg|] \}}|qSr"r"rGrOrr"r"r# 6rUz=SSHCertificateBuilder.add_critical_option..zDuplicate critical option namerD)r;rr1rrIrCrrrrrrErrrr~rOr=r"r"r#add_critical_option0s z)SSHCertificateBuilder.add_critical_optionc Cstt|trt|tstd|dd|jDvr8tdt|j|j|j|j |j |j |j |j |jg|j||fd S)NrMcSsg|] \}}|qSr"r"rNr"r"r#rOLrUz7SSHCertificateBuilder.add_extension..zDuplicate extension namerD)r;rr1rrIrCrrrrrrErrrrPr"r"r# add_extensionFs z#SSHCertificateBuilder.add_extensionSSHCertPrivateKeyTypesr)rr!c Cst|tjtjtjfstd|jdur0t d|j dur>dn|j }|j durVt d|j durddn|j }|j s~|js~t d|jdurt d|jdurt d|j|jkrt d |jjd d d |jjd d d t|j}|t}td}t|}t}||||||j|||||j j||t} |j D]} | | qT|| ||j||jt} |jD]L\} } | | t | dkrt}|| | |n | | q|| t}|jD]L\} } || t | dkr@t}|| ||n || q|||dt|}t|}t}||||!|||t|tjr|"|}t}||||||nt|tjrnt#|j$}|"|t%|}t&'|\}}t}||t}|(||(|||||nTt|tjsJt}|t)|"|t*+t,-}||||t./|0}t12t3t4d5|d|gS)NzUnsupported private key typezpublic_key must be setrztype must be setrUzAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforecSs|dSNrr"rr"r"r#rUz,SSHCertificateBuilder.sign..)r9cSs|dSrTr"rUr"r"r#rVrUr6r)6r;r r<r r@r rFr1rrIrrrrrErrrsortrrKr0rrrrxrrrrr=rrZr>signrrNrrZdecode_dss_signaturerr r r"rr!rrr@r r rr9rV)r~rr rrJZ cert_prefixr rfZ fprincipalsrZfcritrOr=ZfoptvalZfextZfextvalZca_typeZcaformatZcafr7Zfsigr%r#r$ZfsigblobZ cert_datar"r"r#rX\s                             zSSHCertificateBuilder.sign)r2r3r4rr>r rrrrKrrrQrRrXr"r"r"r#rCZs,"$rC)F)N)F)N)z __future__rrenumrrer rbase64rrW dataclassesrZ cryptographyrZcryptography.exceptionsrZcryptography.hazmat.primitivesrZ)cryptography.hazmat.primitives.asymmetricr r r r r rZ&cryptography.hazmat.primitives.ciphersrrrrZ,cryptography.hazmat.primitives.serializationrrrrrrZbcryptrr$Z_bcrypt_supported ImportErrorrHrBrEZ_ECDSA_NISTP256Z_ECDSA_NISTP384Z_ECDSA_NISTP521r0rr compiler,rZ _SK_STARTZ_SK_ENDrrrrDOTALLrrdrrangerr)ZAESZCTRZCBCZGCMr8r5rPrKr=rXr[r^rcrlrnrprsrwrxrrrrr(r)r+rrUnionr<r@rCrFrrrr?rArDrGrr Enumrrrr8r9r3r?rArSrJrCr"r"r"r#s                6FFEB   hM _