o
    àý°jXÑ  ã                   @  s  U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZmZmZmZmZ d dlmZ d dlmZmZmZmZ d d	lmZmZmZm Z m!Z!m"Z" z
d d
l#m$Z% dZ&W n e'yƒ   dZ&	dšd›dd„Z%Y nw dZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/d Z0d!Z1d"Z2e 3d#¡Z4d$Z5d%Z6d&Z7d'Z8d(Z9d)Z:d*Z;e 3e6d+ e7 ej<¡Z=e>e?e@d,d-ƒƒƒZAe	G d.d/„ d/ƒƒZBeBejCd0ejDd*d*ddd1�eBejCd0ejEd*d*ddd1�eBejCd0ejFd*d2d*dd1�d3œZGd4eHd5< e+e,e-d6œZIdœd9d:„ZJd�d=d>„ZKdždCdD„ZLdŸdEdF„ZMd dJdK„ZNd¡dNdO„ZOd¡dPdQ„ZPd¢dSdT„ZQd¡dUdV„ZRd£dXdY„ZSG dZd[„ d[ƒZTG d\d]„ d]ƒZUG d^d_„ d_ƒZVG d`da„ daƒZWG dbdc„ dcƒZXd¤ddde„ZYG dfdg„ dgƒZZG dhdi„ diƒZ[e)eUƒ e*eVƒ e(eXƒ e+eWdje \¡ ƒe,eWdke ]¡ ƒe-eWdle ^¡ ƒe/eZƒ e0e[ƒ iZ_d¥dndo„Z`ejaejbejcejdejef Zf	d¦ddpœd§dudv„Zgd¨dzd{„Zhejaejiejjejkejlf Zmejaejiejjejlf ZnG d|d}„ d}ejoƒZpG d~d„ dƒZqd©dƒd„„Zr	dšdªd†d‡„Zsdªdˆd‰„Ztd«dŒd�„Zud¬d‘d’„Zv	d¦d­d“d”„Zwd®d•d–„Zxejaejbejcejef Zyd—ZzG d˜d™„ d™ƒZ{dS )¯é    )ÚannotationsN)Ú	dataclass)Úutils©ÚUnsupportedAlgorithm)Úhashes)ÚdsaÚecÚed25519ÚpaddingÚrsa)ÚAEADDecryptionContextÚCipherÚ
algorithmsÚmodes)ÚEncodingÚKeySerializationEncryptionÚNoEncryptionÚPrivateFormatÚPublicFormatÚ_KeySerializationEncryption)ÚkdfTFÚpasswordÚbytesÚsaltÚdesired_key_bytesÚintÚroundsÚignore_few_roundsÚboolÚreturnc                 C  ó   t dƒ‚)NzNeed bcrypt moduler   )r   r   r   r   r   © r"   ú£/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/cryptography/hazmat/primitives/serialization/ssh.pyÚ_bcrypt_kdf0   s   r$   s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   sk-ssh-ed25519@openssh.coms"   sk-ecdsa-sha2-nistp256@openssh.coms   rsa-sha2-256s   rsa-sha2-512s   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   noneó
   aes256-ctré   s   (.*?)é   é   c                   @  sF   e Zd ZU ded< ded< ded< ded< ded< d	ed
< ded< dS )Ú
_SSHCipherztype[algorithms.AES]Úalgr   Úkey_lenz3type[modes.CTR] | type[modes.CBC] | type[modes.GCM]ÚmodeÚ	block_lenÚiv_lenú
int | NoneÚtag_lenr   Úis_aeadN)Ú__name__Ú
__module__Ú__qualname__Ú__annotations__r"   r"   r"   r#   r)   [   s   
 r)   é    )r*   r+   r,   r-   r.   r0   r1   é   )r%   s
   aes256-cbcs   aes256-gcm@openssh.comzdict[bytes, _SSHCipher]Ú_SSH_CIPHERS)Ú	secp256r1Ú	secp384r1Ú	secp521r1Úkeyú&SSHPrivateKeyTypes | SSHPublicKeyTypesc                 C  sŠ   t | tjƒrt|  ¡ ƒ}|S t | tjƒrt| ƒ}|S t | tjtjfƒr't	}|S t | t
jt
jfƒr4t}|S t | tjtjfƒrAt}|S tdƒ‚)NúUnsupported key type)Ú
isinstancer	   ÚEllipticCurvePrivateKeyÚ_ecdsa_key_typeÚ
public_keyÚEllipticCurvePublicKeyr   ÚRSAPrivateKeyÚRSAPublicKeyÚ_SSH_RSAr   ÚDSAPrivateKeyÚDSAPublicKeyÚ_SSH_DSAr
   ÚEd25519PrivateKeyÚEd25519PublicKeyÚ_SSH_ED25519Ú
ValueError)r<   Úkey_typer"   r"   r#   Ú_get_ssh_key_type�   s$   óõ
÷ùÿþrO   rB   úec.EllipticCurvePublicKeyc                 C  s*   | j }|jtvrtd|j›�ƒ‚t|j S )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )ÚcurveÚnameÚ_ECDSA_KEY_TYPErM   )rB   rQ   r"   r"   r#   rA       s   

ÿ
rA   Údataúutils.Bufferr-   ÚNonec                 C  s    | r
t | ƒ| dkrtdƒ‚dS )zRequire data to be full blocksr   zCorrupt data: missing paddingN)ÚlenrM   )rT   r-   r"   r"   r#   Ú_check_block_sizeª   s   ÿrX   c                 C  s   | rt dƒ‚dS )z!All data should have been parsed.zCorrupt data: unparsed dataN)rM   ©rT   r"   r"   r#   Ú_check_empty°   s   ÿrZ   Ú
ciphernameúbytes | Noneú)Cipher[modes.CBC | modes.CTR | modes.GCM]c                 C  sV   |st dƒ‚t|  }t|||j|j |dƒ}t| |d|j… ¡| ||jd… ¡ƒS )z$Generate key + iv and return cipher.z9Key is password-protected, but password was not provided.TN)Ú	TypeErrorr8   r$   r+   r.   r   r*   r,   )r[   r   r   r   ÚciphÚseedr"   r"   r#   Ú_init_cipher¶   s   ÿÿþra   Ú
memoryviewútuple[int, memoryview]c                 C  ó6   t | ƒdk r
tdƒ‚tj| dd… dd�| dd… fS )ÚUint32é   úInvalid dataNÚbig©Ú	byteorder©rW   rM   r   Ú
from_bytesrY   r"   r"   r#   Ú_get_u32Ì   ó   "rm   c                 C  rd   )ÚUint64é   rg   Nrh   ri   rk   rY   r"   r"   r#   Ú_get_u64Ó   rn   rq   útuple[memoryview, memoryview]c                 C  s8   t | ƒ\}} |t| ƒkrtdƒ‚| d|… | |d… fS )zBytes with u32 length prefixrg   N)rm   rW   rM   )rT   Únr"   r"   r#   Ú_get_sshstrÚ   s   rt   c                 C  s4   t | ƒ\}} |r|d dkrtdƒ‚t |d¡| fS )zBig integer.r   é   rg   rh   )rt   rM   r   rl   )rT   Úvalr"   r"   r#   Ú
_get_mpintâ   s   rw   rv   c                 C  s4   | dk rt dƒ‚| sdS |  ¡ d d }t | |¡S )z!Storage format for signed bigint.r   znegative mpint not allowedó    rp   )rM   Ú
bit_lengthr   Úint_to_bytes)rv   Únbytesr"   r"   r#   Ú	_to_mpintê   s   r|   c                   @  sx   e Zd ZU dZded< d$d%d	d
„Zd&dd„Zd'dd„Zd'dd„Zd(dd„Z	d'dd„Z
d)dd„Zd*d+dd „Zd,d"d#„ZdS )-Ú	_FragListz,Build recursive structure without data copy.zlist[utils.Buffer]ÚflistNÚinitúlist[utils.Buffer] | Noner    rV   c                 C  s   g | _ |r| j  |¡ d S d S ©N)r~   Úextend)Úselfr   r"   r"   r#   Ú__init__ù   s   ÿz_FragList.__init__rv   rU   c                 C  s   | j  |¡ dS )zAdd plain bytesN)r~   Úappend©rƒ   rv   r"   r"   r#   Úput_rawþ   ó   z_FragList.put_rawr   c                 C  ó   | j  |jddd�¡ dS )zBig-endian uint32rf   rh   ©Úlengthrj   N©r~   r…   Úto_bytesr†   r"   r"   r#   Úput_u32  ó   z_FragList.put_u32c                 C  r‰   )zBig-endian uint64rp   rh   rŠ   NrŒ   r†   r"   r"   r#   Úput_u64  r�   z_FragList.put_u64úbytes | _FragListc                 C  sN   t |tttfƒr|  t|ƒ¡ | j |¡ dS |  | ¡ ¡ | j 	|j¡ dS )zBytes prefixed with u32 lengthN)
r?   r   rb   Ú	bytearrayrŽ   rW   r~   r…   Úsizer‚   r†   r"   r"   r#   Ú
put_sshstr
  s
   z_FragList.put_sshstrc                 C  s   |   t|ƒ¡ dS )z*Big-endian bigint prefixed with u32 lengthN)r”   r|   r†   r"   r"   r#   Ú	put_mpint  s   z_FragList.put_mpintc                 C  s   t tt| jƒƒS )zCurrent number of bytes)ÚsumÚmaprW   r~   ©rƒ   r"   r"   r#   r“     rˆ   z_FragList.sizer   Údstbufrb   Úposc                 C  s2   | j D ]}t|ƒ}||| }}||||…< q|S )zWrite into bytearray)r~   rW   )rƒ   r™   rš   ÚfragÚflenÚstartr"   r"   r#   Úrender  s
   
z_FragList.renderr   c                 C  s"   t t|  ¡ ƒƒ}|  |¡ | ¡ S )zReturn as bytes)rb   r’   r“   rž   Útobytes)rƒ   Úbufr"   r"   r#   rŸ   #  s   
z_FragList.tobytesr�   )r   r€   r    rV   )rv   rU   r    rV   )rv   r   r    rV   )rv   r‘   r    rV   ©r    r   )r   )r™   rb   rš   r   r    r   ©r    r   )r2   r3   r4   Ú__doc__r5   r„   r‡   rŽ   r�   r”   r•   r“   rž   rŸ   r"   r"   r"   r#   r}   ô   s   
 




	
r}   c                   @  óB   e Zd ZdZddd„Zdd	d
„Zddd„Zd dd„Zd!dd„ZdS )"Ú_SSHFormatRSAzhFormat for RSA keys.

    Public:
        mpint e, n
    Private:
        mpint n, e, d, iqmp, p, q
    rT   rb   r    ú"tuple[tuple[int, int], memoryview]c                 C  s$   t |ƒ\}}t |ƒ\}}||f|fS )zRSA public fields©rw   )rƒ   rT   Úers   r"   r"   r#   Ú
get_public3  s   z_SSHFormatRSA.get_publicú#tuple[rsa.RSAPublicKey, memoryview]c                 C  s.   |   |¡\\}}}t ||¡}| ¡ }||fS )zMake RSA public key from data.)r©   r   ÚRSAPublicNumbersrB   )rƒ   rT   r¨   rs   Úpublic_numbersrB   r"   r"   r#   Úload_public;  s   z_SSHFormatRSA.load_publicÚunsafe_skip_rsa_key_validationr   ú$tuple[rsa.RSAPrivateKey, memoryview]c              	   C  sª   t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}	}||f|kr.tdƒ‚t ||¡}
t ||	¡}t ||¡}t ||	||
|||¡}|j|d�}||fS )zMake RSA private key from data.z Corrupt data: rsa field mismatch©r®   )rw   rM   r   Úrsa_crt_dmp1Úrsa_crt_dmq1r«   ÚRSAPrivateNumbersÚprivate_key)rƒ   rT   Ú	pubfieldsr®   rs   r¨   ÚdÚiqmpÚpÚqÚdmp1Údmq1r¬   Úprivate_numbersr´   r"   r"   r#   Úload_privateD  s$   ÿÿz_SSHFormatRSA.load_privaterB   úrsa.RSAPublicKeyÚf_pubr}   rV   c                 C  s$   |  ¡ }| |j¡ | |j¡ dS )zWrite RSA public keyN)r¬   r•   r¨   rs   )rƒ   rB   r¿   Úpubnr"   r"   r#   Úencode_public\  s   z_SSHFormatRSA.encode_publicr´   úrsa.RSAPrivateKeyÚf_privc                 C  sZ   |  ¡ }|j}| |j¡ | |j¡ | |j¡ | |j¡ | |j¡ | |j¡ dS )zWrite RSA private keyN)	r¼   r¬   r•   rs   r¨   r¶   r·   r¸   r¹   )rƒ   r´   rÃ   r¼   r¬   r"   r"   r#   Úencode_privated  s   z_SSHFormatRSA.encode_privateN)rT   rb   r    r¦   )rT   rb   r    rª   )rT   rb   r®   r   r    r¯   )rB   r¾   r¿   r}   r    rV   )r´   rÂ   rÃ   r}   r    rV   ©	r2   r3   r4   r£   r©   r­   r½   rÁ   rÄ   r"   r"   r"   r#   r¥   *  s    


	
r¥   c                   @  sL   e Zd ZdZd!dd„Zd"d	d
„Zd#dd„Zd$dd„Zd%dd„Zd&dd„Z	d S )'Ú_SSHFormatDSAzhFormat for DSA keys.

    Public:
        mpint p, q, g, y
    Private:
        mpint p, q, g, y, x
    rT   rb   r    útuple[tuple, memoryview]c                 C  s@   t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}}||||f|fS )zDSA public fieldsr§   )rƒ   rT   r¸   r¹   ÚgÚyr"   r"   r#   r©   }  s
   z_SSHFormatDSA.get_publicú#tuple[dsa.DSAPublicKey, memoryview]c           	      C  sJ   |   |¡\\}}}}}t |||¡}t ||¡}|  |¡ | ¡ }||fS )zMake DSA public key from data.)r©   r   ÚDSAParameterNumbersÚDSAPublicNumbersÚ	_validaterB   )	rƒ   rT   r¸   r¹   rÈ   rÉ   Úparameter_numbersr¬   rB   r"   r"   r#   r­   …  s   
z_SSHFormatDSA.load_publicr®   r   ú$tuple[dsa.DSAPrivateKey, memoryview]c                 C  sz   |   |¡\\}}}}}t|ƒ\}}||||f|krtdƒ‚t |||¡}	t ||	¡}
|  |
¡ t ||
¡}| ¡ }||fS )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r©   rw   rM   r   rË   rÌ   rÍ   ÚDSAPrivateNumbersr´   )rƒ   rT   rµ   r®   r¸   r¹   rÈ   rÉ   ÚxrÎ   r¬   r¼   r´   r"   r"   r#   r½   �  s   
z_SSHFormatDSA.load_privaterB   údsa.DSAPublicKeyr¿   r}   rV   c                 C  sL   |  ¡ }|j}|  |¡ | |j¡ | |j¡ | |j¡ | |j¡ dS )zWrite DSA public keyN)r¬   rÎ   rÍ   r•   r¸   r¹   rÈ   rÉ   )rƒ   rB   r¿   r¬   rÎ   r"   r"   r#   rÁ      s   
z_SSHFormatDSA.encode_publicr´   údsa.DSAPrivateKeyrÃ   c                 C  s$   |   | ¡ |¡ | | ¡ j¡ dS )zWrite DSA private keyN)rÁ   rB   r•   r¼   rÑ   )rƒ   r´   rÃ   r"   r"   r#   rÄ   ­  s   z_SSHFormatDSA.encode_privater¬   údsa.DSAPublicNumbersc                 C  s    |j }|j ¡ dkrtdƒ‚d S )Ni   z#SSH supports only 1024 bit DSA keys)rÎ   r¸   ry   rM   )rƒ   r¬   rÎ   r"   r"   r#   rÍ   ´  s   ÿz_SSHFormatDSA._validateN)rT   rb   r    rÇ   )rT   rb   r    rÊ   )rT   rb   r®   r   r    rÏ   )rB   rÒ   r¿   r}   r    rV   )r´   rÓ   rÃ   r}   r    rV   )r¬   rÔ   r    rV   )
r2   r3   r4   r£   r©   r­   r½   rÁ   rÄ   rÍ   r"   r"   r"   r#   rÆ   t  s    




rÆ   c                   @  sL   e Zd ZdZd#dd„Zd$dd„Zd%dd„Zd&dd„Zd'dd„Zd(d d!„Z	d"S ))Ú_SSHFormatECDSAz–Format for ECDSA keys.

    Public:
        str curve
        bytes point
    Private:
        str curve
        bytes point
        mpint secret
    Ússh_curve_namer   rQ   úec.EllipticCurvec                 C  s   || _ || _d S r�   )rÖ   rQ   )rƒ   rÖ   rQ   r"   r"   r#   r„   Æ  s   
z_SSHFormatECDSA.__init__rT   rb   r    ú0tuple[tuple[memoryview, memoryview], memoryview]c                 C  s^   t |ƒ\}}t |ƒ\}}|| jkrtdƒ‚t|ƒdkrtdƒ‚|d dkr)tdƒ‚||f|fS )zECDSA public fieldszCurve name mismatchr   zInvalid EC point: empty datarf   zNeed uncompressed point)rt   rÖ   rM   rW   ÚNotImplementedError)rƒ   rT   rQ   Úpointr"   r"   r#   r©   Ê  s   
z_SSHFormatECDSA.get_publicú,tuple[ec.EllipticCurvePublicKey, memoryview]c                 C  s.   |   |¡\\}}}tj | j| ¡ ¡}||fS ©z Make ECDSA public key from data.)r©   r	   rC   Úfrom_encoded_pointrQ   rŸ   )rƒ   rT   Ú_rÚ   rB   r"   r"   r#   r­   Ø  s
   
ÿz_SSHFormatECDSA.load_publicr®   r   ú-tuple[ec.EllipticCurvePrivateKey, memoryview]c                 C  sH   |   |¡\\}}}t|ƒ\}}||f|krtdƒ‚t || j¡}||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r©   rw   rM   r	   Úderive_private_keyrQ   )rƒ   rT   rµ   r®   Ú
curve_namerÚ   Úsecretr´   r"   r"   r#   r½   â  s   z_SSHFormatECDSA.load_privaterB   rP   r¿   r}   rV   c                 C  s*   |  tjtj¡}| | j¡ | |¡ dS )zWrite ECDSA public keyN)Úpublic_bytesr   ÚX962r   ÚUncompressedPointr”   rÖ   )rƒ   rB   r¿   rÚ   r"   r"   r#   rÁ   î  s
   ÿz_SSHFormatECDSA.encode_publicr´   úec.EllipticCurvePrivateKeyrÃ   c                 C  s,   |  ¡ }| ¡ }|  ||¡ | |j¡ dS )zWrite ECDSA private keyN)rB   r¼   rÁ   r•   Úprivate_value)rƒ   r´   rÃ   rB   r¼   r"   r"   r#   rÄ   ø  s   z_SSHFormatECDSA.encode_privateN)rÖ   r   rQ   r×   )rT   rb   r    rØ   ©rT   rb   r    rÛ   )rT   rb   r®   r   r    rß   )rB   rP   r¿   r}   r    rV   )r´   ræ   rÃ   r}   r    rV   )
r2   r3   r4   r£   r„   r©   r­   r½   rÁ   rÄ   r"   r"   r"   r#   rÕ   º  s    






rÕ   c                   @  r¤   )"Ú_SSHFormatEd25519z~Format for Ed25519 keys.

    Public:
        bytes point
    Private:
        bytes point
        bytes secret_and_point
    rT   rb   r    ú$tuple[tuple[memoryview], memoryview]c                 C  s   t |ƒ\}}|f|fS )zEd25519 public fields)rt   )rƒ   rT   rÚ   r"   r"   r#   r©     s   
z_SSHFormatEd25519.get_publicú+tuple[ed25519.Ed25519PublicKey, memoryview]c                 C  s(   |   |¡\\}}tj | ¡ ¡}||fS ©z"Make Ed25519 public key from data.)r©   r
   rK   Úfrom_public_bytesrŸ   )rƒ   rT   rÚ   rB   r"   r"   r#   r­     s
   ÿz_SSHFormatEd25519.load_publicr®   r   ú,tuple[ed25519.Ed25519PrivateKey, memoryview]c           	      C  sb   |   |¡\\}}t|ƒ\}}|dd… }|dd… }||ks#|f|kr'tdƒ‚tj |¡}||fS )z#Make Ed25519 private key from data.Nr6   z$Corrupt data: ed25519 field mismatch)r©   rt   rM   r
   rJ   Úfrom_private_bytes)	rƒ   rT   rµ   r®   rÚ   Úkeypairrâ   Úpoint2r´   r"   r"   r#   r½     s   z_SSHFormatEd25519.load_privaterB   úed25519.Ed25519PublicKeyr¿   r}   rV   c                 C  s   |  tjtj¡}| |¡ dS )zWrite Ed25519 public keyN)rã   r   ÚRawr   r”   )rƒ   rB   r¿   Úraw_public_keyr"   r"   r#   rÁ   ,  s   ÿz_SSHFormatEd25519.encode_publicr´   úed25519.Ed25519PrivateKeyrÃ   c                 C  sR   |  ¡ }| tjtjtƒ ¡}| tjtj¡}t||gƒ}|  	||¡ | 
|¡ dS )zWrite Ed25519 private keyN)rB   Úprivate_bytesr   ró   r   r   rã   r   r}   rÁ   r”   )rƒ   r´   rÃ   rB   Úraw_private_keyrô   Ú	f_keypairr"   r"   r#   rÄ   5  s   ÿÿz _SSHFormatEd25519.encode_privateN)rT   rb   r    rê   ©rT   rb   r    rë   )rT   rb   r®   r   r    rî   )rB   rò   r¿   r}   r    rV   )r´   rõ   rÃ   r}   r    rV   rÅ   r"   r"   r"   r#   ré     s    
	



	ré   c                 C  s2   t | ƒ\}} | ¡  d¡std|› d�ƒ‚|| fS )z!
    U2F application strings
    s   ssh:z4U2F application string does not start with b'ssh:' (ú))rt   rŸ   Ú
startswithrM   )rT   Úapplicationr"   r"   r#   Úload_applicationF  s   ÿÿrý   c                   @  ó$   e Zd ZdZddd„Zdd	d
„ZdS )Ú_SSHFormatSKEd25519zÏ
    The format of a sk-ssh-ed25519@openssh.com public key is:

        string		"sk-ssh-ed25519@openssh.com"
        string		public key
        string		application (user-specified, but typically "ssh:")
    rT   rb   r    rë   c                 C  ó&   t tƒ |¡\}}t|ƒ\}}||fS rì   )Ú_lookup_kformatrL   r­   rý   ©rƒ   rT   rB   rÞ   r"   r"   r#   r­   \  ó   z_SSHFormatSKEd25519.load_publicútyping.NoReturnc                 C  r!   )Nz,sk-ssh-ed25519 private keys cannot be loadedr   ©rƒ   rT   r"   r"   r#   r©   d  ó   ÿz_SSHFormatSKEd25519.get_publicNrù   ©rT   rb   r    r  ©r2   r3   r4   r£   r­   r©   r"   r"   r"   r#   rÿ   S  s    
rÿ   c                   @  rþ   )Ú_SSHFormatSKECDSAzò
    The format of a sk-ecdsa-sha2-nistp256@openssh.com public key is:

        string		"sk-ecdsa-sha2-nistp256@openssh.com"
        string		curve name
        ec_point	Q
        string		application (user-specified, but typically "ssh:")
    rT   rb   r    rÛ   c                 C  r   rÜ   )r  Ú_ECDSA_NISTP256r­   rý   r  r"   r"   r#   r­   v  r  z_SSHFormatSKECDSA.load_publicr  c                 C  r!   )Nz4sk-ecdsa-sha2-nistp256 private keys cannot be loadedr   r  r"   r"   r#   r©   ~  r  z_SSHFormatSKECDSA.get_publicNrè   r  r  r"   r"   r"   r#   r	  l  s    
	r	  s   nistp256s   nistp384s   nistp521rN   c                 C  s4   t | tƒst| ƒ ¡ } | tv rt|  S td| ›�ƒ‚)z"Return valid format or throw errorzUnsupported key type: )r?   r   rb   rŸ   Ú_KEY_FORMATSr   )rN   r"   r"   r#   r  ’  s
   
r  r°   Úbackendú
typing.Anyr®   ÚSSHPrivateKeyTypesc                C  sö  t  d| ¡ |durt  d|¡ t | ¡}|stdƒ‚| d¡}| d¡}t 	t
| ƒ||… ¡} |  t¡s9tdƒ‚t
| ƒttƒd… } t| ƒ\}} t| ƒ\}} t| ƒ\}	} t| ƒ\}
} |
dkrctdƒ‚t| ƒ\}} t|ƒ\}}t|ƒ}| |¡\}}t|ƒ |tks‡|tk�r| ¡ }|tvr–td|›�ƒ‚|tkr¡td|›�ƒ‚t| j}t| j}t| ƒ\}} t| jrÅt| ƒ}t|ƒ|krÄtd	ƒ‚nt| ƒ t||ƒ t|	ƒ\}}t|ƒ\}}t|ƒ t||| ¡ |ƒ}| ¡ }t
| |¡ƒ}t| j�rt |t!ƒsÿJ ‚t| "|¡ƒ nt| #¡ ƒ n|�rt$d
ƒ‚t| ƒ\}} t| ƒ d}t||ƒ t|ƒ\}}t|ƒ\}}||k�r;tdƒ‚t|ƒ\}}||k�rJtdƒ‚|j%|||d�\}}t|ƒ\}}|t&dt|ƒ… k�ritdƒ‚t |t'j(ƒ�ryt)j*dt j+dd� |S )z.Load private key from OpenSSH custom encoding.rT   Nr   zNot OpenSSH private key formatr'   zOnly one key supportedzUnsupported cipher: zUnsupported KDF: z+Corrupt data: invalid tag length for cipherz4Password was given but private key is not encrypted.rp   zCorrupt data: broken checksumzCorrupt data: key type mismatchr°   zCorrupt data: invalid paddingúDSSH DSA keys are deprecated and will be removed in a future release.é   ©Ú
stacklevel),r   Ú_check_byteslikeÚ_check_bytesÚ_PEM_RCÚsearchrM   r�   ÚendÚbinasciiÚ
a2b_base64rb   rû   Ú	_SK_MAGICrW   rt   rm   r  r©   rZ   Ú_NONErŸ   r8   r   Ú_BCRYPTr-   r0   r1   r   rX   ra   Ú	decryptorÚupdater?   r   Úfinalize_with_tagÚfinalizer^   r½   Ú_PADDINGr   rG   ÚwarningsÚwarnÚDeprecatedIn40)rT   r   r  r®   ÚmÚp1Úp2r[   ÚkdfnameÚ
kdfoptionsÚnkeysÚpubdataÚpub_key_typeÚkformatrµ   Úciphername_bytesÚblklenr0   ÚedataÚtagr   Úkbufr   r_   ÚdecÚck1Úck2rN   r´   rÞ   r"   r"   r#   Úload_ssh_private_key£  s¢   



ÿ


ÿ
ÿ



ýür6  r´   Úencryption_algorithmr   c                 C  sä  t  d|¡ t| tjƒrtjdt jdd� t| ƒ}t	|ƒ}t
ƒ }|rQt}t| j}t}t}	t|tƒr:|jdur:|j}	t d¡}
| |
¡ | |	¡ t|||
|	ƒ}nt }}d}d}d}t d¡}d	}t
ƒ }| |¡ | |  ¡ |¡ t
||gƒ}| |¡ | | |¡ | |¡ | td|| ¡ |  … ¡ t
ƒ }| t¡ | |¡ | |¡ | |¡ | |¡ | |¡ | |¡ | ¡ }| ¡ }tt || ƒƒ}| !|¡ || }|durê| "¡  #|||… ||d… ¡ t$|d|… ƒS )
z3Serialize private key with OpenSSH custom encoding.r   úISSH DSA key support is deprecated and will be removed in a future releaserf   r  Nr&   rp   r'   rx   )%r   r  r?   r   rG   r"  r#  r$  rO   r  r}   Ú_DEFAULT_CIPHERr8   r-   r  Ú_DEFAULT_ROUNDSr   Ú_kdf_roundsÚosÚurandomr”   rŽ   ra   r  rÁ   rB   rÄ   r‡   r!  r“   r  rb   r’   rž   Ú	encryptorÚupdate_intor   )r´   r   r7  rN   r-  Úf_kdfoptionsr[   r/  r(  r   r   r_   r*  ÚcheckvalÚcommentÚf_public_keyÚ	f_secretsÚf_mainÚslenÚmlenr    Úofsr"   r"   r#   Ú_serialize_ssh_private_key  sj   ü
ÿ















 rI  c                   @  s   e Zd ZdZdZdS )ÚSSHCertificateTyper'   r  N)r2   r3   r4   ÚUSERÚHOSTr"   r"   r"   r#   rJ  p  s    rJ  c                   @  s¼   e Zd Zd9dd„Zed:dd„ƒZd;dd„Zed<d d!„ƒZed=d#d$„ƒZed:d%d&„ƒZ	ed>d'd(„ƒZ
ed<d)d*„ƒZed<d+d,„ƒZed?d-d.„ƒZed?d/d0„ƒZd;d1d2„Zd:d3d4„Zd@d6d7„Zd8S )AÚSSHCertificateÚ_noncerb   Ú_public_keyÚSSHPublicKeyTypesÚ_serialr   Ú_cctypeÚ_key_idÚ_valid_principalsúlist[bytes]Ú_valid_afterÚ_valid_beforeÚ_critical_optionsúdict[bytes, bytes]Ú_extensionsÚ	_sig_typeÚ_sig_keyÚ_inner_sig_typeÚ
_signatureÚ_tbs_cert_bodyÚ_cert_key_typer   Ú
_cert_bodyc                 C  sŠ   || _ || _|| _zt|ƒ| _W n ty   tdƒ‚w || _|| _|| _|| _	|	| _
|
| _|| _|| _|| _|| _|| _|| _|| _d S )NzInvalid certificate type)rN  rO  rQ  rJ  Ú_typerM   rS  rT  rV  rW  rX  rZ  r[  r\  r]  r^  r`  ra  r_  )rƒ   rN  rO  rQ  rR  rS  rT  rV  rW  rX  rZ  r[  r\  r]  r^  r_  r`  ra  r"   r"   r#   r„   v  s*   ÿ
zSSHCertificate.__init__r    c                 C  ó
   t | jƒS r�   )r   rN  r˜   r"   r"   r#   ÚnonceŸ  ó   
zSSHCertificate.nonceÚSSHCertPublicKeyTypesc                 C  s   t  t| j¡S r�   )ÚtypingÚcastrf  rO  r˜   r"   r"   r#   rB   £  s   zSSHCertificate.public_keyc                 C  ó   | j S r�   )rQ  r˜   r"   r"   r#   Úserial¨  ó   zSSHCertificate.serialrJ  c                 C  ri  r�   )rb  r˜   r"   r"   r#   Útype¬  rk  zSSHCertificate.typec                 C  rc  r�   )r   rS  r˜   r"   r"   r#   Úkey_id°  re  zSSHCertificate.key_idc                 C  ri  r�   )rT  r˜   r"   r"   r#   Úvalid_principals´  rk  zSSHCertificate.valid_principalsc                 C  ri  r�   )rW  r˜   r"   r"   r#   Úvalid_before¸  rk  zSSHCertificate.valid_beforec                 C  ri  r�   )rV  r˜   r"   r"   r#   Úvalid_after¼  rk  zSSHCertificate.valid_afterc                 C  ri  r�   )rX  r˜   r"   r"   r#   Úcritical_optionsÀ  rk  zSSHCertificate.critical_optionsc                 C  ri  r�   )rZ  r˜   r"   r"   r#   Ú
extensionsÄ  rk  zSSHCertificate.extensionsc                 C  s&   t | jƒ}| | j¡\}}t|ƒ |S r�   )r  r[  r­   r\  rZ   )rƒ   Ú	sigformatÚsignature_keyÚsigkey_restr"   r"   r#   rt  È  s   
zSSHCertificate.signature_keyc                 C  s"   t | jƒd tjt | jƒdd� S )Nó    F)Únewline)r   r`  r  Ú
b2a_base64ra  r˜   r"   r"   r#   rã   Î  s   ÿþÿzSSHCertificate.public_bytesrV   c                 C  s  |   ¡ }t|tjƒr| t| jƒt| jƒ¡ d S t|tj	ƒrIt
| jƒ\}}t
|ƒ\}}t|ƒ t ||¡}t|jƒ}| |t| jƒt |¡¡ d S t|tjƒsQJ ‚| jtkr[t ¡ }n| jtkret ¡ }n| jtkslJ ‚t ¡ }| t| jƒt| jƒt ¡ |¡ d S r�   )rt  r?   r
   rK   Úverifyr   r^  r_  r	   rC   rw   rZ   Ú
asym_utilsÚencode_dss_signatureÚ_get_ec_hash_algrQ   ÚECDSAr   rE   r]  rF   r   ÚSHA1Ú_SSH_RSA_SHA256ÚSHA256Ú_SSH_RSA_SHA512ÚSHA512r   ÚPKCS1v15)rƒ   rt  ÚrrT   ÚsÚcomputed_sigÚhash_algr"   r"   r#   Úverify_cert_signatureÕ  s6   ÿ
ÿ



üz$SSHCertificate.verify_cert_signatureN)"rN  rb   rO  rP  rQ  r   rR  r   rS  rb   rT  rU  rV  r   rW  r   rX  rY  rZ  rY  r[  rb   r\  rb   r]  rb   r^  rb   r_  rb   r`  r   ra  rb   r¢   )r    rf  r¡   )r    rJ  )r    rU  )r    rY  )r    rV   )r2   r3   r4   r„   Úpropertyrd  rB   rj  rl  rm  rn  ro  rp  rq  rr  rt  rã   rˆ  r"   r"   r"   r#   rM  u  s0    
)


rM  rQ   r×   úhashes.HashAlgorithmc                 C  s@   t | tjƒr
t ¡ S t | tjƒrt ¡ S t | tjƒsJ ‚t ¡ S r�   )	r?   r	   Ú	SECP256R1r   r€  Ú	SECP384R1ÚSHA384Ú	SECP521R1r‚  )rQ   r"   r"   r#   r|  ö  s   r|  ú"SSHCertificate | SSHPublicKeyTypesc           "      C  sp  t  d| ¡ t | ¡}|stdƒ‚| d¡ }}| d¡}d}| t¡r/d}|d ttƒ … }|t	kr9|s9t
dƒ‚t|ƒ}z	tt |¡ƒ}W n ttjfyT   tdƒ‚w |rY|}	t|ƒ\}
}|
|krgtd	ƒ‚|rot|ƒ\}}| |¡\}}|�r2t|ƒ\}}t|ƒ\}}t|ƒ\}}t|ƒ\}}g }|r¤t|ƒ\}}| t|ƒ¡ |s•t|ƒ\}}t|ƒ\}}t|ƒ\}}t|ƒ}t|ƒ\}}t|ƒ}t|ƒ\}}t|ƒ\}}t|ƒ\}}|t	krà|sàt
d
ƒ‚|	d t|ƒ … }t|ƒ\}}t|ƒ t|ƒ\}} |tk�r|tttfv�s|tk�r||k�rtdƒ‚t| ƒ\}!} t| ƒ t||||||||||||||!|||	ƒS t|ƒ |S )NrT   zInvalid line formatr'   r  FTz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)r   r  Ú_SSH_PUBKEY_RCÚmatchrM   ÚgroupÚendswithÚ_CERT_SUFFIXrW   rI   r   r  rb   r  r  r^   ÚErrorrt   r­   rq   rm   r…   r   Ú_parse_exts_optsrZ   rF   r  r�  rM  )"rT   Ú_legacy_dsa_allowedr%  rN   Úorig_key_typeÚkey_bodyÚ	with_certr-  ÚrestÚ	cert_bodyÚinner_key_typerd  rB   rj  Úcctyperm  Ú
principalsrn  Ú	principalrp  ro  Úcrit_optionsrq  Úextsrr  rÞ   Úsig_key_rawÚsig_typeÚsig_keyÚtbs_cert_bodyÚsignature_rawÚinner_sig_typeÚsig_restÚ	signaturer"   r"   r#   Ú_load_ssh_public_identity   s¨   


ÿÿþÿ
ÿïr«  c                 C  s   t | ƒS r�   )r«  rY   r"   r"   r#   Úload_ssh_public_identity_  s   r¬  Ú	exts_optsrY  c                 C  s˜   i }d }| rJt | ƒ\}} t|ƒ}||v rtdƒ‚|d ur$||k r$tdƒ‚t | ƒ\}} t|ƒdkr@t |ƒ\}}t|ƒdkr@tdƒ‚t|ƒ||< |}| s|S )NzDuplicate namezFields not lexically sortedr   z!Unexpected extra data after value)rt   r   rM   rW   )r­  ÚresultÚ	last_namerR   ÚbnameÚvalueÚextrar"   r"   r#   r–  e  s$   ór–  rP  Úhash_algorithmú(hashes.MD5 | hashes.SHA1 | hashes.SHA256c                 C  sn   t |tjtjtjfƒstdƒ‚t| ƒ}t|ƒ}tƒ }| 	|¡ | 
| |¡ | ¡ }t |¡}| |¡ | ¡ S )Nz2hash_algorithm must be either MD5, SHA1, or SHA256)r?   r   ÚMD5r~  r€  r^   rO   r  r}   r”   rÁ   rŸ   ÚHashr  r   )r<   r³  rN   r-  r¿   Ússh_binary_dataÚhash_objr"   r"   r#   Ússh_key_fingerprinty  s   þ


r¹  c                 C  sF   t | dd�}t|tƒr| ¡ }n|}t|tjƒr!tjdtj	dd� |S )NT)r—  r  r  r  )
r«  r?   rM  rB   r   rH   r"  r#  r   r$  )rT   r  Úcert_or_keyrB   r"   r"   r#   Úload_ssh_public_key’  s   

ür»  c                 C  sl   t | tjƒrtjdtjdd� t| ƒ}t|ƒ}t	ƒ }| 
|¡ | | |¡ t | ¡ ¡ ¡ }d |d|g¡S )z&One-line public key format for OpenSSHr8  rf   r  rx   rv  )r?   r   rH   r"  r#  r   r$  rO   r  r}   r”   rÁ   r  rx  rŸ   ÚstripÚjoin)rB   rN   r-  r¿   Úpubr"   r"   r#   Úserialize_ssh_public_key¦  s   ü
r¿  é   c                
   @  s˜   e Zd Zddddg dddg g f
d>dd„Zd?dd„Zd@dd„ZdAd!d"„ZdBd%d&„ZdCd(d)„Zd*d+„ Z	dDd.d/„Z
dEd1d2„ZdFd5d6„ZdFd7d8„ZdGd<d=„ZdS )HÚSSHCertificateBuilderNFrO  úSSHCertPublicKeyTypes | NonerQ  r/   rb  úSSHCertificateType | NonerS  r\   rT  rU  Ú_valid_for_all_principalsr   rW  rV  rX  úlist[tuple[bytes, bytes]]rZ  c                 C  s@   || _ || _|| _|| _|| _|| _|| _|| _|	| _|
| _	d S r�   ©
rO  rQ  rb  rS  rT  rÄ  rW  rV  rX  rZ  )rƒ   rO  rQ  rb  rS  rT  rÄ  rW  rV  rX  rZ  r"   r"   r#   r„   Ç  s   
zSSHCertificateBuilder.__init__rB   rf  r    c                 C  s^   t |tjtjtjfƒstdƒ‚| jd urt	dƒ‚t
|| j| j| j| j| j| j| j| j| jd�
S )Nr>   zpublic_key already setrÆ  )r?   r	   rC   r   rE   r
   rK   r^   rO  rM   rÁ  rQ  rb  rS  rT  rÄ  rW  rV  rX  rZ  )rƒ   rB   r"   r"   r#   rB   ß  s,   ýþ
öz SSHCertificateBuilder.public_keyrj  r   c                 C  sv   t |tƒs	tdƒ‚d|  krdk stdƒ‚ tdƒ‚| jd ur$tdƒ‚t| j|| j| j| j	| j
| j| j| j| jd�
S )Nzserial must be an integerr   ì            z"serial must be between 0 and 2**64zserial already setrÆ  )r?   r   r^   rM   rQ  rÁ  rO  rb  rS  rT  rÄ  rW  rV  rX  rZ  )rƒ   rj  r"   r"   r#   rj  û  s(   
ÿ
özSSHCertificateBuilder.serialrl  rJ  c                 C  sR   t |tƒs	tdƒ‚| jd urtdƒ‚t| j| j|| j| j	| j
| j| j| j| jd�
S )Nz"type must be an SSHCertificateTypeztype already setrÆ  )r?   rJ  r^   rb  rM   rÁ  rO  rQ  rS  rT  rÄ  rW  rV  rX  rZ  )rƒ   rl  r"   r"   r#   rl    s    

özSSHCertificateBuilder.typerm  r   c                 C  sR   t |tƒs	tdƒ‚| jd urtdƒ‚t| j| j| j|| j	| j
| j| j| j| jd�
S )Nzkey_id must be byteszkey_id already setrÆ  )r?   r   r^   rS  rM   rÁ  rO  rQ  rb  rT  rÄ  rW  rV  rX  rZ  )rƒ   rm  r"   r"   r#   rm  #  s    

özSSHCertificateBuilder.key_idrn  c                 C  s|   | j rtdƒ‚tdd„ |D ƒƒr|stdƒ‚| jrtdƒ‚t|ƒtkr'tdƒ‚t| j| j	| j
| j|| j | j| j| j| jd�
S )NzDPrincipals can't be set because the cert is valid for all principalsc                 s  s   � | ]}t |tƒV  qd S r�   )r?   r   )Ú.0rÑ   r"   r"   r#   Ú	<genexpr>?  s   € z9SSHCertificateBuilder.valid_principals.<locals>.<genexpr>z5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsrÆ  )rÄ  rM   Úallr^   rT  rW   Ú_SSHKEY_CERT_MAX_PRINCIPALSrÁ  rO  rQ  rb  rS  rW  rV  rX  rZ  )rƒ   rn  r"   r"   r#   rn  6  s:   ÿÿþÿÿöz&SSHCertificateBuilder.valid_principalsc                 C  sJ   | j rtdƒ‚| jrtdƒ‚t| j| j| j| j| j d| j| j	| j
| jd�
S )Nz@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTrÆ  )rT  rM   rÄ  rÁ  rO  rQ  rb  rS  rW  rV  rX  rZ  r˜   r"   r"   r#   Úvalid_for_all_principalsZ  s$   ÿöz.SSHCertificateBuilder.valid_for_all_principalsro  úint | floatc                 C  sv   t |ttfƒstdƒ‚t|ƒ}|dk s|dkrtdƒ‚| jd ur$tdƒ‚t| j| j| j	| j
| j| j|| j| j| jd�
S )Nz$valid_before must be an int or floatr   rÇ  zvalid_before must [0, 2**64)zvalid_before already setrÆ  )r?   r   Úfloatr^   rM   rW  rÁ  rO  rQ  rb  rS  rT  rÄ  rV  rX  rZ  )rƒ   ro  r"   r"   r#   ro  p  s&   
öz"SSHCertificateBuilder.valid_beforerp  c                 C  sv   t |ttfƒstdƒ‚t|ƒ}|dk s|dkrtdƒ‚| jd ur$tdƒ‚t| j| j| j	| j
| j| j| j|| j| jd�
S )Nz#valid_after must be an int or floatr   rÇ  zvalid_after must [0, 2**64)zvalid_after already setrÆ  )r?   r   rÎ  r^   rM   rV  rÁ  rO  rQ  rb  rS  rT  rÄ  rW  rX  rZ  )rƒ   rp  r"   r"   r#   rp  †  s&   
öz!SSHCertificateBuilder.valid_afterrR   r±  c                 C  st   t |tƒr
t |tƒstdƒ‚|dd„ | jD ƒv rtdƒ‚t| j| j| j| j	| j
| j| j| jg | j¢||f‘| jd�
S )Núname and value must be bytesc                 S  ó   g | ]\}}|‘qS r"   r"   ©rÈ  rR   rÞ   r"   r"   r#   Ú
<listcomp>¢  ó    z=SSHCertificateBuilder.add_critical_option.<locals>.<listcomp>zDuplicate critical option namerÆ  )r?   r   r^   rX  rM   rÁ  rO  rQ  rb  rS  rT  rÄ  rW  rV  rZ  ©rƒ   rR   r±  r"   r"   r#   Úadd_critical_optionœ  s    öz)SSHCertificateBuilder.add_critical_optionc                 C  st   t |tƒr
t |tƒstdƒ‚|dd„ | jD ƒv rtdƒ‚t| j| j| j| j	| j
| j| j| j| jg | j¢||f‘d�
S )NrÏ  c                 S  rÐ  r"   r"   rÑ  r"   r"   r#   rÒ  ¸  rÓ  z7SSHCertificateBuilder.add_extension.<locals>.<listcomp>zDuplicate extension namerÆ  )r?   r   r^   rZ  rM   rÁ  rO  rQ  rb  rS  rT  rÄ  rW  rV  rX  rÔ  r"   r"   r#   Úadd_extension²  s    öz#SSHCertificateBuilder.add_extensionr´   ÚSSHCertPrivateKeyTypesrM  c              	   C  sè  t |tjtjtjfƒstdƒ‚| jd u rt	dƒ‚| j
d u rdn| j
}| jd u r+t	dƒ‚| jd u r2dn| j}| js?| js?t	dƒ‚| jd u rHt	dƒ‚| jd u rQt	dƒ‚| j| jkr[t	d	ƒ‚| jjd
d„ d� | jjdd„ d� t| jƒ}|t }t d¡}t|ƒ}tƒ }| |¡ | |¡ | | j|¡ | |¡ | | jj¡ | |¡ tƒ }	| jD ]}
|	 |
¡ qª| |	 ¡ ¡ | | j¡ | | j¡ tƒ }| jD ]$\}}| |¡ t |ƒdkrêtƒ }| |¡ | | ¡ ¡ qË| |¡ qË| | ¡ ¡ tƒ }| jD ]%\}}| |¡ t |ƒdk�rtƒ }| |¡ | | ¡ ¡ qý| |¡ qý| | ¡ ¡ | d¡ t|ƒ}t|ƒ}tƒ }| |¡ | | !¡ |¡ | | ¡ ¡ t |tjƒ�rq| "| ¡ ¡}tƒ }| |¡ | |¡ | | ¡ ¡ nlt |tjƒ�r³t#|j$ƒ}| "| ¡ t %|¡¡}t& '|¡\}}tƒ }| |¡ tƒ }| (|¡ | (|¡ | | ¡ ¡ | | ¡ ¡ n*t |tjƒ�s¼J ‚tƒ }| t)¡ | "| ¡ t* +¡ t, -¡ ¡}| |¡ | | ¡ ¡ t. /| ¡ ¡ 0¡ }t1 2t3t4d 5|d|g¡ƒ¡S )NzUnsupported private key typezpublic_key must be setr   ztype must be setrx   zAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforec                 S  ó   | d S ©Nr   r"   ©rÑ   r"   r"   r#   Ú<lambda>ó  ó    z,SSHCertificateBuilder.sign.<locals>.<lambda>)r<   c                 S  rØ  rÙ  r"   rÚ  r"   r"   r#   rÛ  ô  rÜ  r6   rv  )6r?   r	   r@   r   rD   r
   rJ   r^   rO  rM   rQ  rb  rS  rT  rÄ  rW  rV  rX  ÚsortrZ  rO   r”  r<  r=  r  r}   r”   rÁ   r�   rŽ   r±  rŸ   rW   rB   Úsignr|  rQ   r}  rz  Údecode_dss_signaturer•   r�  r   rƒ  r   r‚  r  rx  r¼  rg  rh  rM  r¬  r½  )rƒ   r´   rj  rm  rN   Úcert_prefixrd  r-  ÚfÚfprincipalsr¸   ÚfcritrR   r±  ÚfoptvalÚfextÚfextvalÚca_typeÚcaformatÚcafrª  Úfsigr‡  r„  r…  ÚfsigblobÚ	cert_datar"   r"   r#   rÞ  È  sÄ   ýþ

ÿ





















ÿ
þzSSHCertificateBuilder.sign)rO  rÂ  rQ  r/   rb  rÃ  rS  r\   rT  rU  rÄ  r   rW  r/   rV  r/   rX  rÅ  rZ  rÅ  )rB   rf  r    rÁ  )rj  r   r    rÁ  )rl  rJ  r    rÁ  )rm  r   r    rÁ  )rn  rU  r    rÁ  )ro  rÍ  r    rÁ  )rp  rÍ  r    rÁ  )rR   r   r±  r   r    rÁ  )r´   r×  r    rM  )r2   r3   r4   r„   rB   rj  rl  rm  rn  rÌ  ro  rp  rÕ  rÖ  rÞ  r"   r"   r"   r#   rÁ  Æ  s.    õ




$



rÁ  )F)r   r   r   r   r   r   r   r   r   r   r    r   )r<   r=   r    r   )rB   rP   r    r   )rT   rU   r-   r   r    rV   )rT   rU   r    rV   )
r[   r   r   r\   r   r   r   r   r    r]   )rT   rb   r    rc   )rT   rb   r    rr   )rv   r   r    r   )r    rr   )rN   rU   r�   )
rT   rU   r   r\   r  r  r®   r   r    r  )r´   r  r   r   r7  r   r    r   )rQ   r×   r    rŠ  )rT   rU   r    r�  )r­  rb   r    rY  )r<   rP  r³  r´  r    r   )rT   rU   r  r  r    rP  )rB   rP  r    r   )|Ú
__future__r   r  Úenumr<  Úrerg  r"  Údataclassesr   Úcryptographyr   Úcryptography.exceptionsr   Úcryptography.hazmat.primitivesr   Ú)cryptography.hazmat.primitives.asymmetricr   r	   r
   r   r   rz  Ú&cryptography.hazmat.primitives.ciphersr   r   r   r   Ú,cryptography.hazmat.primitives.serializationr   r   r   r   r   r   Úbcryptr   r$   Ú_bcrypt_supportedÚImportErrorrL   rF   rI   r
  Ú_ECDSA_NISTP384Ú_ECDSA_NISTP521r”  Ú_SK_SSH_ED25519Ú_SK_SSH_ECDSA_NISTP256r  r�  Úcompiler�  r  Ú	_SK_STARTÚ_SK_ENDr  r  r9  r:  ÚDOTALLr  rb   r’   Úranger!  r)   ÚAESÚCTRÚCBCÚGCMr8   r5   rS   rO   rA   rX   rZ   ra   rm   rq   rt   rw   r|   r}   r¥   rÆ   rÕ   ré   rý   rÿ   r	  r‹  rŒ  rŽ  r  r  ÚUnionr@   rD   rG   rJ   r  r6  rI  rC   rE   rH   rK   rP  rf  ÚEnumrJ  rM  r|  r«  r¬  r–  r¹  r»  r¿  r×  rË  rÁ  r"   r"   r"   r#   Ú<module>   s.   	ûý
ù	ù	ùí ý











6JFI
Cø
	ýÿýû
rMýÿþÿ 
þ
_

ÿ
þÿ	