a ‚oe_>ã @sddlmZddlZddlmZejrbddlmZddlm Z m Z m Z m Z m Z eje e e e e fZdddd œd d „Zdddd œd d „Zddddœdd„ZdFdddddddddœdd„ZdGdddddddddœdd„ZdHdddddœdd„Zdddœdd „Zdddddddddœd!d"„Zdddddddddœd#d$„Zd%ZdZddd&œd'd(„Zddd)œd*d+„Zddddœd,d-„Zddddd.ddd/œd0d1„Zdd2d3œd4d5„Zddd2d6œd7d8„Z ddd2d9œd:d;„Z!ddd2d<œd=d>„Z"dddd?œd@dA„Z#dIdddddddddœdBdC„Z$dJdddddddddœdDdE„Z%dS)Ké)Ú annotationsN)Ú InvalidTag)ÚBackend©ÚAESCCMÚAESGCMÚAESOCB3ÚAESSIVÚChaCha20Poly1305rÚ _AEADTypesÚbool)ÚbackendÚcipherÚreturncCsddlm}|jjot||ƒS)zz Checks whether the given cipher is supported through EVP_AEAD rather than the normal OpenSSL EVP_CIPHER API. r©r )Ú+cryptography.hazmat.primitives.ciphers.aeadr Ú_libZCryptography_HAS_EVP_AEADÚ isinstance©r rr ©rúJC:\Program Files\Certbot\pkgs\cryptography\hazmat\backends\openssl\aead.pyÚ_is_evp_aead_supported_ciphers  ÿrcCsXt||ƒrdSt|ƒ}|jr*||jvr*dS| d¡r@|jjdkS|j |¡|jj kSdS)NTFó-sivé) rÚ_evp_cipher_cipher_nameZ _fips_enabledZ _fips_aeadÚendswithrZ#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERÚEVP_get_cipherbynameÚ_ffiÚNULL)r rÚ cipher_namerrrÚ_aead_cipher_supported(s    ÿÿr Úbytes©r rÚkeycCs&t||ƒrt|||ƒSt|||ƒSdS©N)rÚ_evp_aead_create_ctxÚ_evp_cipher_create_ctxr"rrrÚ_aead_create_ctx;s  r'ztyping.List[bytes]Úintz typing.Any)r rÚnonceÚdataÚassociated_dataÚ tag_lengthÚctxrcCs6t||ƒrt|||||||ƒSt|||||||ƒSdSr$)rÚ_evp_aead_encryptÚ_evp_cipher_encrypt©r rr)r*r+r,r-rrrÚ_encryptFs ÿÿr1cCs6t||ƒrt|||||||ƒSt|||||||ƒSdSr$)rÚ_evp_aead_decryptÚ_evp_cipher_decryptr0rrrÚ_decryptYs ÿÿr4ztyping.Optional[int])r rr#Útag_lencCstt||ƒ}|dusJ‚|j |¡}|dur2|jjn|}|j ||t|ƒ|¡}| ||jjk¡|j  ||jj ¡}|Sr$) Ú_evp_aead_get_cipherrÚ from_bufferrZEVP_AEAD_DEFAULT_TAG_LENGTHZCryptography_EVP_AEAD_CTX_newÚlenÚopenssl_assertrÚgcZEVP_AEAD_CTX_free)r rr#r5Ú aead_cipherÚkey_ptrr-rrrr%ls   ÿ ý ÿr%)r rcCs$ddlm}t||ƒsJ‚|j ¡S)Nrr)rr rrZEVP_aead_chacha20_poly1305rrrrr6‚s r6c CsÔ|dus J‚t||ƒ}|dus"J‚|j d¡}t|ƒ|j |¡} |j d| ¡} |j |¡} |j |¡} d |¡} |j | ¡}|j || || | t|ƒ| t|ƒ|t| ƒ¡ }|  |dk¡|j  | |d¡dd…}|S)Núsize_t *ú uint8_t[]órr) r6rÚnewr8rZEVP_AEAD_max_overheadr7ÚjoinZEVP_AEAD_CTX_sealr9Úbuffer)r rr)r*r+r,r-r;Úout_lenÚ max_out_lenÚout_bufÚdata_ptrÚ nonce_ptrÚaadÚaad_ptrÚresZencrypted_datarrrr.Œs2        ö r.c CsÈt|ƒ|krt‚|dusJ‚|j d¡}t|ƒ}|j d|¡} |j |¡} |j |¡} d |¡} |j | ¡} |j || ||| t|ƒ| t|ƒ| t| ƒ¡ }|dkrª| ¡t‚|j  | |d¡dd…}|S)Nr=r>r?r) r8rrr@r7rArZEVP_AEAD_CTX_openÚ_consume_errorsrB)r rr)r*r+r,r-rCrDrErFrGrHrIrJZdecrypted_datarrrr2µs6       ö r2r)rrcCsÎddlm}m}m}m}m}t||ƒr*dSt||ƒrPdt|jƒd›d�  d¡St||ƒrvdt|jƒd›d�  d¡St||ƒr dt|jƒdd ›d �  d¡St||ƒs®J‚dt|jƒd›d �  d¡SdS) Nrrschacha20-poly1305zaes-éz-ccmÚasciiz-ocbéz-sivz-gcm) rrrrr r rr8Ú_keyÚencode)rrrrr r rrrrås     r)rr cCsj| d¡rH|j |jj||jj¡}| ||jjk¡|j ||jj¡}n|j |¡}| ||jjk¡|S)Nr) rrZEVP_CIPHER_fetchrrr9r:ZEVP_CIPHER_freer)rr Ú evp_cipherrrrÚ _evp_cipherûs ý rRcCs||j ¡}| ||jjk¡|j ||jj¡}t|ƒ}t||ƒ}|j  |¡}|j  |||jj||jjd¡}| |dk¡|S©Nr) rÚEVP_CIPHER_CTX_newr9rrr:ÚEVP_CIPHER_CTX_freerrRr7ÚEVP_CipherInit_ex)r rr#r-rrQr<rJrrrr& s    úr&ztyping.Optional[bytes])r rr#r)Útagr5Ú operationc Cs.t||ƒ}|j ¡}|j ||jj¡}|j |||jj|jj|jjt|t kƒ¡} |  | dk¡|j  ||jj t |ƒ|jj¡} |  | dk¡|tkr¬|dusžJ‚t|||ƒn2| d¡rÞ|j  ||jj||jj¡} |  | dk¡|j |¡} |j |¡} |j ||jj|jj| | t|t kƒ¡} |  | dk¡|S)Nrs-ccm)rRrrTrr:rUrVrr(Ú_ENCRYPTr9ÚEVP_CIPHER_CTX_ctrlZEVP_CTRL_AEAD_SET_IVLENr8Ú_DECRYPTÚ_evp_cipher_set_tagrÚEVP_CTRL_AEAD_SET_TAGr7) r rr#r)rWr5rXrQr-rJrGr<rrrÚ_evp_cipher_aead_setup"sT   úü  ü   úr^ÚNone)rWrcCs8|j |¡}|j ||jjt|ƒ|¡}| |dk¡dSrS)rr7rrZr]r8r9)r r-rWZtag_ptrrJrrrr\Ys  ÿr\)r)rXrc CsH|j |¡}|j ||jj|jj|jj|t|tkƒ¡}| |dk¡dSrS)rr7rrVrr(rYr9)r r-r)rXrGrJrrrÚ_evp_cipher_set_nonce_operationas  úr`)r Údata_lenrcCs:|j d¡}|j ||jj||jj|¡}| |dk¡dS©Núint *r)rr@rÚEVP_CipherUpdaterr9)r r-raZintptrrJrrrÚ_evp_cipher_set_lengthps  ÿre)r r+rcCsF|j d¡}|j |¡}|j ||jj||t|ƒ¡}| |dk¡dSrb)rr@r7rrdrr8r9)r r-r+ÚoutlenZ a_data_ptrrJrrrÚ_evp_cipher_process_aadxs   ÿrg)r r*rcCsp|j d¡}|j dt|ƒ¡}|j |¡}|j ||||t|ƒ¡}|dkrV| ¡t‚|j ||d¡dd…S)Nrcúunsigned char[]r) rr@r8r7rrdrKrrB)r r-r*rfÚbufrFrJrrrÚ_evp_cipher_process_dataƒs  rjcCsPddlm}m}|dur8t|ƒ} t|| |j|d|tƒ}nt|||tƒt||ƒr`t ||t |ƒƒ|D]} t ||| ƒqdt |||ƒ} |j  d¡} |j  dd¡} |j || | ¡}| |dk¡| |j  | | d¡dd…7} |j  d|¡}|j ||jj||¡}| |dk¡|j  |¡dd…}t||ƒ�rD| t |ƒdk¡|| S| |SdS)Nr©rr rcrhé)rrr rr^rOrYr`rrer8rgrjrr@rÚEVP_CipherFinal_exr9rBrZZEVP_CTRL_AEAD_GET_TAG)r rr)r*r+r,r-rr rÚadÚprocessed_datarfrirJZtag_bufrWrrrr/�sB ù     ÿ r/cCsÀddlm}m}t|ƒ|kr t‚t||ƒrD|d|…} ||d…}n|| d…} |d| …}|durˆt|ƒ} t|| |j|| |t ƒ}nt |||t ƒt ||| ƒt||ƒr¼t ||t|ƒƒ|D]} t ||| ƒqÀt||ƒ�rR|j d¡} |j dt|ƒ¡} |j |¡}|j || | |t|ƒ¡}|dk�r6| ¡t‚|j | | d¡dd…}njt|||ƒ}|j d¡} |j dd¡} |j || | ¡}||j | | d¡dd…7}|dk�r¼| ¡t‚|S)Nrrkrcrhrrl)rrr r8rrrr^rOr[r`r\rergrr@r7rrdrKrBrjrm)r rr)r*r+r,r-rr rWrrnrfriZd_ptrrJrorrrr3ÊsV    ù          r3)N)N)N)N)N)&Z __future__rÚtypingZcryptography.exceptionsrÚ TYPE_CHECKINGZ,cryptography.hazmat.backends.openssl.backendrrrrrr r ÚUnionr rr r'r1r4r%r6r.r2rYr[rrRr&r^r\r`rergrjr/r3rrrrÚsF    ÿùùü ),7 ùBù