a oe_> @sddlmZddlZddlmZejrbddlmZddlm Z m Z m Z m Z m Z eje e e e e fZdddd d d Zdddd d d ZddddddZdFdddddddddddZdGdddddddddddZdHdddddddZddddd Zdddddddddd!d"Zdddddddddd#d$Zd%ZdZddd&d'd(Zddd)d*d+Zddddd,d-Zddddd.ddd/d0d1Zdd2d3d4d5Zddd2d6d7d8Z ddd2d9d:d;Z!ddd2d<d=d>Z"dddd?d@dAZ#dIddddddddddBdCZ$dJddddddddddDdEZ%dS)K) annotationsN) InvalidTag)BackendAESCCMAESGCMAESOCB3AESSIVChaCha20Poly1305r _AEADTypesbool)backendcipherreturncCsddlm}|jjot||S)zz Checks whether the given cipher is supported through EVP_AEAD rather than the normal OpenSSL EVP_CIPHER API. rr )+cryptography.hazmat.primitives.ciphers.aeadr _libZCryptography_HAS_EVP_AEAD isinstancer rr rJC:\Program Files\Certbot\pkgs\cryptography\hazmat\backends\openssl\aead.py_is_evp_aead_supported_ciphers  rcCsXt||rdSt|}|jr*||jvr*dS|dr@|jjdkS|j||jj kSdS)NTF-siv) r_evp_cipher_cipher_nameZ _fips_enabledZ _fips_aeadendswithrZ#CRYPTOGRAPHY_OPENSSL_300_OR_GREATEREVP_get_cipherbyname_ffiNULL)r r cipher_namerrr_aead_cipher_supported(s    r bytesr rkeycCs&t||rt|||St|||SdSN)r_evp_aead_create_ctx_evp_cipher_create_ctxr"rrr_aead_create_ctx;s  r'ztyping.List[bytes]intz typing.Any)r rnoncedataassociated_data tag_lengthctxrcCs6t||rt|||||||St|||||||SdSr$)r_evp_aead_encrypt_evp_cipher_encryptr rr)r*r+r,r-rrr_encryptFs r1cCs6t||rt|||||||St|||||||SdSr$)r_evp_aead_decrypt_evp_cipher_decryptr0rrr_decryptYs r4ztyping.Optional[int])r rr#tag_lencCstt||}|dusJ|j|}|dur2|jjn|}|j||t||}|||jjk|j ||jj }|Sr$) _evp_aead_get_cipherr from_bufferrZEVP_AEAD_DEFAULT_TAG_LENGTHZCryptography_EVP_AEAD_CTX_newlenopenssl_assertrgcZEVP_AEAD_CTX_free)r rr#r5 aead_cipherkey_ptrr-rrrr%ls     r%)r rcCs$ddlm}t||sJ|jS)Nrr)rr rrZEVP_aead_chacha20_poly1305rrrrr6s r6c Cs|dus Jt||}|dus"J|jd}t||j|} |jd| } |j|} |j|} d|} |j| }|j|| || | t|| t||t|  }| |dk|j | |ddd}|S)Nsize_t * uint8_t[]rr) r6rnewr8rZEVP_AEAD_max_overheadr7joinZEVP_AEAD_CTX_sealr9buffer)r rr)r*r+r,r-r;out_len max_out_lenout_bufdata_ptr nonce_ptraadaad_ptrresZencrypted_datarrrr.s2         r.c Cst||krt|dusJ|jd}t|}|jd|} |j|} |j|} d|} |j| } |j|| ||| t|| t|| t|  }|dkr|t|j | |ddd}|S)Nr=r>r?r) r8rrr@r7rArZEVP_AEAD_CTX_open_consume_errorsrB)r rr)r*r+r,r-rCrDrErFrGrHrIrJZdecrypted_datarrrr2s6        r2r)rrcCsddlm}m}m}m}m}t||r*dSt||rPdt|jdd dSt||rvdt|jdd dSt||rdt|jdd d  dSt||sJdt|jdd  dSdS) Nrrschacha20-poly1305zaes-z-ccmasciiz-ocbz-sivz-gcm) rrrrr r rr8_keyencode)rrrrr r rrrrs     r)rr cCsj|drH|j|jj||jj}|||jjk|j||jj}n|j|}|||jjk|S)Nr) rrZEVP_CIPHER_fetchrrr9r:ZEVP_CIPHER_freer)rr evp_cipherrrr _evp_ciphers  rRcCs||j}|||jjk|j||jj}t|}t||}|j |}|j |||jj||jjd}||dk|SNr) rEVP_CIPHER_CTX_newr9rrr:EVP_CIPHER_CTX_freerrRr7EVP_CipherInit_ex)r rr#r-rrQr<rJrrrr& s    r&ztyping.Optional[bytes])r rr#r)tagr5 operationc Cs.t||}|j}|j||jj}|j|||jj|jj|jjt|t k} | | dk|j ||jj t ||jj} | | dk|tkr|dusJt|||n2|dr|j ||jj||jj} | | dk|j|} |j|} |j||jj|jj| | t|t k} | | dk|S)Nrs-ccm)rRrrTrr:rUrVrr(_ENCRYPTr9EVP_CIPHER_CTX_ctrlZEVP_CTRL_AEAD_SET_IVLENr8_DECRYPT_evp_cipher_set_tagrEVP_CTRL_AEAD_SET_TAGr7) r rr#r)rWr5rXrQr-rJrGr<rrr_evp_cipher_aead_setup"sT        r^None)rWrcCs8|j|}|j||jjt||}||dkdSrS)rr7rrZr]r8r9)r r-rWZtag_ptrrJrrrr\Ys  r\)r)rXrc CsH|j|}|j||jj|jj|jj|t|tk}||dkdSrS)rr7rrVrr(rYr9)r r-r)rXrGrJrrr_evp_cipher_set_nonce_operationas  r`)r data_lenrcCs:|jd}|j||jj||jj|}||dkdSNint *r)rr@rEVP_CipherUpdaterr9)r r-raZintptrrJrrr_evp_cipher_set_lengthps  re)r r+rcCsF|jd}|j|}|j||jj||t|}||dkdSrb)rr@r7rrdrr8r9)r r-r+outlenZ a_data_ptrrJrrr_evp_cipher_process_aadxs   rg)r r*rcCsp|jd}|jdt|}|j|}|j||||t|}|dkrV|t|j||dddS)Nrcunsigned char[]r) rr@r8r7rrdrKrrB)r r-r*rfbufrFrJrrr_evp_cipher_process_datas  rjcCsPddlm}m}|dur8t|} t|| |j|d|t}nt|||tt||r`t ||t ||D]} t ||| qdt |||} |j d} |j dd} |j|| | }||dk| |j | | ddd7} |j d|}|j||jj||}||dk|j |dd}t||rD|t |dk|| S| |SdS)Nrrr rcrh)rrr rr^rOrYr`rrer8rgrjrr@rEVP_CipherFinal_exr9rBrZZEVP_CTRL_AEAD_GET_TAG)r rr)r*r+r,r-rr radprocessed_datarfrirJZtag_bufrWrrrr/sB       r/cCsddlm}m}t||kr tt||rD|d|} ||d}n|| d} |d| }|durt|} t|| |j|| |t }nt |||t t ||| t||rt ||t||D]} t ||| qt||rR|jd} |jdt|} |j|}|j|| | |t|}|dkr6|t|j| | ddd}njt|||}|jd} |jdd} |j|| | }||j| | ddd7}|dkr|t|S)Nrrkrcrhrrl)rrr r8rrrr^rOr[r`r\rergrr@r7rrdrKrBrjrm)r rr)r*r+r,r-rr rWrrnrfriZd_ptrrJrorrrr3sV              r3)N)N)N)N)N)&Z __future__rtypingZcryptography.exceptionsr TYPE_CHECKINGZ,cryptography.hazmat.backends.openssl.backendrrrrrr r Unionr rr r'r1r4r%r6r.r2rYr[rrRr&r^r\r`rergrjr/r3rrrrsF     ),7 B