관리-도구
편집 파일: ssh.cpython-39.pyc
a �a�U � @ s d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlm Z d dl m Z d dl m Z mZmZmZ d dlmZmZmZ d dlmZmZmZmZ zd dlmZ d Z W n0 e y� d Z dVe e e e e!e d �d d �Z Y n0 dZ"dZ#dZ$dZ%dZ&dZ'dZ(e�)d�Z*dZ+dZ,dZ-dZ.dZ/dZ0d Z1d Z2e�)e,d e- ej3�Z4e5e6e7d d ���Z8ej9d!ej:d fej9d!ej;d fd"�Z<e%e&e'd#�Z=e�>d$�Z?e�>d%�Z@d&d'� ZAe,d( e-d( fd)d*�ZBd+d,� ZCd-d.� ZDd/d0� ZEd1d2� ZFd3d4� ZGd5d6� ZHd7d8� ZId9d:� ZJG d;d<� d<eK�ZLG d=d>� d>eK�ZMG d?d@� d@eK�ZNG dAdB� dBeK�ZOG dCdD� dDeK�ZPe#eM� e$eN� e"eP� e%eOdEe�Q� �e&eOdFe�R� �e'eOdGe�S� �iZTdHdI� ZUejVejWejXe jYejZf Z[dWe ej\e ej]e[dJ�dKdL�Z^dXe[ej\e e dM�dNdO�Z_ejVej`ejae jbejcf ZddYe ej]eddP�dQdR�Zeede dS�dTdU�ZfdS )Z� N)� encodebytes)�utils��UnsupportedAlgorithm)�dsa�ec�ed25519�rsa)�Cipher� algorithms�modes)�Encoding� NoEncryption� PrivateFormat� PublicFormat)�kdfTF)�password�salt�desired_key_bytes�rounds�ignore_few_rounds�returnc C s t d��d S )NzNeed bcrypt moduler )r r r r r � r �V/usr/lib64/python3.9/site-packages/cryptography/hazmat/primitives/serialization/ssh.py� _bcrypt_kdf s r s ssh-ed25519s ssh-rsas ssh-dsss ecdsa-sha2-nistp256s ecdsa-sha2-nistp384s ecdsa-sha2-nistp521s -cert-v01@openssh.coms \A(\S+)[ \t]+(\S+)s openssh-key-v1 s# -----BEGIN OPENSSH PRIVATE KEY-----s! -----END OPENSSH PRIVATE KEY-----s bcrypts none� aes256-ctr� �H s (.*?)� � � )r s aes256-cbc)Z secp256r1Z secp384r1Z secp521r1s >Is >Qc C s( | j }|jtvr td|j ��t|j S )z3Return SSH key_type and curve_name for private key.z)Unsupported curve for ssh private key: %r)�curve�name�_ECDSA_KEY_TYPE� ValueError)� public_keyr! r r r �_ecdsa_key_typeR s �r& � c C s d� |t| �|g�S )N� )�join�_base64_encode)�data�prefix�suffixr r r �_ssh_pem_encode\ s r. c C s | rt | �| dkr td��dS )z Require data to be full blocksr z Corrupt data: missing paddingN)�lenr$ )r+ Z block_lenr r r �_check_block_size` s r0 c C s | r t d��dS )z!All data should have been parsed.zCorrupt data: unparsed dataN)r$ �r+ r r r � _check_emptyf s r2 c C sR |s t d��t| \}}}}t|||| |d�}t||d|� �|||d� ��S )z$Generate key + iv and return cipher.zKey is password-protected.TN)r$ � _SSH_CIPHERSr r ) � ciphernamer r r ZalgoZkey_len�modeZiv_lenZseedr r r � _init_cipherl s r6 c C s6 t | �dk rtd��t�| dd� �d | dd� fS )ZUint32� � Invalid dataNr )r/ r$ �_U32�unpackr1 r r r �_get_u32v s r; c C s6 t | �dk rtd��t�| dd� �d | dd� fS )ZUint64� r8 Nr )r/ r$ �_U64r: r1 r r r �_get_u64} s r> c C s8 t | �\}} |t| �kr td��| d|� | |d� fS )z Bytes with u32 length prefixr8 N)r; r/ r$ )r+ �nr r r � _get_sshstr� s r@ c C s4 t | �\}} |r$|d dkr$td��t�|d�| fS )z Big integer.r � r8 Zbig)r@ r$ �int� from_bytes)r+ �valr r r � _get_mpint� s rE c C s4 | dk rt d��| sdS | �� d d }t�| |�S )z!Storage format for signed bigint.r znegative mpint not allowedr( r< )r$ � bit_lengthr Z int_to_bytes)rD �nbytesr r r � _to_mpint� s rH c @ sT e Zd ZdZddd�Zdd� Zdd� Zd d � Zd d � Zd d� Z ddd�Z dd� Z dS )� _FragListz,Build recursive structure without data copy.Nc C s g | _ |r| j �|� d S �N)�flist�extend)�self�initr r r �__init__� s z_FragList.__init__c C s | j �|� dS )zAdd plain bytesN)rK �append�rM rD r r r �put_raw� s z_FragList.put_rawc C s | j �t�|�� dS )zBig-endian uint32N)rK rP r9 �packrQ r r r �put_u32� s z_FragList.put_u32c C sL t |tttf�r,| �t|�� | j�|� n | �|�� � | j� |j� dS )z Bytes prefixed with u32 lengthN) � isinstance�bytes� memoryview� bytearrayrT r/ rK rP �sizerL rQ r r r � put_sshstr� s z_FragList.put_sshstrc C s | � t|�� dS )z*Big-endian bigint prefixed with u32 lengthN)rZ rH rQ r r r � put_mpint� s z_FragList.put_mpintc C s t tt| j��S )zCurrent number of bytes)�sum�mapr/ rK )rM r r r rY � s z_FragList.sizer c C s2 | j D ]&}t|�}||| }}||||�< q|S )zWrite into bytearray)rK r/ )rM Zdstbuf�pos�fragZflen�startr r r �render� s z_FragList.renderc C s" t t| �� ��}| �|� |�� S )zReturn as bytes)rW rX rY ra �tobytes)rM �bufr r r rb � s z_FragList.tobytes)N)r ) �__name__� __module__� __qualname__�__doc__rO rR rT rZ r[ rY ra rb r r r r rI � s rI c @ s8 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd S ) � _SSHFormatRSAzhFormat for RSA keys. Public: mpint e, n Private: mpint n, e, d, iqmp, p, q c C s$ t |�\}}t |�\}}||f|fS )zRSA public fields�rE )rM r+ �er? r r r � get_public� s z_SSHFormatRSA.get_publicc C s. | � |�\\}}}t�||�}|�� }||fS )z Make RSA public key from data.)rk r �RSAPublicNumbersr% )rM �key_typer+ rj r? �public_numbersr% r r r � load_public� s z_SSHFormatRSA.load_publicc C s� t |�\}}t |�\}}t |�\}}t |�\}}t |�\}}t |�\}}||f|kr\td��t�||�} t�||�} t�||�} t�|||| | || �} | �� } | |fS )z Make RSA private key from data.z Corrupt data: rsa field mismatch)rE r$ r Z rsa_crt_dmp1Z rsa_crt_dmq1rl ZRSAPrivateNumbers� private_key)rM r+ � pubfieldsr? rj �d�iqmp�p�qZdmp1Zdmq1rn �private_numbersrp r r r � load_private� s �z_SSHFormatRSA.load_privatec C s$ |� � }|�|j� |�|j� dS )zWrite RSA public keyN)rn r[ rj r? )rM r% �f_pubZpubnr r r � encode_public� s z_SSHFormatRSA.encode_publicc C sZ |� � }|j}|�|j� |�|j� |�|j� |�|j� |�|j� |�|j� dS )zWrite RSA private keyN) rv rn r[ r? rj rr rs rt ru )rM rp �f_privrv rn r r r �encode_private� s z _SSHFormatRSA.encode_privateN� rd re rf rg rk ro rw ry r{ r r r r rh � s rh c @ s@ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dS )� _SSHFormatDSAzhFormat for DSA keys. Public: mpint p, q, g, y Private: mpint p, q, g, y, x c C s@ t |�\}}t |�\}}t |�\}}t |�\}}||||f|fS )zDSA public fieldsri )rM r+ rt ru �g�yr r r rk s z_SSHFormatDSA.get_publicc C sJ | � |�\\}}}}}t�|||�}t�||�}| �|� |�� } | |fS )z Make DSA public key from data.)rk r �DSAParameterNumbers�DSAPublicNumbers� _validater% ) rM rm r+ rt ru r~ r �parameter_numbersrn r% r r r ro s z_SSHFormatDSA.load_publicc C sz | � |�\\}}}}}t|�\}}||||f|kr:td��t�|||�}t�||�} | �| � t�|| �} | �� } | |fS )z Make DSA private key from data.z Corrupt data: dsa field mismatch) rk rE r$ r r� r� r� ZDSAPrivateNumbersrp ) rM r+ rq rt ru r~ r �xr� rn rv rp r r r rw & s z_SSHFormatDSA.load_privatec C sL |� � }|j}| �|� |�|j� |�|j� |�|j� |�|j� dS )zWrite DSA public keyN)rn r� r� r[ rt ru r~ r )rM r% rx rn r� r r r ry 4 s z_SSHFormatDSA.encode_publicc C s$ | � |�� |� |�|�� j� dS )zWrite DSA private keyN)ry r% r[ rv r� )rM rp rz r r r r{ ? s z _SSHFormatDSA.encode_privatec C s |j }|j�� dkr td��d S )Ni z#SSH supports only 1024 bit DSA keys)r� rt rF r$ )rM rn r� r r r r� D s z_SSHFormatDSA._validateN) rd re rf rg rk ro rw ry r{ r� r r r r r} s r} c @ s@ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dS )�_SSHFormatECDSAz�Format for ECDSA keys. Public: str curve bytes point Private: str curve bytes point mpint secret c C s || _ || _d S rJ )�ssh_curve_namer! )rM r� r! r r r rO V s z_SSHFormatECDSA.__init__c C sJ t |�\}}t |�\}}|| jkr*td��|d dkr>td��||f|fS )zECDSA public fieldszCurve name mismatchr r7 zNeed uncompressed point)r@ r� r$ �NotImplementedError)rM r+ r! �pointr r r rk Z s z_SSHFormatECDSA.get_publicc C s. | � |�\\}}}tj�| j|�� �}||fS )z Make ECDSA public key from data.)rk r �EllipticCurvePublicKeyZfrom_encoded_pointr! rb )rM rm r+ � curve_namer� r% r r r ro d s �z_SSHFormatECDSA.load_publicc C sH | � |�\\}}}t|�\}}||f|kr2td��t�|| j�}||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)rk rE r$ r Zderive_private_keyr! )rM r+ rq r� r� �secretrp r r r rw l s z _SSHFormatECDSA.load_privatec C s* |� tjtj�}|�| j� |�|� dS )zWrite ECDSA public keyN)� public_bytesr ZX962r ZUncompressedPointrZ r� )rM r% rx r� r r r ry v s � z _SSHFormatECDSA.encode_publicc C s, |� � }|�� }| �||� |�|j� dS )zWrite ECDSA private keyN)r% rv ry r[ Z private_value)rM rp rz r% rv r r r r{ ~ s z _SSHFormatECDSA.encode_privateN) rd re rf rg rO rk ro rw ry r{ r r r r r� J s r� c @ s8 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd S ) �_SSHFormatEd25519z~Format for Ed25519 keys. Public: bytes point Private: bytes point bytes secret_and_point c C s t |�\}}|f|fS )zEd25519 public fields)r@ )rM r+ r� r r r rk � s z _SSHFormatEd25519.get_publicc C s( | � |�\\}}tj�|�� �}||fS )z"Make Ed25519 public key from data.)rk r �Ed25519PublicKeyZfrom_public_bytesrb )rM rm r+ r� r% r r r ro � s �z _SSHFormatEd25519.load_publicc C sb | � |�\\}}t|�\}}|dd� }|dd� }||ksF|f|krNtd��tj�|�}||fS )z#Make Ed25519 private key from data.Nr z$Corrupt data: ed25519 field mismatch)rk r@ r$ r �Ed25519PrivateKeyZfrom_private_bytes)rM r+ rq r� Zkeypairr� Zpoint2rp r r r rw � s z _SSHFormatEd25519.load_privatec C s |� tjtj�}|�|� dS )zWrite Ed25519 public keyN)r� r �Rawr rZ )rM r% rx �raw_public_keyr r r ry � s �z _SSHFormatEd25519.encode_publicc C sR |� � }|�tjtjt� �}|�tjtj�}t||g�}| � ||� |� |� dS )zWrite Ed25519 private keyN) r% Z private_bytesr r� r r r� r rI ry rZ )rM rp rz r% Zraw_private_keyr� Z f_keypairr r r r{ � s �� z _SSHFormatEd25519.encode_privateNr| r r r r r� � s r� s nistp256s nistp384s nistp521c C s6 t | t�st| ��� } | tv r&t| S td| ��dS )z"Return valid format or throw errorzUnsupported key type: %rN)rU rV rW rb � _KEY_FORMATSr )rm r r r �_lookup_kformat� s r� )r+ r �backendr c C sF t �d| � |dur t �d|� t�| �}|s6td��|�d�}|�d�}t� t | �||� �} | � t �srtd��t | �t t �d� } t| �\}} t| �\}} t| �\}} t| �\} } | dkr�td��t| �\} } t| �\} } t| �} | �| �\} } t| � t| �\}} t| � ||fttfk�r�|�� }|tv�r@td| ��|tk�rVtd| ��t| d }t||� t|�\}}t|�\}}t|� t|||�� |�}t |�� �|��}nd }t||� t|�\}}t|�\}}||k�r�td ��t|�\}}|| k�rtd ��| � || �\}}t|�\}}|t dt |�� k�rBtd ��|S )z.Load private key from OpenSSH custom encoding.r+ Nr z Not OpenSSH private key formatr zOnly one key supportedzUnsupported cipher: %rzUnsupported KDF: %r� r< z Corrupt data: broken checksumz Corrupt data: key type mismatchz Corrupt data: invalid padding) r �_check_byteslike� _check_bytes�_PEM_RC�searchr$ r` �end�binascii� a2b_base64rW � startswith� _SK_MAGICr/ r@ r; r� rk r2 �_NONErb r3 r �_BCRYPTr0 r6 Z decryptor�updaterw �_PADDING)r+ r r� �mZp1Zp2r4 �kdfnameZ kdfoptions�nkeysZpubdataZ pub_key_type�kformatrq Zedata�blklenr Zkbufr �ciphZck1Zck2rm rp �commentr r r �load_ssh_private_key� sh r� )rp r r c C s4 |durt �d|� |r,t|�tkr,td��t| tj�rFt| � � �}n>t| t j �rXt }n,t| t j�rjt}nt| tj�r|t}ntd��t|�}t� }|r�t}t| d }t}t}t�d�} |�| � |� |� t ||| |�} nt }}d}d} d} t�d �} d } t� }|�|� |� | � � |� t| | g�}|�|� |� | |� |�| � |�!t"d||�#� | � � t� }|�!t$� |�|� |�|� |�|� |� | � |�|� |�|� |�#� }|�#� }t%t&|| ��}|�'|� || }| du�r| �(� �)|||� ||d� � t*|d|� �}t&|�|||�< |S ) z3Serialize private key with OpenSSH custom encoding.Nr zNPasswords longer than 72 bytes are not supported by OpenSSH private key format�Unsupported key typer� r r< r r7 r( )+r r� r/ � _MAX_PASSWORDr$ rU r �EllipticCurvePrivateKeyr& r% r � RSAPrivateKey�_SSH_RSAr � DSAPrivateKey�_SSH_DSAr r� � _SSH_ED25519r� rI �_DEFAULT_CIPHERr3 r� �_DEFAULT_ROUNDS�os�urandomrZ rT r6 r� ry r{ rR r� rY r� rW rX ra Z encryptorZ update_intor. )rp r rm r� Z f_kdfoptionsr4 r� r� r r r� r� Zcheckvalr� Z f_public_keyZ f_secretsZf_mainZslen�mlenrc ZofsZtxtr r r �serialize_ssh_private_key& st � r� )r+ r� r c C sx t �d| � t�| �}|s"td��|�d� }}|�d�}d}t|tt� d� krjd}|dtt� � }t|�}zt t � |��} W n t t j fy� td��Y n0 t| �\}} ||kr�td��|r�t| �\} } |�|| �\} } |�rlt| �\} } t| �\} } t| �\} } t| �\}} t| �\}} t| �\}} t| �\}} t| �\}} t| �\}} t| �\}} t| �\}} t| � | S ) z-Load public key from OpenSSH one-line format.r+ zInvalid line formatr � FNTzInvalid key format)r r� �_SSH_PUBKEY_RC�matchr$ �group� _CERT_SUFFIXr/ r� rW r� r� � TypeError�Errorr@ ro r> r; r2 )r+ r� r� rm Z orig_key_typeZkey_bodyZ with_certr� Zinner_key_typeZnoncer% �serialZcctypeZkey_idZ principalsZ valid_afterZ valid_beforeZ crit_options� extensionsZreservedZsig_keyZ signaturer r r �load_ssh_public_key� sF r� )r% r c C s� t | tj�rt| �}n>t | tj�r(t}n,t | tj�r:t }nt | t j �rLt }nt d��t|�}t� }|�|� |�| |� t�|�� ��� }d�|d|g�S )z&One-line public key format for OpenSSHr� r( � )rU r r� r& r � RSAPublicKeyr� r � DSAPublicKeyr� r r� r� r$ r� rI rZ ry r� Z b2a_base64rb �stripr) )r% rm r� rx Zpubr r r �serialize_ssh_public_key� s r� )F)N)N)N)gr� r� �re�struct�typing�base64r r* Z cryptographyr Zcryptography.exceptionsr Z)cryptography.hazmat.primitives.asymmetricr r r r Z&cryptography.hazmat.primitives.ciphersr r r Z,cryptography.hazmat.primitives.serializationr r r r Zbcryptr r Z_bcrypt_supported� ImportErrorrV rB �boolr� r� r� Z_ECDSA_NISTP256Z_ECDSA_NISTP384Z_ECDSA_NISTP521r� �compiler� r� Z _SK_STARTZ_SK_ENDr� r� r� r� r� �DOTALLr� rW rX �ranger� ZAESZCTRZCBCr3 r# �Structr9 r= r& r. r0 r2 r6 r; r> r@ rE rH �objectrI rh r} r� r� Z SECP256R1Z SECP384R1Z SECP521R1r� r� �Unionr� r� r� r� Z_SSH_PRIVATE_KEY_TYPES�Optional�Anyr� r� r� r� r� r� Z_SSH_PUBLIC_KEY_TYPESr� r� r r r r �<module> s� �� �� 0>>=:� �� �� M �� T�� �� ,