3
l_T @ s d dl mZmZmZ d dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z d dl
mZ d dlmZmZmZmZ d dlmZmZmZ d dlmZmZmZm Z yd d l m Z d
Z W n e!k
r d Z d d
Z Y nX yd dl"m#Z$ W n" e!k
r d dl"m%Z$ Y nX dZ&dZ'dZ(dZ)dZ*dZ+dZ,ej-dZ.dZ/dZ0dZ1dZ2d Z3d Z4d Z5d Z6ej-e0d e1 ej7Z8e9e:e;d!dSZd fej=d"ej?d fd#Z@e)e*e+d$ZAejBd%ZCejBd&ZDd'd( ZEe0d) e1d) fd*d+ZFd,d- ZGd.d/ ZHd0d1 ZId2d3 ZJd4d5 ZKd6d7 ZLd8d9 ZMd:d; ZNG dd? d?eOZQG d@dA dAeOZRG dBdC dCeOZSG dDdE dEeOZTe'eQ e(eR e&eT e)eSdFejU e*eSdGejV e+eSdHejW iZXdIdJ ZYdTdKdLZZdUdMdNZ[dVdOdPZ\dQdR Z]dS )W )absolute_importdivisionprint_functionN)utils)UnsupportedAlgorithm) _get_backend)dsaeced25519rsa)Cipher
algorithmsmodes)Encoding NoEncryption
PrivateFormat PublicFormat)kdfTFc O s t dd S )NzNeed bcrypt module)r )argskwargs r /usr/lib64/python3.6/ssh.py _bcrypt_kdf! s r ) encodebytes) encodestrings ssh-ed25519s ssh-rsas ssh-dsss ecdsa-sha2-nistp256s ecdsa-sha2-nistp384s ecdsa-sha2-nistp521s -cert-v01@openssh.coms \A(\S+)[ \t]+(\S+)s openssh-key-v1 s# -----BEGIN OPENSSH PRIVATE KEY-----s! -----END OPENSSH PRIVATE KEY-----s bcrypts nones
aes256-ctr H s (.*?) )s
aes256-ctrs
aes256-cbc)Z secp256r1Z secp384r1Z secp521r1s >Is >Qc C s( | j }|jtkr td|j t|j S )z3Return SSH key_type and curve_name for private key.z)Unsupported curve for ssh private key: %r)curvename_ECDSA_KEY_TYPE
ValueError)
public_keyr r r r _ecdsa_key_typeS s
r$
c C s dj |t| |gS )N )join_base64_encode)dataprefixsuffixr r r _ssh_pem_encode] s r, c C s" | st | | dkr tddS )z Require data to be full blocksr z Corrupt data: missing paddingN)lenr" )r) Z block_lenr r r _check_block_sizea s r. c C s | r t ddS )z!All data should have been parsed.zCorrupt data: unparsed dataN)r" )r) r r r _check_emptyg s r/ c
C sT |s t dt| \}}}}t|||| |d} t|| d| || |d |S )z$Generate key + iv and return cipher.zKey is password-protected.TN)r" _SSH_CIPHERSr r )
ciphernamepasswordsaltroundsbackendZalgoZkey_lenmodeZiv_lenZseedr r r _init_cipherm s
r7 c C s6 t | dk rtdtj| dd d | dd fS )ZUint32 z Invalid dataNr )r- r" _U32unpack)r) r r r _get_u32w s r; c C s6 t | dk rtdtj| dd d | dd fS )ZUint64 z Invalid dataNr )r- r" _U64r: )r) r r r _get_u64~ s r> c C s8 t | \}} |t| kr td| d| | |d fS )z Bytes with u32 length prefixz Invalid dataN)r; r- r" )r) nr r r _get_sshstr s r@ c C s8 t | \}} |r(tj|ddkr(tdtj|d| fS )z Big integer.r z Invalid dataZbig)r@ six
indexbytesr" r Zint_from_bytes)r) valr r r
_get_mpint s rE c C s4 | dk rt d| sdS | j d d }tj| |S )z!Storage format for signed bigint.r znegative mpint not allowedr& r< )r"
bit_lengthr Z int_to_bytes)rD nbytesr r r _to_mpint s rH c @ sT e Zd ZdZdddZdd Zdd Zd d
Zd d Zd
d Z dddZ
dd Z dS ) _FragListz,Build recursive structure without data copy.Nc C s g | _ |r| j j| d S )N)flistextend)selfZinitr r r __init__ s z_FragList.__init__c C s | j j| dS )zAdd plain bytesN)rJ append)rL rD r r r put_raw s z_FragList.put_rawc C s | j jtj| dS )zBig-endian uint32N)rJ rN r9 pack)rL rD r r r put_u32 s z_FragList.put_u32c C sL t |tttfr,| jt| | jj| n | j|j | jj |j dS )z Bytes prefixed with u32 lengthN)
isinstancebytes
memoryview bytearrayrQ r- rJ rN sizerK )rL rD r r r
put_sshstr s
z_FragList.put_sshstrc C s | j t| dS )z*Big-endian bigint prefixed with u32 lengthN)rW rH )rL rD r r r put_mpint s z_FragList.put_mpintc C s t tt| jS )zCurrent number of bytes)summapr- rJ )rL r r r rV s z_FragList.sizer c C s6 x0| j D ]&}t|}||| }}||||< qW |S )zWrite into bytearray)rJ r- )rL ZdstbufposZfragZflenstartr r r render s
z_FragList.renderc C s" t t| j }| j| |j S )zReturn as bytes)rT rU rV r] tobytes)rL bufr r r r^ s
z_FragList.tobytes)N)r ) __name__
__module__ __qualname____doc__rM rO rQ rW rX rV r] r^ r r r r rI s
rI c @ s8 e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd S )
_SSHFormatRSAzhFormat for RSA keys.
Public:
mpint e, n
Private:
mpint n, e, d, iqmp, p, q
c C s$ t |\}}t |\}}||f|fS )zRSA public fields)rE )rL r) er? r r r
get_public s z_SSHFormatRSA.get_publicc C s0 | j |\\}}}tj||}|j|}||fS )z Make RSA public key from data.)rf r RSAPublicNumbersr# )rL key_typer) r5 re r? public_numbersr# r r r load_public s
z_SSHFormatRSA.load_publicc C s t |\}}t |\}}t |\}}t |\}}t |\}}t |\} }||f|kr\tdtj||}
tj|| } tj||} tj|| ||
| || }
|
j|}||fS )z Make RSA private key from data.z Corrupt data: rsa field mismatch)rE r" r Z rsa_crt_dmp1Z rsa_crt_dmq1rg ZRSAPrivateNumbers private_key)rL r) pubfieldsr5 r? re diqmppqZdmp1Zdmq1ri private_numbersrk r r r load_private s
z_SSHFormatRSA.load_privatec C s$ |j }|j|j |j|j dS )zWrite RSA public keyN)ri rX re r? )rL r# f_pubZpubnr r r
encode_public s z_SSHFormatRSA.encode_publicc C sZ |j }|j}|j|j |j|j |j|j |j|j |j|j |j|j dS )zWrite RSA private keyN) rq ri rX r? re rm rn ro rp )rL rk f_privrq ri r r r encode_private s z _SSHFormatRSA.encode_privateN) r` ra rb rc rf rj rr rt rv r r r r rd s rd c @ s@ e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd d
Z dS )
_SSHFormatDSAzhFormat for DSA keys.
Public:
mpint p, q, g, y
Private:
mpint p, q, g, y, x
c C s@ t |\}}t |\}}t |\}}t |\}}||||f|fS )zDSA public fields)rE )rL r) ro rp gyr r r rf s
z_SSHFormatDSA.get_publicc C sL | j |\\}}}}}tj|||}tj||} | j| | j|}
|
|fS )z Make DSA public key from data.)rf r DSAParameterNumbersDSAPublicNumbers _validater# ) rL rh r) r5 ro rp rx ry parameter_numbersri r# r r r rj s
z_SSHFormatDSA.load_publicc
C s| | j |\\}}}}}t|\}}||||f|kr:tdtj|||} tj|| }
| j|
tj||
} | j|} | |fS )z Make DSA private key from data.z Corrupt data: dsa field mismatch) rf rE r" r rz r{ r| ZDSAPrivateNumbersrk )
rL r) rl r5 ro rp rx ry xr} ri rq rk r r r rr ' s
z_SSHFormatDSA.load_privatec C sL |j }|j}| j| |j|j |j|j |j|j |j|j dS )zWrite DSA public keyN)ri r} r| rX ro rp rx ry )rL r# rs ri r} r r r rt 5 s
z_SSHFormatDSA.encode_publicc C s$ | j |j | |j|j j dS )zWrite DSA private keyN)rt r# rX rq r~ )rL rk ru r r r rv @ s z _SSHFormatDSA.encode_privatec C s |j }|jj dkr tdd S )Ni z#SSH supports only 1024 bit DSA keys)r} ro rF r" )rL ri r} r r r r| E s z_SSHFormatDSA._validateN)
r` ra rb rc rf rj rr rt rv r| r r r r rw
s rw c @ s@ e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd d
Z dS )_SSHFormatECDSAzFormat for ECDSA keys.
Public:
str curve
bytes point
Private:
str curve
bytes point
mpint secret
c C s || _ || _d S )N)ssh_curve_namer )rL r r r r r rM W s z_SSHFormatECDSA.__init__c C sN t |\}}t |\}}|| jkr*tdtj|ddkrBtd||f|fS )zECDSA public fieldszCurve name mismatchr r8 zNeed uncompressed point)r@ r r" rB rC NotImplementedError)rL r) r pointr r r rf [ s
z_SSHFormatECDSA.get_publicc C s. | j |\\}}}tjj| j|j }||fS )z Make ECDSA public key from data.)rf r EllipticCurvePublicKeyZfrom_encoded_pointr r^ )rL rh r) r5
curve_namer r# r r r rj e s z_SSHFormatECDSA.load_publicc C sJ | j |\\}}}t|\}}||f|kr2tdtj|| j|}||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)rf rE r" r Zderive_private_keyr )rL r) rl r5 r r secretrk r r r rr m s z _SSHFormatECDSA.load_privatec C s* |j tjtj}|j| j |j| dS )zWrite ECDSA public keyN) public_bytesr ZX962r ZUncompressedPointrW r )rL r# rs r r r r rt w s z _SSHFormatECDSA.encode_publicc C s, |j }|j }| j|| |j|j dS )zWrite ECDSA private keyN)r# rq rt rX Z
private_value)rL rk ru r# rq r r r rv s z _SSHFormatECDSA.encode_privateN)
r` ra rb rc rM rf rj rr rt rv r r r r r K s
r c @ s8 e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd S )
_SSHFormatEd25519z~Format for Ed25519 keys.
Public:
bytes point
Private:
bytes point
bytes secret_and_point
c C s t |\}}|f|fS )zEd25519 public fields)r@ )rL r) r r r r rf s z _SSHFormatEd25519.get_publicc C s( | j |\\}}tjj|j }||fS )z"Make Ed25519 public key from data.)rf r
Ed25519PublicKeyZfrom_public_bytesr^ )rL rh r) r5 r r# r r r rj s
z _SSHFormatEd25519.load_publicc C sb | j |\\}}t|\}}|dd }|dd }||ksF|f|krNtdtjj|}||fS )z#Make Ed25519 private key from data.Nr z$Corrupt data: ed25519 field mismatch)rf r@ r" r
Ed25519PrivateKeyZfrom_private_bytes) rL r) rl r5 r Zkeypairr Zpoint2rk r r r rr s z _SSHFormatEd25519.load_privatec C s |j tjtj}|j| dS )zWrite Ed25519 public keyN)r r Rawr rW )rL r# rs raw_public_keyr r r rt s z _SSHFormatEd25519.encode_publicc C sR |j }|jtjtjt }|jtjtj}t||g}| j || |j
| dS )zWrite Ed25519 private keyN) r# Z
private_bytesr r r r r r rI rt rW )rL rk ru r# Zraw_private_keyr Z f_keypairr r r rv s z _SSHFormatEd25519.encode_privateN) r` ra rb rc rf rj rr rt rv r r r r r s r s nistp256s nistp384s nistp521c C s6 t | tst| j } | tkr&t| S td| dS )z"Return valid format or throw errorzUnsupported key type: %rN)rR rS rT r^ _KEY_FORMATSr )rh r r r _lookup_kformat s
r c C sR t jd| t|}|dk r(t jd| tj| }|s>td|jd}|jd}t j
t | || } | j t
sztdt | tt
d } t| \}} t| \}} t| \}} t| \} } | dkrtdt| \}
} t|
\} }
t| } | j|
\}
}
t|
t| \}} t| ||fttfkr|j }|tkrHtd| |tkr^td| t| d }t|| t|\}}t|\}}t| t|||j ||}t |j j |}nd
}t|| t|\}}t|\}}||krtd t|\}}|| krtd | j ||
|\}}t|\}}|t dt| krNtd
|S )z.Load private key from OpenSSH custom encoding.r) Nr2 z Not OpenSSH private key formatr zOnly one key supportedzUnsupported cipher: %rzUnsupported KDF: %r r< z Corrupt data: broken checksumz Corrupt data: key type mismatchz Corrupt data: invalid padding) r _check_bytesliker _check_bytes_PEM_RCsearchr" r\ endbinascii
a2b_base64rT
startswith _SK_MAGICr- r@ r; r rf r/ _NONEr^ r0 r _BCRYPTr. r7 Z decryptorupdaterr _PADDING)r) r2 r5 mZp1Zp2r1 kdfnameZ
kdfoptionsnkeysZpubdataZ pub_key_typekformatrl Zedatablklenr3 Zkbufr4 ciphZck1Zck2rh rk commentr r r load_ssh_private_key sl
r c C s> |dk rt jd| |r,t|tkr,tdt| tjrFt| j }n>t| t
j rXt }n,t| t
jrjt}nt| tjr|t}ntdt|}t }|rt}t| d }t}t}tjd} |j| |j | t d}
t ||| ||
} nt }}d}d} d} tjd }
d
}t }|j| |j | j | t|
|
g}|j| |j!| | |j| |j"t#d||j$ | t }|j"t% |j| |j| |j| |j | |j| |j| |j$ }|j$ }t&t'|| }|j(| || }| dk r| j) j*||| ||d t+|d| }t'||||< |S ) z3Serialize private key with OpenSSH custom encoding.Nr2 zNPasswords longer than 72 bytes are not supported by OpenSSH private key formatzUnsupported key typer r r< r r8 r& ),r r r-
_MAX_PASSWORDr" rR r ZEllipticCurvePrivateKeyr$ r# r Z
RSAPrivateKey_SSH_RSAr Z
DSAPrivateKey_SSH_DSAr
r _SSH_ED25519r rI _DEFAULT_CIPHERr0 r _DEFAULT_ROUNDSosurandomrW rQ r r7 r rt rv rO r rV r rT rU r] Z encryptorZ update_intor, )rk r2 rh r Z f_kdfoptionsr1 r r r4 r3 r5 r r Zcheckvalr Z f_public_keyZ f_secretsZf_mainZslenZmlenr_ ZofsZtxtr r r serialize_ssh_private_key st
r c C s t |}tjd| tj| }|s*td|jd }}|jd}d}t|tt d krrd}|dtt }t |}yt
t j |} W n" t
t jfk
r tdY nX t| \}} ||krtd|rt| \} } |j|| |\}
} |rxt| \} } t| \} } t| \}
} t| \}} t| \}} t| \}} t| \}} t| \}} t| \}} t| \}} t| \}} t| |
S ) z-Load public key from OpenSSH one-line format.r) zInvalid line formatr FNTzInvalid key format)r r r _SSH_PUBKEY_RCmatchr" group _CERT_SUFFIXr- r rT r r TypeErrorErrorr@ rj r> r; r/ )r) r5 r rh Z
orig_key_typeZkey_bodyZ with_certr Zinner_key_typeZnoncer# serialZcctypeZkey_idZ
principalsZ valid_afterZ valid_beforeZ crit_options
extensionsZreservedZsig_keyZ signaturer r r load_ssh_public_keym sH
r c C s t | tjrt| }n>t | tjr(t}n,t | tjr:t }nt | t
j rLt }nt
dt|}t }|j| |j| | tj|j j }dj|d|gS )z&One-line public key format for OpenSSHzUnsupported key typer& )rR r r r$ r Z RSAPublicKeyr r Z DSAPublicKeyr r
r r r" r rI rW rt r Z
b2a_base64r^ stripr' )r# rh r rs Zpubr r r serialize_ssh_public_key s
r )N)N)N)^Z
__future__r r r r r restructrB Z cryptographyr Zcryptography.exceptionsr Z cryptography.hazmat.backendsr Z)cryptography.hazmat.primitives.asymmetricr r r
r Z&cryptography.hazmat.primitives.ciphersr r
r Z,cryptography.hazmat.primitives.serializationr r r r Zbcryptr r Z_bcrypt_supported ImportErrorbase64r r( r r r r Z_ECDSA_NISTP256Z_ECDSA_NISTP384Z_ECDSA_NISTP521r compiler r Z _SK_STARTZ_SK_ENDr r r r r DOTALLr rT rU ranger ZAESZCTRZCBCr0 r! Structr9 r= r$ r, r. r/ r7 r; r> r@ rE rH objectrI rd rw r r Z SECP256R1Z SECP384R1Z SECP521R1r r r r r r r r r r s
0>>=:
J
O
+