HEX

File: //usr/local/CyberPanel/lib64/python3.10/site-packages/paramiko/__pycache__/pkey.cpython-310.pyc
o

�h��@sLdZddlZddlmZmZddlmZddlZddlmZddl	m
Z
mZddlZddl
Z
ddlZddlmZddlmZdd	lmZmZmZdd
lmZddlmZddlmZmZdd
lmZddlm Z m!Z!ddl"m#Z#zddl$m%Z%Wne&y�ddl'm%Z%YnwdZ(dd�Z)Gdd�de*�Z+Gdd�d�Z,Gdd�d�Z-dS)z!
Common API for all public keys.
�N)�encodebytes�decodebytes)�	unhexlify)�Path)�md5�sha256)�default_backend)�
serialization)�
algorithms�modes�Cipher)�
asymmetric)�util)�u�b)�o600)�SSHException�PasswordRequiredException)�Message)�	TripleDESsopenssh-key-v1cCsh|d}d|krdkr|S|dkrtd��t|�D]}||||dkr,td��q|d|�S)N���� ��zInvalid key�)r�range)�data�padding_length�i�r�C/usr/local/CyberPanel/lib/python3.10/site-packages/paramiko/pkey.py�_unpad_openssh?s��r!c@s"eZdZdZddd�Zdd�ZdS)�UnknownKeyTypezK
    An unknown public/private key algorithm was attempted to be read.
    NcCs||_||_dS�N��key_type�	key_bytes)�selfr%r&rrr �__init__Ss
zUnknownKeyType.__init__cCsd|j�dt|j��d�S)NzUnknownKeyType(type=z	, bytes=<z>))r%�lenr&�r'rrr �__str__WszUnknownKeyType.__str__�NN)�__name__�
__module__�__qualname__�__doc__r(r+rrrr r"Ns
r"c@s�eZdZdZejddejd�ejddejd�eddejd�d�Z	dZ
d	Ze�
d
�Ze�
d�ZedOd
d��Zedd��Zedd��ZdPdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zedd ��Zd!d"�Zed#d$��Zd%d&�Zd'd(�Z d)d*�Z!ed+d,��Z"d-d.�Z#dOd/d0�Z$d1d2�Z%edOd3d4��Z&edOd5d6��Z'dOd7d8�Z(dOd9d:�Z)dOd;d<�Z*dOd=d>�Z+d?d@�Z,dAdB�Z-dCdD�Z.dEdF�Z/dOdGdH�Z0dOdIdJ�Z1dKdL�Z2dMdN�Z3dS)Q�PKeyz�
    Base class for public keys.

    Also includes some "meta" level convenience constructors such as
    `.from_type_string`.
    �)�cipher�keysize�	blocksize�moder��)zAES-128-CBCzAES-256-CBCzDES-EDE3-CBCr�z3^-{5}BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-{5}\s*$z1^-{5}END (RSA|DSA|EC|OPENSSH) PRIVATE KEY-{5}\s*$NcCs\ddlm}m}m}m}t|�}d}t|��|�r%|dt|��}|}n|}||}t|��	�}t|��	�}|�
�}	z	tj|	|d�}
Wnt
yTtj|	|d�}
Ynwd}t|
tjj�ra|}n%t|
tjj�rk|}nt|
tjj�ru|}nt|
tjj�r|}nt|	|
jd��|���}|j||d�}
Wd�n1s�wY|��r�|
�t|��|
S)aV
        Attempt to instantiate appropriate key subclass from given file path.

        :param Path path: The path to load (may also be a `str`).

        :returns:
            A `PKey` subclass instance.

        :raises:
            `UnknownKeyType`, if our crypto backend doesn't know this key type.

        .. versionadded:: 3.2
        r)�DSSKey�RSAKey�
Ed25519Key�ECDSAKeyz	-cert.pubN)r�password)r&r%�r>)�paramikor:r;r<r=�str�endswithr)r�
expanduser�
read_bytesr	�load_ssh_private_key�
ValueError�load_pem_private_key�
isinstancer
�dsa�
DSAPrivateKey�rsa�
RSAPrivateKey�ed25519�Ed25519PrivateKey�ec�EllipticCurvePrivateKeyr"�	__class__�open�from_private_key�exists�load_certificate)�path�
passphraser:r;r<r=�cert_suffix�key_path�	cert_pathr�loaded�	key_class�fd�keyrrr �	from_pathsH
�
��
�zPKey.from_pathcCs<ddlm}|D]}||��vr||d�Sqt||d��)av
        Given type `str` & raw `bytes`, return a `PKey` subclass instance.

        For example, ``PKey.from_type_string("ssh-ed25519", <public bytes>)``
        will (if successful) return a new `.Ed25519Key`.

        :param str key_type:
            The key type, eg ``"ssh-ed25519"``.
        :param bytes key_bytes:
            The raw byte data forming the key material, as expected by
            subclasses' ``data`` parameter.

        :returns:
            A `PKey` subclass instance.

        :raises:
            `UnknownKeyType`, if no registered classes knew about this type.

        .. versionadded:: 3.2
        r)�key_classes)rr$)r@r`�identifiersr")r%r&r`r\rrr �from_type_string�s�zPKey.from_type_stringcCs|jgS)z�
        returns an iterable of key format/name strings this class can handle.

        Most classes only have a single identifier, and thus this default
        implementation suffices; see `.ECDSAKey` for one example of an
        override.
        )�name)�clsrrr ra�s	zPKey.identifierscC�dS)aV
        Create a new instance of this public key type.  If ``msg`` is given,
        the key's public part(s) will be filled in from the message.  If
        ``data`` is given, the key's public part(s) will be filled in from
        the string.

        :param .Message msg:
            an optional SSH `.Message` containing a public key of this type.
        :param bytes data:
            optional, the bytes of a public key of this type

        :raises: `.SSHException` --
            if a key cannot be created from the ``data`` or ``msg`` given, or
            no key was passed in.
        Nr)r'�msgrrrr r(�sz
PKey.__init__cCsDd}t|d�r|jrd|j��}d|j�d|���d|j�|�d�S)N��commentz
, comment=z	PKey(alg=z, bits=z, fp=�))�hasattrrh�algorithm_name�get_bits�fingerprint)r'rhrrr �__repr__s$z
PKey.__repr__cC�t�S)z�
        Return a string of an SSH `.Message` made up of the public part(s) of
        this key.  This string is suitable for passing to `__init__` to
        re-create the key object later.
        ��bytesr*rrr �asbytesszPKey.asbytescCs|��Sr#)rrr*rrr �	__bytes__ szPKey.__bytes__cCst|t�o
|j|jkSr#)rHr1�_fields�r'�otherrrr �__eq__#szPKey.__eq__cCs
t|j�Sr#)�hashrtr*rrr �__hash__&�
z
PKey.__hash__cCst�r#)�NotImplementedErrorr*rrr rt)szPKey._fieldscCre)z�
        Return the name of this private key implementation.

        :return:
            name of this private key type, in SSH terminology, as a `str` (for
            example, ``"ssh-rsa"``).
        rgrr*rrr �get_name-sz
PKey.get_namecCsF|���dd�}d}||vr|�|d�}|��S|�d�d}|��S)z�
        Return the key algorithm identifier for this key.

        Similar to `get_name`, but aimed at pure algorithm name instead of SSH
        protocol field value.
        zssh-rgz-cert-v01@openssh.comz-cert�-r)r|�replace�split�upper)r'rc�	cert_tailrrr rk7s
�zPKey.algorithm_namecCre)z�
        Return the number of significant bits in this key.  This is useful
        for judging the relative security of a key.

        :return: bits in the key (as an `int`)
        rrr*rrr rlKs	z
PKey.get_bitscCre)zf
        Return ``True`` if this key has the private part necessary for signing
        data.
        Frr*rrr �can_signVsz
PKey.can_signcCst|�����S)z�
        Return an MD5 fingerprint of the public part of this key.  Nothing
        secret is revealed.

        :return:
            a 16-byte `string <str>` (binary) of the MD5 fingerprint, in SSH
            format.
        )rrr�digestr*rrr �get_fingerprint]s	zPKey.get_fingerprintcCsBtt|��}|j��}t|���}t|����d�}|�d|��S)z�
        Modern fingerprint property designed to be comparable to OpenSSH.

        Currently only does SHA256 (the OpenSSH default).

        .. versionadded:: 3.2
        �=�:)	rrqrcr�rr�r�strip�rstrip)r'�hashy�	hash_name�b64ed�cleanedrrr rmhs
	
zPKey.fingerprintcCstt|�����dd�S)a+
        Return a base64 string containing the public part of this key.  Nothing
        secret is revealed.  This format is compatible with that used to store
        public key files or recognized host keys.

        :return: a base64 `string <str>` containing the public part of the key.
        �
rg)rrrrr~r*rrr �
get_base64wszPKey.get_base64cCro)a�
        Sign a blob of data with this private key, and return a `.Message`
        representing an SSH signature message.

        :param bytes data:
            the data to sign.
        :param str algorithm:
            the signature algorithm to use, if different from the key's
            internal name. Default: ``None``.
        :return: an SSH signature `message <.Message>`.

        .. versionchanged:: 2.9
            Added the ``algorithm`` kwarg.
        rp)r'r�	algorithmrrr �
sign_ssh_data�szPKey.sign_ssh_datacCre)a^
        Given a blob of data, and an SSH message representing a signature of
        that data, verify that it was signed with this key.

        :param bytes data: the data that was signed.
        :param .Message msg: an SSH signature message
        :return:
            ``True`` if the signature verifies correctly; ``False`` otherwise.
        Fr)r'rrfrrr �verify_ssh_sig�s
zPKey.verify_ssh_sigcC�|||d�}|S)a�
        Create a key object by reading a private key file.  If the private
        key is encrypted and ``password`` is not ``None``, the given password
        will be used to decrypt the key (otherwise `.PasswordRequiredException`
        is thrown).  Through the magic of Python, this factory method will
        exist in all subclasses of PKey (such as `.RSAKey` or `.DSSKey`), but
        is useless on the abstract PKey class.

        :param str filename: name of the file to read
        :param str password:
            an optional password to use to decrypt the key file, if it's
            encrypted
        :return: a new `.PKey` based on the given private key

        :raises: ``IOError`` -- if there was an error reading the file
        :raises: `.PasswordRequiredException` -- if the private key file is
            encrypted, and ``password`` is ``None``
        :raises: `.SSHException` -- if the key file is invalid
        )�filenamer>r)rdr�r>r^rrr �from_private_key_file�szPKey.from_private_key_filecCr�)a
        Create a key object by reading a private key from a file (or file-like)
        object.  If the private key is encrypted and ``password`` is not
        ``None``, the given password will be used to decrypt the key (otherwise
        `.PasswordRequiredException` is thrown).

        :param file_obj: the file-like object to read from
        :param str password:
            an optional password to use to decrypt the key, if it's encrypted
        :return: a new `.PKey` based on the given private key

        :raises: ``IOError`` -- if there was an error reading the key
        :raises: `.PasswordRequiredException` --
            if the private key file is encrypted, and ``password`` is ``None``
        :raises: `.SSHException` -- if the key file is invalid
        )�file_objr>r)rdr�r>r^rrr rS�szPKey.from_private_keycC�td��)a�
        Write private key contents into a file.  If the password is not
        ``None``, the key is encrypted before writing.

        :param str filename: name of the file to write
        :param str password:
            an optional password to use to encrypt the key file

        :raises: ``IOError`` -- if there was an error writing the file
        :raises: `.SSHException` -- if the key is invalid
        �Not implemented in PKey��	Exception)r'r�r>rrr �write_private_key_file��zPKey.write_private_key_filecCr�)a�
        Write private key contents into a file (or file-like) object.  If the
        password is not ``None``, the key is encrypted before writing.

        :param file_obj: the file-like object to write into
        :param str password: an optional password to use to encrypt the key

        :raises: ``IOError`` -- if there was an error writing to the file
        :raises: `.SSHException` -- if the key is invalid
        r�r�)r'r�r>rrr �write_private_key�r�zPKey.write_private_keycCs>t|d��}|�|||�}Wd�|S1swY|S)a�
        Read an SSH2-format private key file, looking for a string of the type
        ``"BEGIN xxx PRIVATE KEY"`` for some ``xxx``, base64-decode the text we
        find, and return it as a string.  If the private key is encrypted and
        ``password`` is not ``None``, the given password will be used to
        decrypt the key (otherwise `.PasswordRequiredException` is thrown).

        :param str tag: ``"RSA"`` or ``"DSA"``, the tag used to mark the
            data block.
        :param str filename: name of the file to read.
        :param str password:
            an optional password to use to decrypt the key file, if it's
            encrypted.
        :return: the `bytes` that make up the private key.

        :raises: ``IOError`` -- if there was an error reading the file.
        :raises: `.PasswordRequiredException` -- if the private key file is
            encrypted, and ``password`` is ``None``.
        :raises: `.SSHException` -- if the key file is invalid.
        �rN)rR�_read_private_key)r'�tagr�r>�frrrr �_read_private_key_file�s
��zPKey._read_private_key_filecCsH|��}|s
td�|���d}|j�||�}t|�d}||kr5|s5|d7}|j�||�}||kr5|r#|d7}|r@|�d�nd}|t|�ksL|durStd�|���|}	|j�||	�}|	|kru|su|	d7}	|j�||	�}|	|kru|rc||kr�|�||	|�}
|j	}||
fS|dkr�|�
|||	�|�}
|j}||
fStd�||���)Nzno lines in {} private key filerrznot a valid {} private key file�OPENSSHz#encountered {} key, expected {} key)�	readlinesr�format�	BEGIN_TAG�matchr)�group�END_TAG�_read_private_key_pem�_PRIVATE_KEY_FORMAT_ORIGINAL�_read_private_key_openssh�_PRIVATE_KEY_FORMAT_OPENSSH)r'r�r�r>�lines�start�m�
line_range�keytype�endr�pkformatrrr r�s>��	��
�zPKey._read_private_keycCsd}t|�|jj|���)Nz={}._read_private_key() spat out an unknown key format id '{}')rr�rQr-)r'�id_�errrrr �_got_bad_key_format_id%szPKey._got_bad_key_format_idc
Cs�d}i}|d7}|t|�kr2||�d�}t|�dkrn|d��||d��<|d7}|t|�kszttd�|||����}Wntjj	yV}zt
d�|���d}~wwd|vr]|S|d}	|	dkrlt
d�|	���z|d	�d
�\}
}Wnt
d��|
|jvr�t
d�|
���|dur�t
d
��|j|
d}|j|
d}
|j|
d}tt|��}t�t|||
�}t||�||�t�d���}|�|�|��S)Nrrz: rg�base64 decoding error: {}z	proc-typez4,ENCRYPTEDz"Unknown private key structure "{}"zdek-info�,z(Can't parse DEK-info in private key filezUnknown private key cipher "{}"zPrivate key file is encryptedr3r4r6)�backend)r)rr��lowerrr�join�base64�binascii�Errorrr��
_CIPHER_TABLErrr�generate_key_bytesrrr�	decryptor�update�finalize)r'r�r�r>r��headers�liner�e�	proc_type�encryption_type�saltstrr3r4r6�saltr^r�rrr r�)sX����
���zPKey._read_private_key_pemc
Cs�zttd�|���}Wntjjy }ztd�|���d}~ww|dd�}|tkr/td��|�	|dd�d�}|\}}}	}
}|
dkrHtd��|�	|d	�\}}
|td
�kr�|td�kr`t
j}n|td�krjt
j}n
td
�|�
d����|dur|td��|�	|	d�\}}tjt|�t|�d|dd�}|dd�}|dd�}tt�|�||�t����}|�|
�}||��7}n|td�kr�|td�kr�|
}ntd��|�	|d�}|\}}}}||kr�td��t|�S)z�
        Read the new OpenSSH SSH2 private key format available
        since OpenSSH version 6.5
        Reference:
        https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key
        rgr�Nrz)unexpected OpenSSH key header encountered�sssurrz.unsupported: private keyfile has multiple keys�ss�bcryptz
aes256-cbcz
aes256-ctrz,unknown cipher `{}` used in private key filezutf-8zprivate key file is encrypted�su�0T)�ignore_few_roundsr�nonez.unknown cipher or kdf used in private key file�uusrz/OpenSSH private key file checkints do not match)rrr�r�r�r�rr��OPENSSH_AUTH_MAGIC�_uint32_cstruct_unpackr�CBC�CTR�decoderr��kdfrr
�AESrr�r�r�r!)r'r�r>rr��
auth_magic�cstructr3�kdfname�kdf_options�num_pubkeys�	remainder�pubkey�privkey_blobr6r��rounds�key_ivr^�ivr��decrypted_privkey�	checkint1�	checkint2r��keydatarrr r�Xsv�������	��
��zPKey._read_private_key_opensshc
CsPg}d}z�|D]�}|dkr0t�d|||d��d}|d7}||||�}||7}|�|�|dkr^t�d|||d��d}|d7}||||�}||7}t�|d�}|�|�q|dkrzt�d|||d��d}	|d7}|�|	�q|dkr�||d	�}|�|�nqWt|�SWt|�Sty�}
ztt|
���d	}
~
ww)
a
        Used to read new OpenSSH private key format.
        Unpacks a c data structure containing a mix of 32-bit uints and
        variable length strings prefixed by 32-bit uint size field,
        according to the specified format. Returns the unpacked vars
        in a tuple.
        Format strings:
          s - denotes a string
          i - denotes a long integer, encoded as a byte string
          u - denotes a 32-bit unsigned integer
          r - the remainder of the input string, returned as a string
        r�sz>L�rTrr�N)	�struct�unpack�appendr�inflate_longr�rrA�tuple)r'r�	strformat�arr�idxr��s_sizer�rrr�rrr r��sD


������zPKey._uint32_cstruct_unpackcCs^t�tj|tjtjBtjBtd�d��}|j||||d�Wd�dS1s(wYdS)a�
        Write an SSH2-format private key file in a form that can be read by
        paramiko or openssh.  If no password is given, the key is written in
        a trivially-encoded format (base64) which is completely insecure.  If
        a password is given, DES-EDE3-CBC is used.

        :param str tag:
            ``"RSA"`` or ``"DSA"``, the tag used to mark the data block.
        :param filename: name of the file to write.
        :param bytes data: data blob that makes up the private key.
        :param str password: an optional password to use to encrypt the file.

        :raises: ``IOError`` -- if there was an error writing the file.
        )�flagsr6�wr?N)�os�fdopenrR�O_WRONLY�O_TRUNC�O_CREATr�_write_private_key)r'r�r^r�r>r�rrr �_write_private_key_file�s��
"�zPKey._write_private_key_filecCs@|dur	t��}nt�t|��}|�|�tjj||����dSr#)	r	�NoEncryption�BestAvailableEncryptionr�write�
private_bytes�Encoding�PEMr�)r'r�r^r�r>�
encryptionrrr r�s

��zPKey._write_private_keycCs�|}|}t|t�r|g}t|t�r|g}|durtd��|��|��}||vr*dS||vr=|�t|����|��dSd}t|�	|j
j|���)a�
        Perform message type-checking & optional certificate loading.

        This includes fast-forwarding cert ``msg`` objects past the nonce, so
        that the subsequent fields are the key numbers; thus the caller may
        expect to treat the message as key material afterwards either way.

        The obtained key type is returned for classes which need to know what
        it was (e.g. ECDSA.)
        NzKey object may not be emptyz%Invalid key (class: {}, data type: {})rHrAr�rewind�get_textrUrrr�
get_stringr�rQr-)r'rfr%�	cert_type�	key_types�
cert_types�type_r�rrr �_check_type_and_load_cert
s"

zPKey._check_type_and_load_certcCsht|t�rd}ntj�|�rd}nd}tt|�|�}|j�|�	��s/d}t
|�|j|�	����||_dS)a5
        Supplement the private key contents with data loaded from an OpenSSH
        public key (``.pub``) or certificate (``-cert.pub``) file, a string
        containing such a file, or a `.Message` object.

        The .pub contents adds no real value, since the private key
        file includes sufficient information to derive the public
        key info. For certificates, however, this can be used on
        the client side to offer authentication requests to the server
        based on certificate instead of raw public key.

        See:
        https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys

        Note: very little effort is made to validate the certificate contents,
        that is for the server to decide if it is good enough to authenticate
        successfully.
        �from_message�	from_file�from_stringz0PublicBlob type {} incompatible with key type {}N)
rHrr�rV�isfile�getattr�
PublicBlobr%�
startswithr|rFr��public_blob)r'�value�constructor�blobr�rrr rU>s

zPKey.load_certificater#r,)4r-r.r/r0r
r�rr�rr�r�r��re�compiler�r��staticmethodr_rb�classmethodrar(rnrrrsrwry�propertyrtr|rkrlr�r�rmr�r�r�r�rSr�r�r�r�r�r�r�r�r�r�rrUrrrr r1[s�
�����
I












%/V
1
"1r1c@sVeZdZdZddd�Zedd��Zedd��Zed	d
��Zdd�Z	d
d�Z
dd�ZdS)ra�
    OpenSSH plain public key or OpenSSH signed public key (certificate).

    Tries to be as dumb as possible and barely cares about specific
    per-key-type data.

    .. note::

        Most of the time you'll want to call `from_file`, `from_string` or
        `from_message` for useful instantiation, the main constructor is
        basically "I should be using ``attrs`` for this."
    NcCs||_||_||_dS)a
        Create a new public blob of given type and contents.

        :param str type_: Type indicator, eg ``ssh-rsa``.
        :param bytes blob: The blob bytes themselves.
        :param str comment: A comment, if one was given (e.g. file-based.)
        N)r%�key_blobrh)r'r
rrhrrr r(rs
zPublicBlob.__init__cCs:t|��}|��}Wd�n1swY|�|�S)zO
        Create a public blob from a ``-cert.pub``-style file on disk.
        N)rR�readr)rdr�r��stringrrr r
~s

�
zPublicBlob.from_filec
Cs�|�dd�}t|�dkrd}t|�|���|d}tt|d��}z|d��}Wnty4d}Ynwt|�}|�	�}||krNd�||�}	td�|	���||||d�S)	zI
        Create a public blob from a ``-cert.pub``-style string.
        Nr9z%Not enough fields for public blob: {}rrz!key type={!r}, but blob type={!r}zInvalid PublicBlob contents: {})r
rrh)
rr)rFr�rrr��
IndexErrorrr)
rdr�fieldsrfr%rrhr��	blob_type�deetsrrr r�s&��zPublicBlob.from_stringcCs|��}|||��d�S)z�
        Create a public blob from a network `.Message`.

        Specifically, a cert-bearing pubkey auth packet, because by definition
        OpenSSH-style certificates 'are' their own network representation."
        )r
r)rrr)rd�messager
rrr r�szPublicBlob.from_messagecCs&d�|j�}|jr|d�|j�7}|S)Nz{} public key/certificatez- {})r�r%rh)r'�retrrr r+�szPublicBlob.__str__cCs|o	|o	|j|jkSr#)rrurrr rw�szPublicBlob.__eq__cCs
||kSr#rrurrr �__ne__�rzzPublicBlob.__ne__r#)r-r.r/r0r(rr
rrr+rwr%rrrr rds





r).r0r�rrr�rr��pathlibr�hashlibrrrr�r��cryptography.hazmat.backendsr�cryptography.hazmat.primitivesr	�&cryptography.hazmat.primitives.ciphersr
rrr
r@r�
paramiko.utilrr�paramiko.commonr�paramiko.ssh_exceptionrr�paramiko.messager�/cryptography.hazmat.decrepit.ciphers.algorithmsr�ImportError�1cryptography.hazmat.primitives.ciphers.algorithmsr�r!r�r"r1rrrrr �<module>sF�