o
    �õ±jË3  ã                   @   sH   d dl T d dlZd dlmZ G dd„ dƒZddejdedefd	d
„ZdS )é    )Ú*N)ÚCallablec                   @   sØ   e Zd Zdejfdd„Zdd„ Zd4dd„Zd4d	d
„Zdd„ Z	dd„ Z
d5dd„Zdd„ Zd6dd„Zdd„ Zdd„ Zdd„ Zd7dd„Zd d!„ Zd"d#„ Zd$d%„ Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Zd.d/„ Zd8d0d1„Zd2d3„ ZdS )9ÚSPNEGORelayÚauth_relay_queuec                 C   sj   || _ i | _d | _d | _d | _d | _d| _d | _d| _d | _	d | _
d | _d | _d| _d | _d | _g | _d S ©Nr   F)r   Úauthentication_contextsÚselected_authentication_contextÚ&selected_authentication_context_serverÚselected_mechtypeÚselected_mechtype_serverÚiteration_ctrÚstart_client_evtÚiteration_ctr_serverÚmic_dataÚ_SPNEGORelay__server_side_crashÚ_SPNEGORelay__client_side_crashÚ!_SPNEGORelay__server_latest_tokenÚ"_SPNEGORelay__relay_queue_notifiedÚ_SPNEGORelay__authtypeÚconnection_infoÚoriginal_mechtypes)Úselfr   © r   ú˜/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/spnego/relay/native.pyÚ__init__   s"   
zSPNEGORelay.__init__c                 Ã   s   �t d| ƒ d S )Nz[SPNEGORelay] %s)Úprint)r   Úmessager   r   r   Úprint_debug!   s   €zSPNEGORelay.print_debugNc                 C   s.   | j D ]}| j |  |¡ | j | j| _qd S ©N)r   Úsetupr   )r   Úlog_qÚkr   r   r   r   $   s   
þzSPNEGORelay.setupc                 Ã   s2   �| j du r|| _| j | ¡I d H  d| _ d S d S )NFT)r   r   r   Úput)r   Úauthtyper   r   r   Únotify_relay)   s   €

ýzSPNEGORelay.notify_relayc                 C   s
   || _ d S r   )r   )r   r   r   r   r   Úset_connection_info/   ó   
zSPNEGORelay.set_connection_infoc                 C   s0   | j d u r	tdƒ‚t| j dƒdu r| j  ¡ S dS )Nz&Call this after selecting auth method!Úis_guestTF)r   Ú	ExceptionÚhasattrr'   ©r   r   r   r   r'   2   s
   

zSPNEGORelay.is_guestÚinitc                 Ã   s   �| j j|||d�I d H S )N)Ú	direction)r   Úsign)r   ÚdataÚ
message_nor,   r   r   r   r-   :   s   €zSPNEGORelay.signc                 Ã   s   �| j  ||¡I d H S r   )r   Úencrypt)r   r.   r/   r   r   r   r0   =   s   €zSPNEGORelay.encryptc                 Ã   s   �| j j||||d�I d H S )N)r,   Ú	auth_data)r   Údecrypt)r   r.   r/   r,   r1   r   r   r   r2   @   s   €zSPNEGORelay.decryptc                 C   s   d| j v r
| j d S d S ©Nú2NTLMSSP - Microsoft NTLM Security Support Provider©r   r*   r   r   r   Úget_ntlmC   s   

zSPNEGORelay.get_ntlmc                 C   s   || j |< dS )a\  
		Add an authentication context to the given authentication context name.
		Valid names are:
			'NTLMSSP - Microsoft NTLM Security Support Provider'
			'MS KRB5 - Microsoft Kerberos 5'
			'KRB5 - Kerberos 5'
			'KRB5 - Kerberos 5 - User to User'
			'NEGOEX - SPNEGO Extended Negotiation Security Mechanism'
			
		Context MUST be already set up!
		Nr5   )r   ÚnameÚctxr   r   r   Úadd_auth_contextH   s   zSPNEGORelay.add_auth_contextc                 C   s*   | j D ]}||v r|| j | f  S qdS )N)NNr5   )r   Ú
mech_typesÚauth_type_namer   r   r   Ú select_common_athentication_typeV   s
   
ÿz,SPNEGORelay.select_common_athentication_typeFr   c           
      Ã   sŒ   �| j  |¡I d H \}}}|d urd d |fS |d u rdS i }	|dkr3|dkr-tdƒ|	d< ntdƒ|	d< |d urAt|ƒdkrA||	d< |	|d fS )N©NFNTzaccept-incompleteÚnegStateúaccept-completedr   ÚresponseToken)r	   Úauthenticate_relay_serverÚNegStateÚlen)
r   Ú
token_dataÚinclude_negstateÚflagsÚ
seq_numberÚis_rpcÚresultÚto_continueÚerrÚresponser   r   r   Úprocess_ctx_authenticate_server]   s   €

z+SPNEGORelay.process_ctx_authenticate_serverc                 Ã   s*   �i }t dƒ|d< tdt|ƒiƒ ¡ d fS )Nr?   r>   ÚnegTokenResp)rB   ÚNegotiationTokenÚNegTokenRespÚdump)r   rL   r   r   r   Ú"authenticate_relay_server_finishedn   s   €z.SPNEGORelay.authenticate_relay_server_finishedc                 Ï   sX   �| j j|g|¢R i |¤ŽI d H \}}}|d urd d |fS |s!dS i }||d< ||d fS )Nr=   r@   )r   Úauthenticate)r   rD   ÚargsÚkwargsrI   rJ   rK   rL   r   r   r   Úprocess_ctx_authenticatet   s   €&

z$SPNEGORelay.process_ctx_authenticatec                 C   s   | S r   r   r*   r   r   r   Úget_copy~   s   zSPNEGORelay.get_copyc                 C   s   t | j ¡ ƒS )z\
		Returns a list of authentication context names available to the SPNEGO authentication.
		)Úlistr   Úkeysr*   r   r   r   Úlist_original_conexts�   s   z!SPNEGORelay.list_original_conextsc                 C   s
   | j | S )z²
		Returns a copy of the original (not used) authentication context sp[ecified by name.
		You may use this ctx to perform future authentication, as it has the user credentials
		r5   )r   Úctx_namer   r   r   Úget_original_context‡   s   
z SPNEGORelay.get_original_contextc                 C   s   t | jdƒr| j ¡ S d S )NÚget_extra_info)r)   r   r]   r*   r   r   r   r]   Ž   s   
zSPNEGORelay.get_extra_infoc                 C   s
   | j  ¡ S r   )r   Úget_session_keyr*   r   r   r   r^   “   r&   zSPNEGORelay.get_session_keyc                 C   sH   ddi}dd„ | j D ƒt|ƒdœ}tdt|ƒiƒ}ttdƒ|dœƒ ¡ S )	NÚhintNamez$not_defined_in_RFC4178@please_ignorec                 S   s   g | ]}t |ƒ‘qS r   )ÚMechType)Ú.0Úmtr   r   r   Ú
<listcomp>™   s    z2SPNEGORelay.get_mechtypes_list.<locals>.<listcomp>)Ú	mechTypesÚnegHintsÚnegTokenInitú1.3.6.1.5.5.2©ÚtypeÚvalue)r   ÚNegHintsrO   ÚNegTokenInit2ÚGSSAPIÚGSSTyperQ   )r   ÚneghintÚtokinitÚnegtokenr   r   r   Úget_mechtypes_list–   s   þzSPNEGORelay.get_mechtypes_listc              
   Ã   s¤  �|| _ �z1| jd urd dtdƒfW S d }| jd u r†t |¡j}|d }|d | _t|d ƒdkrR|d d | _	|d d dkrQ|  
¡ I d H  | j|d d  | _n4|d D ]}|dkrn|| _	| j| | _|  
¡ I d H   nqV| jd u r†|  d| ¡I d H  td	|d  ƒ‚| jd u�r4|d u rÊ|d d
kr¡t |¡j}|d }n)z
t |¡}|j}W n tyÉ }	 z|  d| ¡I d H  td|	 ƒ |	‚d }	~	ww d|v rÓ|d }
n|d }
d|v rà|d | _| j|
|||dd�I d H \}}}|d urúd d |fW S |d u �rW dS | jdk�rt| j	ƒ|d< tdt|ƒiƒ}| jdk�r%tdt|ƒiƒ}|  jd7  _| ¡ |d fW S W d S  t�yQ }	 z|	| _d d|	fW  Y d }	~	S d }	~	ww )NFzClient auth crashed!rj   rd   é   r   r4   z([DEBUG][MULTIPLE_MECHTYPES] negtoken: %sz$Failed to find NTLM in mechtypes: %sé`   z[DEBUG][NEGTOKEN_LOAD_ERROR] %sÚ	mechTokenr@   ÚmechListMICT)rF   rG   rH   rE   r=   ÚsupportedMechrN   )r   r   r(   r	   rm   ÚloadÚnativer   rC   r   r$   r   r   rO   r   r   rM   r   r`   rP   rQ   r   )r   ÚtokenrF   rG   rH   rq   ÚgssÚmechtypeÚneg_token_rawÚeÚauthdatarL   rJ   rK   r   r   r   rA   ¡   s‚   €


€ü



€ý

 
ÿÝ$€þz%SPNEGORelay.authenticate_relay_serverc              
   Ï   sÒ  ��zK| j durddtdƒfW S | jdu rí|du r¦t| jƒdkr,|  d¡I dH  tdƒ‚t| jƒdkr@|  d| jd  ¡I dH  | jd | _| j| jvr^|  d	| j ¡I dH  td
| j ƒ‚| j| j | _i }t| jƒ|d< | jj	dg|¢R i |¤ŽI dH \}}}|dur‹dd|fW S ||d< t
dt|ƒiƒ}ttdƒ|dœƒ ¡ ddfW S t
 |¡}	|	j}
t|	tƒs·tdƒ‚| j|
jd  | _|
d | _| j|
d g|¢R i |¤ŽI dH \}}}|durãdd|fW S t|ƒ ¡ |dfW S t
 |¡}	|	j}
|
d dkrþW dS |
d du �rtdƒ W dS | j|
d g|¢R i |¤ŽI dH \}}}|du�r+dd|fW S |�s1W dS t
dt|ƒiƒ ¡ }| jdu �rH| jddfW S ||dfW S  t�yh } z|| _dd|fW  Y d}~S d}~ww )zÅ
		This function is called (multiple times) during negotiation phase of a protocol to determine hich auth mechanism to be used
		Token is a byte array that is an ASN1 NegotiationToken structure.
		NFzServer auth crashed!r   z*[CLIENT][AUTHENTICATE] No mechtypes found!zNo mechtypes foundrs   zH[CLIENT][AUTHENTICATE] Multiple mechtypes found! Selecting first one: %sz'[DEBUG][SELECTED_MECHTYPE_NOT_FOUND] %szSelected mechtype not found: %srd   ru   rf   rg   rh   TzServer send init???rw   r@   r>   r?   r=   z3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!111111111111)NTNrN   )r   r(   r
   rC   r   r   r   r   Ú	MechTypesrS   rO   rl   rm   rn   rQ   rx   ry   Ú
isinstancerP   rd   rV   r   r   r   r   )r   rz   rT   rU   rL   rI   rJ   rK   rq   r}   Ú	neg_tokenÚresr~   r   r   r   rS   æ   sn   €

	&


(
(
€þzSPNEGORelay.authenticater   )r+   )r+   N)FNr   Fr   )Ú__name__Ú
__module__Ú__qualname__ÚasyncioÚQueuer   r   r   r$   r%   r'   r-   r0   r2   r6   r9   r<   rM   rR   rV   rW   rZ   r\   r]   r^   rr   rA   rS   r   r   r   r   r      s0    






Er   r   Úntlm_handler_factoryÚreturnc                 C   s$   |ƒ }t | ƒ}| d|¡ ||_|S r3   )r   r9   Ú
spnego_obj)r   r‰   Úntlm_ctxÚgssapir   r   r   Úspnegorelay_ntlm_factoryD  s
   rŽ   r   )Ú.asyauth.protocols.spnego.messages.asn1_structsr‡   Útypingr   r   rˆ   rŽ   r   r   r   r   Ú<module>   s     9