�
�|�g�, � � � S r SSKJr SSKJr SSKJr SSKJr " S S5 r " S S
\ 5 r
" S S \ 5 r " S
S\ 5 r " S S\ 5 r
" S S\ 5 r\" SSS/5 r " S S\5 r " S S\5 r " S S5 rg ) z�
Modern, adaptable authentication machinery.
Replaces certain parts of `.SSHClient`. For a concrete implementation, see the
``OpenSSHAuthStrategy`` class in `Fabric <https://fabfile.org>`_.
� )�
namedtuple� )�AgentKey)�
get_logger)�AuthenticationExceptionc �0 � \ rS rSrSrS rS rS rS rSr g) �
AuthSource� z�
Some SSH authentication source, such as a password, private key, or agent.
See subclasses in this module for concrete implementations.
All implementations must accept at least a ``username`` (``str``) kwarg.
c � � Xl g �N��username)�selfr s �8/usr/lib/python3/dist-packages/paramiko/auth_strategy.py�__init__�AuthSource.__init__ s � � �
� c � � UR 5 VVs/ s H
u p#U SU< 3PM nnnSR U5 nU R R SU S3$ s snnf )N�=z, �(�))�items�join� __class__�__name__)r �kwargs�k�v�pairs�joineds r �_repr�AuthSource._repr s[ � � +1�,�,�.�9�.�$�!�A�3�a��u� �.��9����5�!���.�.�)�)�*�!�F�8�1�5�5�� :s �Ac �" � U R 5 $ r )r! �r s r �__repr__�AuthSource.__repr__" s � ��z�z�|�r c � � [ e)z
Perform authentication.
��NotImplementedError�r � transports r � authenticate�AuthSource.authenticate% s
� � "�!r r
N)
r �
__module__� __qualname__�__firstlineno__�__doc__r r! r% r, �__static_attributes__� r r r r s � ��!�6� �"r r c � � \ rS rSrSrS rSrg)�NoneAuth�, zK
Auth type "none", ie https://www.rfc-editor.org/rfc/rfc4252#section-5.2 .
c �8 � UR U R 5 $ r )� auth_noner r* s r r, �NoneAuth.authenticate1 s � ��"�"�4�=�=�1�1r r3 N�r r. r/ r0 r1 r, r2 r3 r r r5 r5 , s � ��2r r5 c �> ^ � \ rS rSrSrU 4S jrU 4S jrS rSrU =r $ )�Password�5 a�
Password authentication.
:param callable password_getter:
A lazy callable that should return a `str` password value at
authentication time, such as a `functools.partial` wrapping
`getpass.getpass`, an API call to a secrets store, or similar.
If you already know the password at instantiation time, you should
simply use something like ``lambda: "my literal"`` (for a literal, but
also, shame on you!) or ``lambda: variable_name`` (for something stored
in a variable).
c �, >� [ TU ] US9 X l g �Nr
)�superr �password_getter)r r rA r s �r r �Password.__init__D s �� �
���(��+� .� r c �2 >� [ TU ] U R S9$ )N)�user)r@ r! r )r r s �r r% �Password.__repr__H s �� � �w�}�$�-�-�}�0�0r c �Z � U R 5 nUR U R U5 $ r )rA �
auth_passwordr )r r+ �passwords r r, �Password.authenticateM s) � � �'�'�)���&�&�t�}�}�h�?�?r )rA )
r r. r/ r0 r1 r r% r, r2 �
__classcell__�r s @r r< r< 5 s �� � � /�1�
@� @r r< c � � \ rS rSrSrS rSrg)�
PrivateKey�X ak
Essentially a mixin for private keys.
Knows how to auth, but leaves key material discovery/loading/decryption to
subclasses.
Subclasses **must** ensure that they've set ``self.pkey`` to a decrypted
`.PKey` instance before calling ``super().authenticate``; typically
either in their ``__init__``, or in an overridden ``authenticate`` prior to
its `super` call.
c �N � UR U R U R 5 $ r )�auth_publickeyr �pkeyr* s r r, �PrivateKey.authenticatee s � ��'�'��
�
�t�y�y�A�Ar r3 Nr: r3 r r rM rM X s
� �
�Br rM c �8 ^ � \ rS rSrSrU 4S jrU 4S jrSrU =r$ )�InMemoryPrivateKey�i z)
An in-memory, decrypted `.PKey` object.
c �, >� [ TU ] US9 X l g r? )r@ r rQ )r r rQ r s �r r �InMemoryPrivateKey.__init__n s �� �
���(��+�� r c �~ >� [ TU ] U R S9n[ U R [ 5 ( a US-
nU$ )N�rQ z [agent])r@ r! rQ �
isinstancer )r �repr s �r r% �InMemoryPrivateKey.__repr__s s9 �� � �g�m����m�+�� �d�i�i�� *� *� �:� �C��
r rY � r r. r/ r0 r1 r r% r2 rJ rK s @r rT rT i s �� ���
� r rT c �2 ^ � \ rS rSrSrU 4S jrS rSrU =r$ )�OnDiskPrivateKey�| au
Some on-disk private key that needs opening and possibly decrypting.
:param str source:
String tracking where this key's path was specified; should be one of
``"ssh-config"``, ``"python-config"``, or ``"implicit-home"``.
:param Path path:
The filesystem path this key was loaded from.
:param PKey pkey:
The `PKey` object this auth source uses/represents.
c �p >� [ TU ] US9 X l SnX%; a [ SU< 35 eX0l X@l g )Nr
)z
ssh-configz
python-configz
implicit-homez source argument must be one of: )r@ r �source�
ValueError�pathrQ )r r rb rd rQ �allowedr s �r r �OnDiskPrivateKey.__init__� s@ �� �
���(��+� � �B�� � � � ?��{� K�L� L�� �� r c �r � U R U R U R [ U R 5 S9$ )N)�keyrb rd )r! rQ rb �strrd r$ s r r% �OnDiskPrivateKey.__repr__� s/ � ��z�z�� � �$�+�+�C�� � �N� �
�
r )rd rQ rb r] rK s @r r_ r_ | s �� �
��
�
r r_ � SourceResultrb �resultc �2 ^ � \ rS rSrSrU 4S jrS rSrU =r$ )�
AuthResult� a�
Represents a partial or complete SSH authentication attempt.
This class conceptually extends `AuthStrategy` by pairing the former's
authentication **sources** with the **results** of trying to authenticate
with them.
`AuthResult` is a (subclass of) `list` of `namedtuple`, which are of the
form ``namedtuple('SourceResult', 'source', 'result')`` (where the
``source`` member is an `AuthSource` and the ``result`` member is either a
return value from the relevant `.Transport` method, or an exception
object).
.. note::
Transport auth method results are always themselves a ``list`` of "next
allowable authentication methods".
In the simple case of "you just authenticated successfully", it's an
empty list; if your auth was rejected but you're allowed to try again,
it will be a list of string method names like ``pubkey`` or
``password``.
The ``__str__`` of this class represents the empty-list scenario as the
word ``success``, which should make reading the result of an
authentication session more obvious to humans.
Instances also have a `strategy` attribute referencing the `AuthStrategy`
which was attempted.
c �2 >� Xl [ TU ] " U0 UD6 g r )�strategyr@ r )r rq �argsr r s �r r �AuthResult.__init__� s �� � �
�
���$�)�&�)r c �2 � SR S U 5 5 $ )N�
c 3 �h # � U H( oR S UR =( d S 3v � M* g7f)z -> �successN)rb rl )�.0�xs r � <genexpr>�%AuthResult.__str__.<locals>.<genexpr>� s* � � �
�>B��x�x�j��Q�X�X� 2�� 3� 4�d�s �02)r r$ s r �__str__�AuthResult.__str__� s" � �
�y�y�
�>B�
�
�
r �rq ) r r. r/ r0 r1 r r| r2 rJ rK s @r rn rn � s �� � �<*�
�
r rn c �$ � \ rS rSrSrS rS rSrg)� AuthFailure�� a�
Basic exception wrapping an `AuthResult` indicating overall auth failure.
Note that `AuthFailure` descends from `AuthenticationException` but is
generally "higher level"; the latter is now only raised by individual
`AuthSource` attempts and should typically only be seen by users when
encapsulated in this class. It subclasses `AuthenticationException`
primarily for backwards compatibility reasons.
c � � Xl g r �rl )r rl s r r �AuthFailure.__init__� s � � � r c �2 � S[ U R 5 - $ )Nru )ri rl r$ s r r| �AuthFailure.__str__� s � ��c�$�+�+�&�&�&r r� N)r r. r/ r0 r1 r r| r2 r3 r r r� r� � s � �� �'r r� c �* � \ rS rSrSrS rS rS rSrg)� AuthStrategy�� z�
This class represents one or more attempts to auth with an SSH server.
By default, subclasses must at least accept an ``ssh_config``
(`.SSHConfig`) keyword argument, but may opt to accept more as needed for
their particular strategy.
c �8 � Xl [ [ 5 U l g r )�
ssh_configr r �log)r r� s r r �AuthStrategy.__init__� s � � %�� �h�'��r c � � [ e)a+
Generator yielding `AuthSource` instances, in the order to try.
This is the primary override point for subclasses: you figure out what
sources you need, and ``yield`` them.
Subclasses _of_ subclasses may find themselves wanting to do things
like filtering or discarding around a call to `super`.
r( r$ s r � get_sources�AuthStrategy.get_sources� s
� � "�!r c � � Sn[ U S9nU R 5 HX nU R R SU 35 UR U5 nSnUR [ XE5 5 U( d MX O U( d [ US9eU$ ! [
aC nUnUR R nU R R SU SU 35 SnAN�SnAff = f) z�
Handles attempting `AuthSource` instances yielded from `get_sources`.
You *normally* won't need to override this, but it's an option for
advanced users.
Fr~ zTrying TzAuthentication via z
failed with Nr� ) rn r� r� �debugr, � Exceptionr r �info�appendrk r� )r r+ � succeeded�overall_resultrb rl �e� source_classs r r, �AuthStrategy.authenticate s� � � � �#�T�2�� �&�&�(�F� �H�H�N�N�W�V�H�-� .�
� �,�,�Y�7�� � �"
� !� !�,�v�">� ?��y��/ )�4 � �^�4� 4� � ��) �
��� !�{�{� 3� 3� ����
�
�)�&�� �|�n�M�� ��
�s �B
�
C�9C�C)r� r� N) r r. r/ r0 r1 r r� r, r2 r3 r r r� r� � s � ��(�
"�+ r r� N)r1 � collectionsr �agentr �utilr �
ssh_exceptionr r r5 r< rM rT r_ rk �listrn r� r� r3 r r �<module>r� s� ��� #� � � 2�"� "�:2�z� 2� @�z� @�FB�� B�"�� �&
�z�
�B �.�8�X�*>�?� �*
�� *
�\'�)� '�$G � G r