�
�|�g�p � � � S r SSKrSSKrSSKrSrSrSr SSKr\" \S5 ( a \R S:X a Sr\R 4rO9Sr\R R \R R R 4r SS KJr SS KJr SS
KJr SS jr " S S5 r " S S\ 5 r \S: a \ r " S S\ 5 r " S S\ 5 r!g! \\4 a0 SSKrSSKrSSKrS r\R* 4r Nq! \ a S
rSr N~f = ff = f)z�
This module provides GSS-API / SSPI authentication as defined in :rfc:`4462`.
.. note:: Credential delegation is not supported in server mode.
.. seealso:: :doc:`/api/kex_gss`
.. versionadded:: 1.15
� NT� � __title__z
python-gssapi�MIT�PYTHON-GSSAPI-NEW�SSPIF)�MSG_USERAUTH_REQUEST)� SSHException)�__version_info__c � � [ S:X a [ X5 $ [ S:X a [ X5 $ [ S:X a [ R S:X a [ X5 $ [
S5 e)a|
Provide SSH2 GSS-API / SSPI authentication.
:param str auth_method: The name of the SSH authentication mechanism
(gssapi-with-mic or gss-keyex)
:param bool gss_deleg_creds: Delegate client credentials or not.
We delegate credentials by default.
:return: Either an `._SSH_GSSAPI_OLD` or `._SSH_GSSAPI_NEW` (Unix)
object or an `_SSH_SSPI` (Windows) object
:rtype: object
:raises: ``ImportError`` -- If no GSS-API / SSPI module could be imported.
:see: `RFC 4462 <http://www.ietf.org/rfc/rfc4462.txt>`_
:note: Check for the available API and return either an `._SSH_GSSAPI_OLD`
(MIT GSSAPI using python-gssapi package) object, an
`._SSH_GSSAPI_NEW` (MIT GSSAPI using gssapi package) object
or an `._SSH_SSPI` (MS SSPI) object.
If there is no supported API available,
``None`` will be returned.
r r r �ntz)Unable to import a GSS-API / SSPI module!)�_API�_SSH_GSSAPI_OLD�_SSH_GSSAPI_NEW�os�name� _SSH_SSPI� ImportError)� auth_method�gss_deleg_credss �2/usr/lib/python3/dist-packages/paramiko/ssh_gss.py�GSSAuthr N sR � �, �u�}� �{�<�<�
�$� $� �{�<�<�
�� �B�G�G�t�O���6�6��E�F�F� c �F � \ rS rSrSrS rS rS rS S jrS r S r
S r S
r g )
� _SSH_GSSAuth�n zg
Contains the shared variables and methods of `._SSH_GSSAPI_OLD`,
`._SSH_GSSAPI_NEW` and `._SSH_SSPI`.
c � � Xl X l SU l SU l SU l SU l SU l SU l SU l SU l SU l
SU l g)��
:param str auth_method: The name of the SSH authentication mechanism
(gssapi-with-mic or gss-keyex)
:param bool gss_deleg_creds: Delegate client credentials or not
Nzssh-connectionz1.2.840.113554.1.2.2F) � _auth_method�_gss_deleg_creds� _gss_host� _username� _session_id�_service�
_krb5_mech� _gss_ctxt�_gss_ctxt_status�
_gss_srv_ctxt�_gss_srv_ctxt_status�cc_file��selfr r s r �__init__�_SSH_GSSAuth.__init__t se � � (�� /� � ��� ��� ���(��
� � 1��� ��� %�� � "���$)��!��� r c �> � UR S5 ( a Xl gg)z�
This is just a setter to use a non default service.
I added this method, because RFC 4462 doesn't specify "ssh-connection"
as the only service value.
:param str service: The desired SSH service
zssh-N)�findr# )r+ �services r � set_service�_SSH_GSSAuth.set_service� s � � �<�<�� � � #�M� r c � � Xl g)z�
Setter for C{username}. If GSS-API Key Exchange is performed, the
username is not set by C{ssh_init_sec_context}.
:param str username: The name of the user who attempts to login
N)r! )r+ �usernames r � set_username�_SSH_GSSAuth.set_username� s � � "�r c �� � SSK Jn SSKJn U R S5 nUR U" U R 5 5 nU R [ U5 5 nUS:X a Xe- $ XF- U- $ )a|
This method returns a single OID, because we only support the
Kerberos V5 mechanism.
:param str mode: Client for client mode and server for server mode
:return: A byte sequence containing the number of supported
OIDs, the length of the OID and the actual OID encoded with
DER
:note: In server mode we just return the OID length and the DER encoded
OID.
r )�ObjectIdentifier)�encoder� �server)�pyasn1.type.univr8 �pyasn1.codec.derr9 � _make_uint32�encoder$ �len)r+ �moder8 r9 �OIDs�krb5_OID�OID_lens r � ssh_gss_oids�_SSH_GSSAuth.ssh_gss_oids� sd � � 6�,�� � ��#���>�>�"2�4�?�?�"C�D���#�#�C��M�2�� �8� ��%� %��~��(�(r c �t � SSK Jn UR U5 u p4UR 5 U R :w a gg)z�
Check if the given OID is the Kerberos V5 OID (server mode).
:param str desired_mech: The desired GSS-API mechanism of the client
:return: ``True`` if the given OID is supported, otherwise C{False}
r ��decoderFT)r= rI �decode�__str__r$ )r+ � desired_mechrI �mech�__s r �ssh_check_mech�_SSH_GSSAuth.ssh_check_mech� s/ � � -��>�>�,�/��� �<�<�>�T�_�_� ,��r c �0 � [ R " SU5 $ )z�
Create a 32 bit unsigned integer (The byte sequence of an integer).
:param int integer: The integer value to convert
:return: The byte sequence of an 32 bit integer
z!I)�struct�pack)r+ �integers r r> �_SSH_GSSAuth._make_uint32� s � � �{�{�4��)�)r c � � U R [ U5 5 nXQ-
nU[ R " S[ 5 -
nXPR [ U5 5 -
nXRR 5 -
nXPR [ U5 5 -
nXSR 5 -
nXPR [ U5 5 -
nXTR 5 -
nU$ )a^
Create the SSH2 MIC filed for gssapi-with-mic.
:param str session_id: The SSH session ID
:param str username: The name of the user who attempts to login
:param str service: The requested SSH service
:param str auth_method: The requested SSH authentication mechanism
:return: The MIC as defined in RFC 4462. The contents of the
MIC field are:
string session_identifier,
byte SSH_MSG_USERAUTH_REQUEST,
string user-name,
string service (ssh-connection),
string authentication-method
(gssapi-with-mic or gssapi-keyex)
�B)r> r@ rR rS r r? )r+ �
session_idr4 r0 r �mics r �_ssh_build_mic�_SSH_GSSAuth._ssh_build_mic� s� � �" � � ��J��0�� ��� �v�{�{�3� 4�5�5�� � � ��X� �/�/�� ��� � �� � � ��W� �.�.�� �~�~� � �� � � ��[�!1�2�2�� �!�!�#�#���
r ) r r% r& r r r' r( r$ r# r" r! r) N)�client)
�__name__�
__module__� __qualname__�__firstlineno__�__doc__r, r1 r5 rE rO r> rZ �__static_attributes__r r r r r n s* � ��
�6 $�"�)�, � *�r r c �^ � \ rS rSrSrS r S S jrS
S jrSS jrSS jr \
S 5 r S
r S r
g)r �� z�
Implementation of the GSS-API MIT Kerberos Authentication for SSH2,
using the older (unmaintained) python-gssapi package.
:see: `.GSSAuth`
c �B � [ R XU5 U R ( aD [ R [ R
[ R [ R 4U l g[ R [ R
[ R 4U l g�r N) r r, r �gssapi�C_PROT_READY_FLAG� C_INTEG_FLAG�
C_MUTUAL_FLAG� C_DELEG_FLAG�
_gss_flagsr* s r r, �_SSH_GSSAPI_OLD.__init__� sp � � � � �d� �A� � � ��(�(��#�#��$�$��#�#� �D�O� �(�(��#�#��$�$� �D�Or Nc � � SSK Jn X0l Xl [ R
" SU R - [ R 5 n[ R " 5 nU R Ul Uc* [ R R U R 5 nOeUR U5 u p�U R 5 U R :w a [ S5 e[ R R U R 5 nSn UcA [ R " UUUR S9U l U R" R% U 5 n O U R" R% U5 n U R" R. U l U $ ! [ R& aI SR) [* R, " 5 S U R 5 n [ R& " U 5 ef = f) ac
Initialize a GSS-API context.
:param str username: The name of the user who attempts to login
:param str target: The hostname of the target to connect to
:param str desired_mech: The negotiated GSS-API mechanism
("pseudo negotiated" mechanism, because we
support just the krb5 mechanism :-))
:param str recv_token: The GSS-API token received from the Server
:raises:
`.SSHException` -- Is raised if the desired mechanism of the client
is not supported
:return: A ``String`` if the GSS-API has returned a token or
``None`` if no token was returned
r rH �host@N�Unsupported mechanism OID.)� peer_name� mech_type� req_flagsz
{} Target: {}r: )r= rI r! r rg �Name�C_NT_HOSTBASED_SERVICE�Contextrl �flags�OID�mech_from_stringr$ rJ rK r � InitContextr% �step� GSSException�format�sys�exc_info� establishedr& )
r+ �targetrL r4 �
recv_tokenrI � targ_name�ctx� krb5_mechrM rN �token�messages
r �ssh_init_sec_context�$_SSH_GSSAPI_OLD.ssh_init_sec_context
sk � �$ -�!�� ���K�K� �d�n�n� $�f�&C�&C�
� � �n�n� ���O�O�� � � � �
�
�3�3�D�O�O�D�I� �~�~�l�3�H�D��|�|�~�� � �0�"�#?�@�@� "�J�J� 7� 7���� H� ��� /��!�!'�!3�!3� '� '� !�i�i�"���
���+�+�E�2�� ���+�+�J�7�� !%��� :� :�� �� �� �"�"� /�%�,�,�S�\�\�^�A�->����O�G��%�%�g�.� .� /�s � AE= �E= �=A Gc � � Xl U( dY U R U R U R U R U R 5 nU R
R
U5 nU$ U R R
U R 5 nU$ )a�
Create the MIC token for a SSH2 message.
:param str session_id: The SSH session ID
:param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not
:return: gssapi-with-mic:
Returns the MIC token from GSS-API for the message we created
with ``_ssh_build_mic``.
gssapi-keyex:
Returns the MIC token from GSS-API with the SSH session ID as
message.
)r" rZ r! r# r r% �get_micr' �r+ rX �gss_kex� mic_field� mic_tokens r � ssh_get_mic�_SSH_GSSAPI_OLD.ssh_get_micA s � � &��� �+�+�� � �����
�
��!�!� �I� ���.�.�y�9�I� �� �*�*�2�2�4�3C�3C�D�I��r c �� � Xl X0l U R c [ R " 5 U l U R R U5 nU R R U l U$ )�s
Accept a GSS-API context (server mode).
:param str hostname: The servers hostname
:param str username: The name of the user who attempts to login
:param str recv_token: The GSS-API Token received from the server,
if it's not the initial call.
:return: A ``String`` if the GSS-API has returned a token or ``None``
if no token was returned
)r r! r' rg �
AcceptContextr{ r� r( �r+ �hostnamer� r4 r� s r �ssh_accept_sec_context�&_SSH_GSSAPI_OLD.ssh_accept_sec_context\ sZ � � "��!�� � � � %�!'�!5�!5�!7�D� ��"�"�'�'�
�3��$(�$6�$6�$B�$B��!�� r c �2 � X l X0l U R bX U R U R U R U R U R 5 nU R
R
XA5 gU R R
U R U5 g)a<
Verify the MIC token for a SSH2 message.
:param str mic_token: The MIC token received from the client
:param str session_id: The SSH session ID
:param str username: The name of the user who attempts to login
:return: None if the MIC check was successful
:raises: ``gssapi.GSSException`` -- if the MIC check failed
N)r" r! rZ r# r r' �
verify_micr% �r+ r� rX r4 r� s r �
ssh_check_mic� _SSH_GSSAPI_OLD.ssh_check_micp s{ � � &��!�� �>�>� %� �+�+�� � �����
�
��!�!� �I�
� � � )� )�)� ?�
�N�N� %� %�d�&6�&6� � Br c �4 � U R R b gg)�y
Checks if credentials are delegated (server mode).
:return: ``True`` if credentials are delegated, otherwise ``False``
TF)r' �delegated_cred�r+ s r �credentials_delegated�%_SSH_GSSAPI_OLD.credentials_delegated� s � � � � � ,� ,� 8��r c � � [ e)a>
Save the Client token in a file. This is used by the SSH server
to store the client credentials if credentials are delegated
(server mode).
:param str client_token: The GSS-API token received form the client
:raises:
``NotImplementedError`` -- Credential delegation is currently not
supported in server mode
��NotImplementedError�r+ � client_tokens r �save_client_creds�!_SSH_GSSAPI_OLD.save_client_creds� �
� � "�!r �r% r& rl r r' r( r" r! �NNN�F�N�r] r^ r_ r` ra r, r� r� r� r� �propertyr� r� rb r r r r r � sB � ���. DH�2�h�6�(C�4 �� �� "r r )� � c �^ � \ rS rSrSrS r S S jrS
S jrSS jrSS jr \
S 5 r S
r S r
g)r i� z�
Implementation of the GSS-API MIT Kerberos Authentication for SSH2,
using the newer, currently maintained gssapi package.
:see: `.GSSAuth`
c �� � [ R XU5 U R ( al [ R R
[ R R [ R R [ R R 4U l g[ R R
[ R R [ R R 4U l grf )
r r, r rg �RequirementFlag�protection_ready� integrity�mutual_authentication�delegate_to_peerrl r* s r r, �_SSH_GSSAPI_NEW.__init__� s� � � � � �d� �A� � � ��&�&�7�7��&�&�0�0��&�&�<�<��&�&�7�7� �D�O� �&�&�7�7��&�&�0�0��&�&�<�<� �D�Or Nc �J � SSK Jn X0l Xl [ R
" SU R - [ R R S9nUb< UR U5 u pxUR 5 U R :w a [ S5 e[ R R n Sn
UcB [ R " UU R U SS9U l U R R# U
5 n
OU R R# U5 n
U R R$ U l U
$ ) a�
Initialize a GSS-API context.
:param str username: The name of the user who attempts to login
:param str target: The hostname of the target to connect to
:param str desired_mech: The negotiated GSS-API mechanism
("pseudo negotiated" mechanism, because we
support just the krb5 mechanism :-))
:param str recv_token: The GSS-API token received from the Server
:raises: `.SSHException` -- Is raised if the desired mechanism of the
client is not supported
:raises: ``gssapi.exceptions.GSSError`` if there is an error signaled
by the GSS-API implementation
:return: A ``String`` if the GSS-API has returned a token or ``None``
if no token was returned
r rH ro )� name_typeNrp �initiate)r rw rM �usage)r= rI r! r rg rt �NameType�hostbased_servicerJ rK r$ r �MechType�kerberos�SecurityContextrl r% r{ �completer& ) r+ r� rL r4 r� rI r� rM rN r� r� s r r� �$_SSH_GSSAPI_NEW.ssh_init_sec_context� s� � �& -�!�� ���K�K� �d�n�n� $� �o�o�7�7�
� � � #� �~�~�l�3�H�D��|�|�~�� � �0�"�#?�@�@��O�O�,�,� ��� � � #� 3� 3� ��o�o� � � �D�N� �N�N�'�'��.�E��N�N�'�'�
�3�E� $��� 7� 7�� �� r c � � Xl U( dY U R U R U R U R U R 5 nU R
R
U5 nU$ U R R
U R 5 nU$ )a�
Create the MIC token for a SSH2 message.
:param str session_id: The SSH session ID
:param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not
:return: gssapi-with-mic:
Returns the MIC token from GSS-API for the message we created
with ``_ssh_build_mic``.
gssapi-keyex:
Returns the MIC token from GSS-API with the SSH session ID as
message.
:rtype: str
)r" rZ r! r# r r% �
get_signaturer' r� s r r� �_SSH_GSSAPI_NEW.ssh_get_mic� s � � &��� �+�+�� � �����
�
��!�!� �I� ���4�4�Y�?�I� �� �*�*�8�8��9I�9I�J�I��r c �� � Xl X0l U R c [ R " SS9U l U R R U5 nU R R U l U$ )r� �accept)r� )r r! r' rg r� r{ r� r( r� s r r� �&_SSH_GSSAPI_NEW.ssh_accept_sec_context s\ � � "��!�� � � � %�!'�!7�!7�h�!G�D� ��"�"�'�'�
�3��$(�$6�$6�$?�$?��!�� r c �2 � X l X0l U R bX U R U R U R U R U R 5 nU R
R
XA5 gU R R
U R U5 g)aC
Verify the MIC token for a SSH2 message.
:param str mic_token: The MIC token received from the client
:param str session_id: The SSH session ID
:param str username: The name of the user who attempts to login
:return: None if the MIC check was successful
:raises: ``gssapi.exceptions.GSSError`` -- if the MIC check failed
N)r" r! rZ r# r r' �verify_signaturer% r� s r r� � _SSH_GSSAPI_NEW.ssh_check_mic$ s{ � � &��!�� �>�>� %� �+�+�� � �����
�
��!�!� �I�
� � � /� /� � E�
�N�N� +� +�D�,<�,<�i� Hr c �4 � U R R b gg)z�
Checks if credentials are delegated (server mode).
:return: ``True`` if credentials are delegated, otherwise ``False``
:rtype: bool
TF)r' �delegated_credsr� s r r� �%_SSH_GSSAPI_NEW.credentials_delegated> s � � � � � -� -� 9��r c � � [ e)a?
Save the Client token in a file. This is used by the SSH server
to store the client credentials if credentials are delegated
(server mode).
:param str client_token: The GSS-API token received form the client
:raises: ``NotImplementedError`` -- Credential delegation is currently
not supported in server mode
r� r� s r r� �!_SSH_GSSAPI_NEW.save_client_credsJ s
� � "�!r r� r� r� r� r� r r r r r � sB � ���. DH�,�\�8�(I�4 � � � �
"r r c �Z � \ rS rSrSrS r S S jrS
S jrS rSS jr \
S 5 r S
r S r
g)r iW zZ
Implementation of the Microsoft SSPI Kerberos Authentication for SSH2.
:see: `.GSSAuth`
c � � [ R XU5 U R ( a8 [ R [ R
- [ R - U l g[ R [ R
- U l grf )r r, r �sspicon�ISC_REQ_INTEGRITY�ISC_REQ_MUTUAL_AUTH�ISC_REQ_DELEGATErl r* s r r, �_SSH_SSPI.__init__^ sf � � � � �d� �A� � � ��)�)��-�-�.��*�*�+�
�O� �)�)�G�,G�,G�G�
�Or Nc �, � SSK Jn X0l Xl SnSU R - nUb< UR U5 u p�UR 5 U R :w a [ S5 e Uc% [ R " SU R US9U l U R R U5 u pjU
S R n
US:X a S U l Sn
U
$ ! [ R a4 n U =R SR# U R 5 -
sl e Sn A ff = f)
aT
Initialize a SSPI context.
:param str username: The name of the user who attempts to login
:param str target: The FQDN of the target to connect to
:param str desired_mech: The negotiated SSPI mechanism
("pseudo negotiated" mechanism, because we
support just the krb5 mechanism :-))
:param recv_token: The SSPI token received from the Server
:raises:
`.SSHException` -- Is raised if the desired mechanism of the client
is not supported
:return: A ``String`` if the SSPI has returned a token or ``None`` if
no token was returned
r rH �host/Nrp �Kerberos)�scflags� targetspnz , Target: {}T)r= rI r! r rJ rK r$ r �sspi�
ClientAuthrl r% � authorize�Buffer�
pywintypes�error�strerrorr} r& ) r+ r� rL r4 r� rI r� r� rM rN r� �es r r� � _SSH_SSPI.ssh_init_sec_contextq s � �$ -�!�� �����d�n�n�,� � � #� �~�~�l�3�H�D��|�|�~�� � �0�"�#?�@�@� ��!�!%� � � ����9�"��� �>�>�3�3�J�?�L�E��!�H�O�O�E�
�A�:�
� %)�D� !��E�
� � �� � � � �
�J�J�.�/�/����?� ?�J� �� �s �$AC � D� /D�Dc � � Xl U( dY U R U R U R U R U R 5 nU R
R
U5 nU$ U R R
U R 5 nU$ )a�
Create the MIC token for a SSH2 message.
:param str session_id: The SSH session ID
:param bool gss_kex: Generate the MIC for Key Exchange with SSPI or not
:return: gssapi-with-mic:
Returns the MIC token from SSPI for the message we created
with ``_ssh_build_mic``.
gssapi-keyex:
Returns the MIC token from SSPI with the SSH session ID as
message.
)r" rZ r! r# r r% �signr' r� s r r� �_SSH_SSPI.ssh_get_mic� s � � &��� �+�+�� � �����
�
��!�!� �I� ���+�+�I�6�I� �� �*�*�/�/��0@�0@�A�I��r c �� � Xl X l SU R - n[ R " SUS9U l U R R U5 u pVUS R nUS:X a SU l SnU$ )ag
Accept a SSPI context (server mode).
:param str hostname: The servers FQDN
:param str username: The name of the user who attempts to login
:param str recv_token: The SSPI Token received from the server,
if it's not the initial call.
:return: A ``String`` if the SSPI has returned a token or ``None`` if
no token was returned
r� r� )�spnr TN)r r! r� �
ServerAuthr' r� r� r( )r+ r� r4 r� r� r� r� s r r� � _SSH_SSPI.ssh_accept_sec_context� sm � � "��!���d�n�n�,� � !�_�_�Z�Y� G����)�)�3�3�J�?� ���a����� �A�:�(,�D� %��E�� r c � � X l X0l UbX U R U R U R U R U R 5 nU R
R
XA5 gU R R
U R U5 g)a3
Verify the MIC token for a SSH2 message.
:param str mic_token: The MIC token received from the client
:param str session_id: The SSH session ID
:param str username: The name of the user who attempts to login
:return: None if the MIC check was successful
:raises: ``sspi.error`` -- if the MIC check failed
N)r" r! rZ r# r r' �verifyr% r� s r r� �_SSH_SSPI.ssh_check_mic� sw � � &��!�� � � �+�+�� � �����
�
��!�!� �I�
� � � %� %�i� ;�
�N�N� !� !�$�"2�"2�I� >r c � � U R [ R - =( a U R =( d U R $ )r� )rl r� r� r( r� s r r� � _SSH_SSPI.credentials_delegated� s2 � � ����!9�!9�9�
� � %� %� 8�� � �
r c � � [ e)a;
Save the Client token in a file. This is used by the SSH server
to store the client credentails if credentials are delegated
(server mode).
:param str client_token: The SSPI token received form the client
:raises:
``NotImplementedError`` -- Credential delegation is currently not
supported in server mode
r� r� s r r� �_SSH_SSPI.save_client_creds� r� r r� r� r� r� r� r r r r r W sA � �� �( DH�2�h�6�, ?�< �
� �
� "r r )T)"ra rR r r~ �GSS_AUTH_AVAILABLE�GSS_EXCEPTIONSr
rg �hasattrr r| �
exceptions� GeneralError�raw�misc�GSSErrorr �OSErrorr� r� r� r� �paramiko.commonr �paramiko.ssh_exceptionr �paramiko._versionr
r r r � _SSH_GSSAPIr r r r r �<module>r s8 ��,� � �
� � � �� �����v�{�#�#��(8�(8�O�(K��� �-�-�/��"�� � � � *� *� �J�J�O�O� $� $�
�� 1� /� .� G�@~� ~�Bq"�l� q"�h �f� �!�K�l"�l� l"�^s"� � s"��u �W� �
� ������$�*�*�,��� � � "������
�s/ �1C �8C � D�C2�2
D �<D�?D � D