o
    �õ±j&  ã                   @   sÎ   d dl Z d dlmZ d dlmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZmZmZmZ d d
lmZ d dlmZ d dlmZmZ d dlmZ d dlmZm Z  G dd„ dƒZ!dS )é    N)Úlogger)ÚISC_REQ)ÚKerberosCredential)Ú
get_gssapiÚKRB5_MECH_INDEP_TOKEN)r   )ÚKerberosSPN)ÚGSSAPIFlags)ÚAP_REPÚEncAPRepPartÚTicketÚEncryptedData)ÚMESSAGE_TYPE)Úconstruct_apreq_from_ticket)ÚKeyÚ_enctype_table)ÚAIOKerberosClient)ÚKerberosErrorÚKerberosErrorCodec                   @   s    e Zd Zdefdd„Zdd„ Zdd„ Zdd	„ Zd dede	fdd„Z
dede	fdd„Zdede	fdd„Zdd„ Zdefdd„Zd!dedede	dedef
dd„ZdS )"ÚKerberosClientNativeÚ
credentialc                 C   sT   || _ | j  ¡ | _d | _d | _d | _d| _d| _d| _t	j
t	jB t	jB t	jB | _d S )Nr   F)r   Úto_ccredÚccredÚkcÚsession_keyÚgssapiÚ
iterationsÚ
seq_numberÚfrom_ccacher   ÚGSS_C_CONF_FLAGÚGSS_C_INTEG_FLAGÚGSS_C_REPLAY_FLAGÚGSS_C_SEQUENCE_FLAGÚflags)Úselfr   © r$   ú›/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/kerberos/client/native.pyÚ__init__   s    ÿþýÿzKerberosClientNative.__init__c                 C   s   | j S )z±
		Returns the initial sequence number. It is 0 by default, but can be adjusted during authentication, 
		by passing the 'seq_number' parameter in the 'authenticate' function
		)r   ©r#   r$   r$   r%   Úget_seq_number'   s   z#KerberosClientNative.get_seq_numberc                 C   ó   t j| jv S )z3
		Checks if integrity protection was negotiated
		)r   r   r"   r'   r$   r$   r%   Úsigning_needed.   ó   z#KerberosClientNative.signing_neededc                 C   r)   )z3
		Checks if confidentiality flag was negotiated
		)r   r   r"   r'   r$   r$   r%   Úencryption_needed4   r+   z&KerberosClientNative.encryption_neededÚinitÚdataÚ
message_noc                 Ã   s   �| j j|||d�S )z
		Signs a message. 
		)Ú	direction)r   Ú
GSS_GetMIC)r#   r.   r/   r0   r$   r$   r%   Úsign:   s   €zKerberosClientNative.signc                 Ï   s*   �| j j||g|¢R i |¤Ž\}}||fS )z
		Encrypts a message. 
		)r   ÚGSS_Wrap)r#   r.   r/   ÚargsÚkwargsÚeeeer$   r$   r%   Úencrypt@   s   € zKerberosClientNative.encryptc                 Ï   s   �| j j||g|¢R i |¤ŽS )z9
		Decrypts message. Also performs integrity checking.
		)r   Ú
GSS_Unwrap)r#   r.   r/   r4   r5   r$   r$   r%   ÚdecryptG   s   €zKerberosClientNative.decryptc                 C   s   | j jS ©N)r   Úcontentsr'   r$   r$   r%   Úget_session_keyN   s   z$KerberosClientNative.get_session_keyr"   c                 C   sø   |d u r| j S tjtjB tjB tjB }tj|v r|tjO }n|tj M }tj|v r/|tjO }n|tj M }tj	|v r@|tjO }n|tj M }tj
|v rQ|tjO }n|tj M }tj|v rb|tjO }n|tj M }tj|v rt|tjO }|S |tj M }|S r:   )r"   r   r   r   r    r!   r   Ú	INTEGRITYÚCONFIDENTIALITYÚREPLAY_DETECTÚSEQUENCE_DETECTÚUSE_DCE_STYLEÚGSS_C_DCE_STYLEÚMUTUAL_AUTHÚGSS_C_MUTUAL_FLAG)r#   r"   Úkflagsr$   r$   r%   Úiscreq_to_gssapiflagsQ   s:   ÿþý






ÿz*KerberosClientNative.iscreq_to_gssapiflagsNr   ÚauthDatar   Úcb_dataÚspnc                 Ë   s¼  ��zÃ|   |¡| _t d| j ¡ |du rtdƒ‚t |¡}t d| ¡ | jdu r3t| j	| j
jƒ| _| jdk�rÔd| _|  jd7  _z)| j	j ¡ D ]	}t d| ¡ qJ| j |¡\}}	| _}
|
rc|
‚t d¡ d	| _W n­   z| jj| j
jd
�I dH }W nh tyÙ } zO|jtjkrÆ| jjj| jj
j| jj
jd�}t| j	|ƒ}| |j| j
j ¡ ¡I dH \}}}}| ¡ | _| j |¡I dH \}}	| _n	t d| ¡ |‚W Y d}~nd}~w tyæ } z|‚d}~ww | j
jdu�r| j | j
j | j
j ¡ ¡I dH \}}}}| ¡ | _| j
j |_| j |¡I dH \}}	| _Y t d| ¡ t d|	 ¡ t d| j ¡ g }t!j"| jv �s@t!j#| jv �r�t!j"| jv �rL| $d¡ | jdu �rc| jj%||	| j| j| j||d�}nt&t'|d ƒ (¡ | j|d |d d d | j| j||d�}t d| ¡ |d	dfW S | jdu �r¤| jj%||	| j| j| j||d�}nt&t'|d ƒ (¡ | j|d |d d d | j| j||d�}t d| ¡ t)| jƒ| _*|ddfW S || _t d| +¡  ¡ zt, -|¡}t. /|j0dd… ¡j1}W n t�y } zt. /|¡j1}W Y d}~nd}~ww t d| ¡ t2t3|d d ƒ ƒ }|d d }| 4| jd|¡}t5 /|¡j1}t2t3|d d  ƒ ƒ }t6j6 7t6j8j9¡}i }|j:|d!< |j;dd"�|d#< |d$ |d$< t d%| ¡ | <| jdt5|ƒ (¡ d¡}t=|j>|d d& ƒ| _t d'| j ¡ i }d(|d)< t?j@jA|d*< tB| jj>|d+œƒ|d< t d| ¡ t.|ƒ (¡ }t!j#| jv �r³tC| jƒ| _*nt)| jƒ| _*|  jd7  _|d	dfW S  t�yÝ } zdd|fW  Y d}~S d}~ww ),za
		This function is called (multiple times depending on the flags) to perform authentication. 
		z	Flags: %sNzSPN is needed for kerberos!zSPN: %sr   é   zCCACHE SPN record: %szGot TGS from CCACHE!T)Úoverride_etype)Údc_ipÚdomainzFailed to get TGT! %szTGS: %szencpart: %szsession_key: %szmutual-requiredF)r"   r   Úap_optsrH   ÚticketÚcrealmÚcnamezname-stringzAPREQ constructed: %szProcessing AP_REP %sé   z
AP_REP: %szenc-partÚetypeÚcipheré   ÚsubkeyÚkeytypeÚcusec)ÚmicrosecondÚctimez
seq-numberzapreppart_data: %sÚkeyvaluezSessionKey: %sé   Úpvnozmsg-type)rS   rT   )DrF   r"   r   ÚdebugÚ	Exceptionr   Úfrom_spnr   r   r   r   Útargetr   r   ÚccacheÚlist_targetsÚtgs_from_ccacher   r   Úget_TGTÚetypesr   Ú	errorcoder   ÚKDC_ERR_WRONG_REALMÚget_kerberos_targetrM   Úget_referral_ticketÚget_ip_or_hostnameÚ
get_clientÚget_TGSÚcross_targetÚcross_realmr   rD   rB   ÚappendÚconstruct_apreqr   r   Údumpr   r   Úhexr   Ú
from_bytesr	   Úloadr.   Únativer   Úintr9   r
   ÚdatetimeÚnowÚtimezoneÚutcrY   Úreplacer7   r   Úenctyper   Ú
KRB_AP_REPÚvaluer   Ú
gssapi_smb)r#   rG   r"   r   rH   rI   r5   ra   ÚtgsÚencpartÚerrÚtgtÚeÚ	newtargetÚnewkcÚref_tgsÚref_encpartÚref_keyÚnew_factoryrN   ÚapreqÚtempÚapreprT   Úcipher_textÚenc_partry   Úapreppart_dataÚapreppart_data_encÚap_repÚtokenr$   r$   r%   Úauthenticates   s  €



$
ý€€ÿ(


ù
øù	ø
€ÿ
€ÿz!KerberosClientNative.authenticate)r-   )Nr   NN)Ú__name__Ú
__module__Ú__qualname__r   r&   r(   r*   r,   Úbytesrw   r2   r7   r9   r<   r   rF   Ústrr•   r$   r$   r$   r%   r      s    $"r   )"rx   Úasyauth.protocols.kerberosr   Úasyauth.common.winapi.constantsr   Ú#asyauth.common.credentials.kerberosr   Ú!asyauth.protocols.kerberos.gssapir   r   Ú$asyauth.protocols.kerberos.gssapismbr€   Úminikerberos.common.spnr   Úminikerberos.gssapi.gssapir   Ú"minikerberos.protocol.asn1_structsr	   r
   r   r   Úminikerberos.protocol.constantsr   Ú!minikerberos.protocol.ticketutilsr   Ú minikerberos.protocol.encryptionr   r   Úminikerberos.aioclientr   Úminikerberos.protocol.errorsr   r   r   r$   r$   r$   r%   Ú<module>   s   