o jS@sddlmZddlZddlZddlZddlZddlZddlmZddl Z ddl m Z ddl m Z ddlmZmZddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddddZGdddZdS)) annotationsN)List)hashlib)KerberosSecretType) string_to_keyEnctype)EncryptionType)CCACHE)Keytab)Kirbi)cms)algos)DirtyDHfiledata bytes or strreturnbytescCs|dkrt|d }|WdS1swYn.|dkr't|S|dks/|dkr=t|tr8|}t|S|dkrLt|trJ|}|St d|)Nrrbhexb64base64rawzUnknown encoding "%s"!) openreadrfromhex isinstancestrencoder b64decode Exception)rencodingkfr#/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/common/creds.pyget_encoded_datas "     r%c@s@eZdZddZdTddZdUd d ZdVdWddZdXdYddZedZd[ddZ ed\d]ddZ ed\d[ddZ ed^d_d%d&Z ed`d[d'd(Z edad+d,Zd`dbd-d.Zedcddd1d2Zedcded5d6Zedfdgd:d;ZedcdhdEz:KerberosCredential.get_common_enctypes..rz3No common supported enctypes! Server: %s Client: %sz, cSg|]}|jqSr#namerCr#r#r$rFHcSrHr#rI)rD c_enctyper#r#r$rFIrK)get_supported_enctypeslistsetlenr join)r<r>client_enctypescommon_enctypesr#r#r$get_common_enctypesCs  z&KerberosCredential.get_common_enctypesrcCs4|jdd}||}|D] }||vr|Sq dS)NFr@)rMrT)r<r>rRrSrLr#r#r$get_preferred_enctypeNs  z(KerberosCredential.get_preferred_enctypeNetypesaltrcCs|tjkr,|jrt|jS|jdur(|s|j|j }t t j |j|j Std|tjkrX|jr:t|jS|jdurT|sK|j|j }t t j|j|j Std|tjkr|jrft|jS|jrot|jS|jrt|jtr|j d}nt|jtr|j}n tdt|jt||_t|jStd|tjkr|jrt|jS|jr|s|j|j }t t j|j|j Std|tjkr|jrt|jS|jr|s|j|j }t t j |j|j Std|tj!kr]|jrt|jdd S|jrt|jdd S|jrY|j}t|jtr1|j d}nt|jtr<|j}n tdt|jt||_t|jdd Stdtd |j") z@ Returns the encryption key bytes for the enctryption type. Nz%There is no key for AES256 encryptionz%There is no key for AES128 encryptionz utf-16-lezUnknown password type: %sz"There is no key for RC4 encryptionz#There is no key for DES3 encryptionz"There is no key for DES encryptionzUnsupported encryption type: %s)#rAES256_CTS_HMAC_SHA1_96r,rrr)r(upperr'rrrAES256contentsr AES128_CTS_HMAC_SHA1_96r-AES128ARCFOUR_HMAC_MD5r/r*rrtypermd4 hexdigest DES3_CBC_SHA1r0DES3 DES_CBC_MD5r.DES_MD5 ARCFOUR_MD4rJ)r<rVrWpwr#r#r$get_key_for_enctypeVs|                 z&KerberosCredential.get_key_for_enctypeTcCst}|jdur$t|jdkr$|jD]}t|trt|}d||<qn|jdurQd|tj<d|tj <d|tj <d|tj <d|tj <d|tj <d|tj<d|tj<|jrYd|tj<|jrad|tj<|jrd|tj<d|tj <d|tj <d|tj <d|tj <d|tj <d|tj<d|tj<|js|js|jrd|tj <d|tj <|jrd|tj <|jdurt}d|tj<d|tj<|jdurt|dkrtjdtjdtj di}|dkrdd|DSdd|DS)zW Returns a list of all EncryptionTypes this credentials can use for authentication NrTcSrHr#)valuerDrVr#r#r$rFrKz=KerberosCredential.get_supported_enctypes..cSrBr#r#rlr#r#r$rFrG) collections OrderedDictr;rPrintrr: DES_CBC_CRC DES_CBC_MD4rercr_rgrYr]r,r-r)r*r/r.r1r8)r<rA supp_enctypesrVr#r#r$rMs\                            z)KerberosCredential.get_supported_enctypesrkeytab_file_pathr principalrealmcCs,t}||_||_t||d}t|||S)z:Returns a kerberos credential object from Keytab file/datar!)r&r'r(r%from_keytab_string)rsrtrur!credrr#r#r$ from_keytabs  zKerberosCredential.from_keytabcCsV|durtjd}|durtd|}t||d}t}||_||_t ||_ |S)z9Returns a kerberos credential object with CCACHE databaseN KRB5CCNAMEz No CCACHE data or path provided!rv) osenvirongetr r%r&r'r(r from_bytesr8)rrtrur! ccache_pathkr#r#r$ from_ccaches   zKerberosCredential.from_ccachecCs~|dkrt||d}t|}nt|}t}|dur|n||_|dur)|n |jj ddd|_ t ||_ d|_|S)z5Returns a kerberos credential object from .kirbi filekirbirvNticketsrruF)r%r r~copydeepcopyr& get_usernamer'kirbiobjnativer(r from_kirbir8r9)rsrtrur!rrrxr#r#r$rs   " zKerberosCredential.from_kirbirr)r7rr'r(cCs t||d}tj|||||dS)z Retruns a credential object from data found in the PFX file Username and domain will override the values found in the certificate rvr7r'r()r%r&from_pfx_string)rr)r7r'r(r!r#r#r$from_pfx s zKerberosCredential.from_pfxcCst|||SN)r&r)rsrtrur#r#r$ from_krbcredszKerberosCredential.from_krbcred keytabdata str or bytescCst}|dur td|durtd||_||_t|tr9t|dddddddddd }t |}t |j dkrItd t |j d krV|j d}n|j D]}|j|d krm|}nqY|j d}tj|jkr}tj}n;tj|jkrtj}n1tj|jkrtj}n'tj|jkrtj}ntj|jkrtj}ntj|jkrtj}n tj|jkrtj}|r|||j|S) NzPrincipal is requiredzRealm is required    rzNo entries found in keytabrj) r&r r'r(rrrrreplacerr r~rPentriesrtto_pnamelowerfindrr[enctyperr^rdDES_CRCDESDES_MD4rfRC4 add_secret key_contentsr)rrtrurxkeytab keytab_entryentryrr#r#r$rwsJ 6           z%KerberosCredential.from_keytab_stringcCs||_|dur|jjjdddd|_||_|durOd}d|jjjvr,|jjjd}d|jjjvr:|jjjd}|durKd|ddd|_dStd dS) z Tries to guess the correct username and domain from the current certificate, if 'username' and/or 'domain' is set it will set those N common_name@rjrdomain_component.rzKCould't find proper domain name in the certificate! Please set it manually!) r'r1subjectrrsplitr(issuerrQr )r<r'r(dcr#r#r$set_user_and_domain_from_certFsz0KerberosCredential.set_user_and_domain_from_certcertdatakeydatacCsddlm}m}t|tr"t|dddddddd}t|tr.)__dict__rrNrQ)r<trr#r#r$__str__s  (zKerberosCredential.__str__)r>r?rr?)r>r?rrr)rVrrWrrr)T)rr?r)rsrrtrrurrr&)NNr)rtrrurrr&)NNNr) rrr)rr7rr'rr(rrr&)NN)rrrtrrurrr&)r'rr(r)NNN) rrrrr7rr'rr(rrr&) rrrrr7rr'rr(rrr&)rNNN) r5rr6rr7rr'rr(rrr&) rrr)rr7rr'rr(rrr&) rrr)rr7rr'rr(rrr&)F)rrrr)r;r)__name__ __module__ __qualname__r=rTrUrirM staticmethodryrrrrrwrrrrrrrrrrrrr#r#r#r$r&+sH   M@  .   1 r&r)rrrr) __future__rrrmrrrtypingrr{ unicryptorminikerberos.common.constantsr minikerberos.protocol.encryptionrrminikerberos.protocol.constantsrminikerberos.common.ccacher minikerberos.common.keytabr minikerberos.common.kirbir asn1cryptor r minikerberos.protocol.dirtydhrr%r&r#r#r#r$s(