o

�h�p�@sD
dZd
dl
Z
d
dlZd
dlZdZdZdZz"d
dlZeed�r*ej	dkr*dZej
f
ZndZejjej
jjfZWn-eefyc


zd
dlZd
dlZd
dlZd	Zejf
ZWn
ey`


d
ZdZYn
wYn
wd
dlmZ
d
dlmZ
d
d
lmZ
ddd�
ZGdd�d�ZGdd�de�Zedkr�eZGdd�de�Z Gdd�de�Z!dS)z�
This module provides GSS-API / SSPI  authentication as defined in :rfc:`4462`.

.. note:: Credential delegation is not supported in server mode.

.. seealso:: :doc:`/api/kex_gss`

.. versionadded:: 1.15
�NT��	__title__z
python-gssapi�MIT�PYTHON-GSSAPI-NEW�SSPIF)
�MSG_USERAUTH_REQUEST)
�SSHException)
�__version_info__cCsHtd
kr	t
||
�Stdkrt||
�Stdkr tjdkr t||
�Std�
�
)a�
    Provide SSH2 GSS-API / SSPI authentication.

    :param str auth_method: The name of the SSH authentication mechanism
                            (gssapi-with-mic or gss-keyex)
    :param bool gss_deleg_creds: Delegate client credentials or not.
                                 We delegate credentials by default.
    :return: Either an `._SSH_GSSAPI_OLD` or `._SSH_GSSAPI_NEW` (Unix)
             object or an `_SSH_SSPI` (Windows) object
    :rtype: object

    :raises: ``ImportError`` -- If no GSS-API / SSPI module could be imported.

    :see: `RFC 4462 <http://www.ietf.org/rfc/rfc4462.txt>`_
    :note: Check for the available API and return either an `._SSH_GSSAPI_OLD`
           (MIT GSSAPI using python-gssapi package) object, an
           `._SSH_GSSAPI_NEW` (MIT GSSAPI using gssapi package) object
           or an `._SSH_SSPI` (MS SSPI) object.
           If there is no supported API available,
           ``None`` will be returned.
    rrr�ntz)Unable to import a GSS-API / SSPI module!)�_API�_SSH_GSSAPI_OLD�_SSH_GSSAPI_NEW�os�name�	_SSH_SSPI�ImportError)�auth_method�gss_deleg_credsrr�F/usr/local/CyberPanel/lib/python3.10/site-packages/paramiko/ssh_gss.py�GSSAuthNs







rc@sJeZ
dZd
Zdd�Zdd�Zdd�Zdd	d
�
Zdd�Zd
d�Z	dd�Z
dS)�_SSH_GSSAuthzs
    Contains the shared variables and methods of `._SSH_GSSAPI_OLD`,
    `._SSH_GSSAPI_NEW` and `._SSH_SSPI`.
    cCsN|
|_||_
d
|_d
|_d
|_d|_	d|_d
|_d|_d
|_	d|_
d
|_d
S)��
        :param str auth_method: The name of the SSH authentication mechanism
                                (gssapi-with-mic or gss-keyex)
        :param bool gss_deleg_creds: Delegate client credentials or not
        Nzssh-connectionz1.2.840.113554.1.2.2F)�_auth_method�_gss_deleg_creds�	_gss_host�	_username�_session_id�_service�
_krb5_mech�	_gss_ctxt�_gss_ctxt_status�
_gss_srv_ctxt�_gss_srv_ctxt_status�cc_file��selfrrrrr�__init__ts









z_SSH_GSSAuth.__init__cCs|
�d
�
r
|
|_
dSdS)z�
        This is just a setter to use a non default service.
        I added this method, because RFC 4462 doesn't specify "ssh-connection"
        as the only service value.

        :param str service: The desired SSH service
        zssh-N)�findr)r%�servicerrr�set_service�s


�z_SSH_GSSAuth.set_servicecCs
|
|_d
S)z�
        Setter for C{username}. If GSS-API Key Exchange is performed, the
        username is not set by C{ssh_init_sec_context}.

        :param str username: The name of the user who attempts to login
        N)
r)r%�usernamerrr�set_username�s
z_SSH_GSSAuth.set_username�clientcCs\d
dlm
}
d
dlm}
|�d�
}|�||j�
�
}|�t|�
�
}|
dkr(||S|||S)a�

        This method returns a single OID, because we only support the
        Kerberos V5 mechanism.

        :param str mode: Client for client mode and server for server mode
        :return: A byte sequence containing the number of supported
                 OIDs, the length of the OID and the actual OID encoded with
                 DER
        :note: In server mode we just return the OID length and the DER encoded
               OID.
        r
)
�ObjectIdentifier)
�encoder�
�server)�pyasn1.type.univr-�pyasn1.codec.derr.�_make_uint32�encoder�len)r%�moder-r.�OIDs�krb5_OID�OID_lenrrr�ssh_gss_oids�s






z_SSH_GSSAuth.ssh_gss_oidscCs0d
dlm
}
|�|
�
\}}|��|jkrdSdS)z�
        Check if the given OID is the Kerberos V5 OID (server mode).

        :param str desired_mech: The desired GSS-API mechanism of the client
        :return: ``True`` if the given OID is supported, otherwise C{False}
        r
�
�decoderFT)r2r<�decode�__str__r)r%�desired_mechr<�mech�__rrr�ssh_check_mech�s



z_SSH_GSSAuth.ssh_check_mechcCst�
d
|
�S)z�
        Create a 32 bit unsigned integer (The byte sequence of an integer).

        :param int integer: The integer value to convert
        :return: The byte sequence of an 32 bit integer
        z!I)�struct�pack)r%�integerrrrr3�sz_SSH_GSSAuth._make_uint32cCs�|�t
|
�
�
}||
7}|t�d
t�7}||�t
|�
�
7}||��7}||�t
|�
�
7}||��7}||�t
|�
�
7}||��7}|S)a�
        Create the SSH2 MIC filed for gssapi-with-mic.

        :param str session_id: The SSH session ID
        :param str username: The name of the user who attempts to login
        :param str service: The requested SSH service
        :param str auth_method: The requested SSH authentication mechanism
        :return: The MIC as defined in RFC 4462. The contents of the
                 MIC field are:
                 string    session_identifier,
                 byte      SSH_MSG_USERAUTH_REQUEST,
                 string    user-name,
                 string    service (ssh-connection),
                 string    authentication-method
                           (gssapi-with-mic or gssapi-keyex)
        �
B)r3r5rCrDrr4)r%�
session_idr*r(r�micrrr�_ssh_build_mic�s








z_SSH_GSSAuth._ssh_build_micN)
r,)�__name__�
__module__�__qualname__�__doc__r&r)r+r:rBr3rIrrrrrns

		rc@�VeZ
dZd
Zdd�Z	ddd�
Zddd	�
Zdd
d�
Zddd
�
Ze	dd��
Z
dd�ZdS)rz�
    Implementation of the GSS-API MIT Kerberos Authentication for SSH2,
    using the older (unmaintained) python-gssapi package.

    :see: `.GSSAuth`
    cCsDt�
||
|�
|jrtjtjtjtjf|_d
Stjtjtjf|_d
S�rN)	rr&r�gssapi�C_PROT_READY_FLAG�C_INTEG_FLAG�
C_MUTUAL_FLAG�C_DELEG_FLAG�
_gss_flagsr$rrrr&�s



�


�z_SSH_GSSAPI_OLD.__init__Nc
Cs
d
dlm
}
||_|
|_t�d|jtj�}t��}|j|_	|dur*tj
�|j�
}n|�
|�
\}	}
|	��|jkr<td�
�
tj
�|j�
}d}z|dur[tj|||j	d�|_|j�|�
}n|j�|�
}Wntjyz


d�t��d|j�}t�|�
�
w|jj|_|S)	a�
        Initialize a GSS-API context.

        :param str username: The name of the user who attempts to login
        :param str target: The hostname of the target to connect to
        :param str desired_mech: The negotiated GSS-API mechanism
                                 ("pseudo negotiated" mechanism, because we
                                 support just the krb5 mechanism :-))
        :param str recv_token: The GSS-API token received from the Server
        :raises:
            `.SSHException` -- Is raised if the desired mechanism of the client
            is not supported
        :return: A ``String`` if the GSS-API has returned a token or
            ``None`` if no token was returned
        r
r;�host@N�Unsupported mechanism OID.)�	peer_name�	mech_type�	req_flagsz
{} Target: {}r/)r2r<rrrP�Name�C_NT_HOSTBASED_SERVICE�ContextrU�flags�OID�mech_from_stringrr=r>r�InitContextr�step�GSSException�format�sys�exc_info�establishedr )
r%�targetr?r*�
recv_tokenr<�	targ_name�ctx�	krb5_mechr@rA�token�messagerrr�ssh_init_sec_context

s>


�











��



�

z$_SSH_GSSAPI_OLD.ssh_init_sec_contextFcC�D|
|_|s|�
|j|j|j|j�}|j�|�
}|S|j�|j�
}|S)
a�

        Create the MIC token for a SSH2 message.

        :param str session_id: The SSH session ID
        :param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not
        :return: gssapi-with-mic:
                 Returns the MIC token from GSS-API for the message we created
                 with ``_ssh_build_mic``.
                 gssapi-keyex:
                 Returns the MIC token from GSS-API with the SSH session ID as
                 message.
        )rrIrrrr�get_micr!�r%rG�gss_kex�	mic_field�	mic_tokenrrr�ssh_get_micA
�






��
z_SSH_GSSAPI_OLD.ssh_get_miccCs:|
|_||_
|jd
urt��|_|j�|�
}|jj|_|S)�

        Accept a GSS-API context (server mode).

        :param str hostname: The servers hostname
        :param str username: The name of the user who attempts to login
        :param str recv_token: The GSS-API Token received from the server,
                               if it's not the initial call.
        :return: A ``String`` if the GSS-API has returned a token or ``None``
                if no token was returned
        N)rrr!rP�
AcceptContextrbrgr"�r%�hostnamerir*rmrrr�ssh_accept_sec_context\
s








z&_SSH_GSSAPI_OLD.ssh_accept_sec_contextcC�T||_||_
|j
d
u
r |�|j|j
|j|j�}|j�||
�
d
S|j�|j|
�
d
S)at

        Verify the MIC token for a SSH2 message.

        :param str mic_token: The MIC token received from the client
        :param str session_id: The SSH session ID
        :param str username: The name of the user who attempts to login
        :return: None if the MIC check was successful
        :raises: ``gssapi.GSSException`` -- if the MIC check failed
        N)rrrIrrr!�
verify_micr�r%rurGr*rtrrr�
ssh_check_micp
�







�z_SSH_GSSAPI_OLD.ssh_check_micc

C�|jj
d
u
rdSdS)��
        Checks if credentials are delegated (server mode).

        :return: ``True`` if credentials are delegated, otherwise ``False``
        NTF)r!�delegated_cred�
r%rrr�credentials_delegated�
s

z%_SSH_GSSAPI_OLD.credentials_delegatedc
C�t�
)
a~

        Save the Client token in a file. This is used by the SSH server
        to store the client credentials if credentials are delegated
        (server mode).

        :param str client_token: The GSS-API token received form the client
        :raises:
            ``NotImplementedError`` -- Credential delegation is currently not
            supported in server mode
        �
�NotImplementedError�r%�client_tokenrrr�save_client_creds�
�z!_SSH_GSSAPI_OLD.save_client_creds�NNN�
F�
N�rJrKrLrMr&rorvr|r��propertyr�r�rrrrr�s

�
4




r)��c@rN)r
z�
    Implementation of the GSS-API MIT Kerberos Authentication for SSH2,
    using the newer, currently maintained gssapi package.

    :see: `.GSSAuth`
    cCsRt�
||
|�
|jrtjjtjjtjjtjjf|_	d
Stjjtjjtjjf|_	d
SrO)
rr&rrP�RequirementFlag�protection_ready�	integrity�mutual_authentication�delegate_to_peerrUr$rrrr&�
s



�


�z_SSH_GSSAPI_NEW.__init__NcCs�d
dlm
}
||_|
|_tjd|jtjjd�}|du
r.|�|�
\}}|�	�|j
kr.td�
�
tjj
}	d}
|durJtj||j|	dd�|_|j�|
�
}
n|j�|�
}
|jj|_|
S)	ae
        Initialize a GSS-API context.

        :param str username: The name of the user who attempts to login
        :param str target: The hostname of the target to connect to
        :param str desired_mech: The negotiated GSS-API mechanism
                                 ("pseudo negotiated" mechanism, because we
                                 support just the krb5 mechanism :-))
        :param str recv_token: The GSS-API token received from the Server
        :raises: `.SSHException` -- Is raised if the desired mechanism of the
                 client is not supported
        :raises: ``gssapi.exceptions.GSSError`` if there is an error signaled
                                                by the GSS-API implementation
        :return: A ``String`` if the GSS-API has returned a token or ``None``
                 if no token was returned
        r
r;rV)
�	name_typeNrW�initiate)rr^r@�usage)r2r<rrrPr[�NameType�hostbased_servicer=r>rr�MechType�kerberos�SecurityContextrUrrb�completer )r%rhr?r*rir<rjr@rArlrmrrrro�
s0



�










�


z$_SSH_GSSAPI_NEW.ssh_init_sec_contextFcCrp)
a�

        Create the MIC token for a SSH2 message.

        :param str session_id: The SSH session ID
        :param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not
        :return: gssapi-with-mic:
                 Returns the MIC token from GSS-API for the message we created
                 with ``_ssh_build_mic``.
                 gssapi-keyex:
                 Returns the MIC token from GSS-API with the SSH session ID as
                 message.
        :rtype: str
        )rrIrrrr�
get_signaturer!rrrrrrv�
s





��
z_SSH_GSSAPI_NEW.ssh_get_miccCs>|
|_||_
|jd
urtjdd�
|_|j�|�
}|jj|_|S)rxN�accept)
r�)rrr!rPr�rbr�r"rzrrrr|s







z&_SSH_GSSAPI_NEW.ssh_accept_sec_contextcCr})a{

        Verify the MIC token for a SSH2 message.

        :param str mic_token: The MIC token received from the client
        :param str session_id: The SSH session ID
        :param str username: The name of the user who attempts to login
        :return: None if the MIC check was successful
        :raises: ``gssapi.exceptions.GSSError`` -- if the MIC check failed
        N)rrrIrrr!�verify_signaturerrrrrr�$r�z_SSH_GSSAPI_NEW.ssh_check_micc

Cr�)z�
        Checks if credentials are delegated (server mode).

        :return: ``True`` if credentials are delegated, otherwise ``False``
        :rtype: bool
        NTF)r!�delegated_credsr�rrrr�>s

z%_SSH_GSSAPI_NEW.credentials_delegatedc
Cr�)
aw

        Save the Client token in a file. This is used by the SSH server
        to store the client credentials if credentials are delegated
        (server mode).

        :param str client_token: The GSS-API token received form the client
        :raises: ``NotImplementedError`` -- Credential delegation is currently
                 not supported in server mode
        r�r�rrrr�Js
z!_SSH_GSSAPI_NEW.save_client_credsr�r�r�r�rrrrr
�
s

�
.



r
c@sTeZ
dZd
Zdd�Z	ddd�
Zddd	�
Zd
d�Zddd
�
Ze	dd��
Z
dd�ZdS)rzf
    Implementation of the Microsoft SSPI Kerberos Authentication for SSH2.

    :see: `.GSSAuth`
    cCs>t�
||
|�
|jrtjtjBtjB|_d
StjtjB|_d
SrO)rr&r�sspicon�ISC_REQ_INTEGRITY�ISC_REQ_MUTUAL_AUTH�ISC_REQ_DELEGATErUr$rrrr&^s
���
�z_SSH_SSPI.__init__Nc
Cs�d
dlm
}
||_|
|_d
}d|j}|du
r)|�|�
\}}	|��|jkr)td�
�
z|dur8tj	d|j
|d�|_|j�|�
\}}
|
d
j
}
Wntjy_
}
z|jd�|j�
7_�d}~w
w|d
krk	d	|_d}
	|
S)
a�
        Initialize a SSPI context.

        :param str username: The name of the user who attempts to login
        :param str target: The FQDN of the target to connect to
        :param str desired_mech: The negotiated SSPI mechanism
                                 ("pseudo negotiated" mechanism, because we
                                 support just the krb5 mechanism :-))
        :param recv_token: The SSPI token received from the Server
        :raises:
            `.SSHException` -- Is raised if the desired mechanism of the client
            is not supported
        :return: A ``String`` if the SSPI has returned a token or ``None`` if
                 no token was returned
        r
r;�host/NrW�Kerberos)�scflags�	targetspnz, Target: {}T)r2r<rrr=r>rr�sspi�
ClientAuthrUr�	authorize�Buffer�
pywintypes�error�strerrorrdr )r%rhr?r*rir<r�rjr@rArm�
errrroqs6











�



��


z_SSH_SSPI.ssh_init_sec_contextFcCrp)
a�

        Create the MIC token for a SSH2 message.

        :param str session_id: The SSH session ID
        :param bool gss_kex: Generate the MIC for Key Exchange with SSPI or not
        :return: gssapi-with-mic:
                 Returns the MIC token from SSPI for the message we created
                 with ``_ssh_build_mic``.
                 gssapi-keyex:
                 Returns the MIC token from SSPI with the SSH session ID as
                 message.
        )rrIrrrr�signr!rrrrrrv�rwz_SSH_SSPI.ssh_get_miccCsV|
|_||_
d
|j}tjd|d�|_|j�|�
\}}|dj}|dkr)d|_d}|S)a�

        Accept a SSPI context (server mode).

        :param str hostname: The servers FQDN
        :param str username: The name of the user who attempts to login
        :param str recv_token: The SSPI Token received from the server,
                               if it's not the initial call.
        :return: A ``String`` if the SSPI has returned a token or ``None`` if
                 no token was returned
        r�r�)
�spnr
TN)rrr��
ServerAuthr!r�r�r")r%r{r*rirjr�rmrrrr|�s










z _SSH_SSPI.ssh_accept_sec_contextcCsR||_||_
|d
u
r|�|j|j
|j|j�}|j�||
�
d
S|j�|j|
�
d
S)ak

        Verify the MIC token for a SSH2 message.

        :param str mic_token: The MIC token received from the client
        :param str session_id: The SSH session ID
        :param str username: The name of the user who attempts to login
        :return: None if the MIC check was successful
        :raises: ``sspi.error`` -- if the MIC check failed
        N)rrrIrrr!�verifyrrrrrr��s






�z_SSH_SSPI.ssh_check_micc

Cs|jt
j@o|jp|jS)
r�)rUr�r�r"r�rrrr��s

�z_SSH_SSPI.credentials_delegatedc
Cr�)
a{

        Save the Client token in a file. This is used by the SSH server
        to store the client credentails if credentials are delegated
        (server mode).

        :param str client_token: The SSPI token received form the client
        :raises:
            ``NotImplementedError`` -- Credential delegation is currently not
            supported in server mode
        r�r�rrrr��r�z_SSH_SSPI.save_client_credsr�r�r�r�rrrrrWs

�
4



r)
T)"rMrCrre�GSS_AUTH_AVAILABLE�GSS_EXCEPTIONSrrP�hasattrrrc�
exceptions�GeneralError�raw�misc�GSSErrorr�OSErrorr�r�r�r��paramiko.commonr�paramiko.ssh_exceptionr�paramiko._versionr	rrr�_SSH_GSSAPIr
rrrrr�<module>
sV






��







���


 50