
    iI                         S SK r S SKrS SKrS SKrS SKrS SKJrJrJrJ	r	J
r
JrJrJrJrJr  S SKJrJr  S SKJr  S SKJrJrJrJrJr  S SKJr  S SKJr  S SKJ r J!r!J"r"J#r#  \RH                  " \%5      r& " S	 S
\5      r'g)    N)
IOVContextProxy
ContextReqGSSMechIOVUnwrapResultIOVWrapResultSecPkgContextSizesUnwrapResultWinRMWrapResult
WrapResult)
Credentialunify_credentials)GSSAPIProxy)NegStateNegTokenInitNegTokenResppack_mech_type_listunpack_token)	SSPIProxy)GssChannelBindings)BadMechanismErrorInvalidTokenErrorNegotiateOptionsNoContextErrorc                   t  ^  \ rS rSrSrSSSSS\R                  SS\R                  4	S\	R                  \	R                  \\\	R                  \   4      S\	R                  \   S\	R                  \   S	\	R                  \   S
\	R                  \   S\S\S\S\S\	R                   SS4U 4S jjjr\S=S\	R                  \   S\	R                  \   4S jj5       r\S\4S j5       r\S\	R                  \   4S j5       r\S\4S j5       r\S\4S j5       r\S\	R                  \   4S j5       r\S\4S j5       rS>S jr S=SS.S\	R                  \   S
\	R                  \   S\	R                  \   4S jjjr  S?S\	R                  \   S
\	R                  \   S\	R>                  \	R                  \   \	R                  \   \4   4S jjr  S=SS.S\	R                  \   S
\	R                  \   S\	R                  \   4S jjjr!S=S\	R                  \   S\	R                  \   4S  jjr"  S?S!\	R                  \   S"\	R                  \   S\	R                  \   4S# jjr#S\$4S$ jr%S@S%\S&\S'\	R                  \&   S\'4S( jjr(  S@S)\	RR                  \*   S&\S'\	R                  \&   S\+4S* jjr,S%\S\-4S+ jr.S%\S\/4S, jr0S)\	RR                  \*   S\14S- jr2S.\S%\S\4S/ jr3S=S%\S'\	R                  \&   S\4S0 jjr4S%\S1\S\&4S2 jr5\S\64S3 j5       r7\S\84S4 j5       r9\S\	R                  \	R>                  \\&4      4S5 j5       r:\S\4S6 j5       r;S\	R                  \8   4S7 jr<  S?S8\	R                  \	R                  \      S
\	R                  \   S\	R                  \   4S9 jjr=SAS:\SS4S; jjr>S<r?U =r@$ )BNegotiateProxy+   a/  A context wrapper for a Python managed SPNEGO context.

This is a context that can be used on Linux to generate SPNEGO tokens based on the raw Kerberos or NTLM tokens
generated by gssapi or our Python NTLM provider This is used as a fallback if gssapi is not available or cannot
generate SPNEGO tokens.
Ninitiate	negotiateusernamepasswordhostnameservicechannel_bindingscontext_requsageprotocoloptionskwargsreturnc
           
      H  > [        X5      n[        [        U ]  XXEXgX5        Xl        SU l        U
R                  SS 5      U l        0 U l        S U l	        / U l
        SU l        SU l        SU l        SU l        [        U R                   ["        R$                  -  5      U l        g )NF_negotiate_contexts)r   superr   __init___credentials	_completeget_available_contexts_context_list_NegotiateProxy__chosen_mech
_mech_list
_init_sent
_mech_sent	_mic_sent	_mic_recvboolr%   r   	dce_style_mic_required)selfr    r!   r"   r#   r$   r%   r&   r'   r(   r)   credentials	__class__s               K/home/james-whalen/.local/lib/python3.13/site-packages/spnego/_negotiate.pyr.   NegotiateProxy.__init__3   s     (;nd,7kRZ	
 (X^XbXb!4Y
  hj7;,.!$"2"2Z5I5I"IJ    c                     SS/nS[         R                  " US9;   d  S[        R                  " US9;   a  UR                  SS5        U$ )Nntlmr   kerberosr(   r   )r   available_protocolsr   insert)clsr(   	protocolss      r@   rG   "NegotiateProxy.available_protocolsU   sQ     [)	 88
 
988IIQ
+rB   c                 `    [         R                  " 5       / :X  a  [        R                  " 5       $ g)NT)r   rG   r   iov_available)rI   s    r@   rM   NegotiateProxy.iov_availablec   s'     ((*b0,,..rB   c                 T    U R                   (       a  U R                  R                  $ S $ N)r3   _contextclient_principalr=   s    r@   rR   NegotiateProxy.client_principalk   s    151C1Ct}}--MMrB   c                     U R                   $ rP   )r0   rS   s    r@   completeNegotiateProxy.completeo   s    ~~rB   c                 p    U R                   (       a  U R                  R                  $ [        R                  $ rP   )r3   rQ   context_attrr   nonerS   s    r@   rY   NegotiateProxy.context_attrs   s#    -1-?-?t}}))TZ__TrB   c                 T    U R                   (       a  U R                  R                  $ S $ rP   )r3   rQ   negotiated_protocolrS   s    r@   r]   "NegotiateProxy.negotiated_protocolw   s    484F4Ft}}00PDPrB   c                 T    U R                   (       a  U R                  R                  $ S$ )NrB   )r3   rQ   session_keyrS   s    r@   r`   NegotiateProxy.session_key{   s    ,0,>,>t}}((GCGrB   c                 6   [        U R                  U R                  U R                  U R                  U R
                  U R                  U R                  U R                  R                  5        VVs0 s H  u  pXS   R                  5       _M     snnS9$ s  snnf )Nr   )r"   r#   r$   r%   r&   r'   r(   r,   )r   	_hostname_servicer$   r%   r&   r'   r(   r3   itemsnew_context)r=   mcs      r@   rf   NegotiateProxy.new_context   s    ^^MM!22((**]]LLCGCUCUC[C[C] ^C]41aD$4$4$6!6C] ^	
 		
 !_s   0Br$   in_tokenc                n   [         R                  S[        R                  " U=(       d    S5      R	                  5       5        U R                  UUS9u  p4nS nU(       d  U R                  S:X  a  U R                  X2S9nS nU(       a  U R                  US9nU R                  XhS9nOUnU R                  R                  U l        U R                  (       a  U R                  U R                  S 40U l        [         R                  S[        R                  " U=(       d    S5      R	                  5       -  5        U$ )NzSPNEGO step input: %srB   rk   r$   r   )in_mic)	out_tokenout_miczSPNEGO step output: %s)logdebugbase64	b64encodedecode_step_spnego_inputr&   _step_spnego_token_step_spnego_mic_step_spnego_outputrQ   rV   r0   _chosen_mechr3   )	r=   rk   r$   mech_token_inmech_list_mic	is_spnegomech_token_outro   rp   s	            r@   stepNegotiateProxy.step   s    			)6+;+;HO+L+S+S+UV 372I2I- 3J 3
/i
 DJJ*4!44m4oN,0	++=+AG 00>0[I 'I!]]33DN=="&"3"3dmmT5J!KD		*V-=-=i>N3-O-V-V-XXYrB   c                    S nS nSnU(       Ga+   [        U5      n[	        U[
        5      (       a  UR                  nUR                  nU R                  UR                  US9nU R                  S:X  a  Xpl        GOSU l        UR                  U l        U R                  5       S   nUR                  UR                  S   :w  a  SU l        GO[	        U[         5      (       a  UR                  nUR"                  nU(       a  X4:X  a  S nUR$                  (       a,  [&        R(                  " UR$                  5      U l        SU l        UR.                  [0        R2                  :X  a  U(       d	  [        SS9eUR.                  [0        R4                  :X  a  SU l        OUR.                  [0        R6                  :X  a  SU l        OS	nUnU(       a&  UR;                  S
5      (       a  [&        R<                  O[&        R>                  U l        U R@                  (       d%  U R                  U R*                  R                  /US9  OU R                  US9U l        XCU4$ ! [        R                   a  n[        USU< 3S9eS nAff = f)NTzFailed to unpack input token )
base_errorcontext_msg)
mech_typesr$   r   r   z5Received SPNEGO rejection with no token error messager   Fs   NTLMSSP rj   )!r   structerrorr   
isinstancer   r|   
mech_token_rebuild_context_listr   r&   r5   r6   _preferred_mech_listvaluer<   r   response_tokensupported_mechr   from_oidr4   r7   	neg_stater   rejectrequest_micaccept_completer0   
startswithrD   rE   r3   )	r=   rk   r$   r|   tokenr}   e	mech_listpreferred_mechs	            r@   rv   !NegotiateProxy._step_spnego_input   sF   
 	i'1 (L11 ( 6 6 ++ !66'22%5 7 	
 ::+ '0O
 '+DO&.&9&9DO &*%>%>%@%CN%++x/B/B1/EE-1*Hl33 ( 6 6 //
 ]3$(M **)0)9)9(:Q:Q)RD&&*DO %%8+8opp%%)=)==)-D&''8+C+CC%)DN "	 5:u?O?OP^?_?_W\\eleueu"))..$($6$6$<$<#=)9 /  #88!1 9 DO Y..S << i'1DabcafBghhis   I I9&I44I9c                    U R                   nU R                  U   u  pES nUR                  (       dB  U(       a  UnUS 4U R                  U'   OUR                  XS9nU R                  (       a  SU l        U$ )Nrm   T)rz   r3   rV   r   _requires_mech_list_micr<   )r=   rk   r$   chosen_mechcontextgenerated_tokenro   s          r@   rw   !NegotiateProxy._step_spnego_token	  sy     ''#'#5#5k#B ,0	 +	3:D/"";/ $LL(L^	 ++%)"rB   rn   c                    U(       aZ  U R                  [        U R                  5      U5        U R                  SS9  SU l        SU l        U R                  (       a  SU l        U R                  R                  (       a_  U R                  (       aN  U R                  (       d=  U R                  [        U R                  5      5      nU R                  5         SU l        U$ g )NFoutgoingT)verifyr   r5   _reset_ntlm_crypto_stater<   r9   r8   r0   rQ   rV   sign)r=   rn   rp   s      r@   rx   NegotiateProxy._step_spnego_mic$  s    KK+DOO<fE))5)9!%D!DN~~!%==!!d&8&8ii 3DOO DEG))+!DNNrB   ro   rp   c                    S nU R                   (       dG  SU l         UUS.nU R                  S:X  a  SUS'   [        U R                  40 UD6R	                  5       nU$ U R
                  (       d  [        R                  nS nU R                  (       d>  U R                  R                  nU R                  (       a  [        R                  nSU l        U R                  R
                  (       aJ  U R                  (       a"  U R                  (       a(  U R                  (       a  [        R                   nSU l        [%        XVXS9R	                  5       nU$ )NT)r   r|   accepts$   not_defined_in_RFC4178@please_ignore	hint_name)r   r   r   r|   )r6   r&   r   r5   packrV   r   accept_incompleter7   rz   r   r<   r   rQ   r8   r9   r   r0   r   )r=   ro   rp   final_tokeninit_kwargsstater   s          r@   ry   "NegotiateProxy._step_spnego_output9  s   
 /3"DO (!(9K zzX%+RK(&tF+FKKMK0 - ..E
 "N??!%!2!2!8!8%%$00E"&}}%%t/A/AdnnY]YgYg 00!%&ydf  rB   c                 j    U R                   (       d	  [        SS9eU R                  R                  5       $ )Nz;Cannot get message sizes until context has been establishedr   )rV   r   rQ   query_message_sizesrS   s    r@   r   "NegotiateProxy.query_message_sizesd  s(    }} -jkk}}0022rB   dataencryptqopc                 6    U R                   R                  XUS9$ N)r   r   )rQ   wrap)r=   r   r   r   s       r@   r   NegotiateProxy.wrapj  s    }}!!$S!AArB   iovc                 6    U R                   R                  XUS9$ r   )rQ   wrap_iov)r=   r   r   r   s       r@   r   NegotiateProxy.wrap_iovm  s     }}%%c%DDrB   c                 8    U R                   R                  U5      $ rP   )rQ   
wrap_winrmr=   r   s     r@   r   NegotiateProxy.wrap_winrmu  s    }}''--rB   c                 8    U R                   R                  U5      $ rP   )rQ   unwrapr   s     r@   r   NegotiateProxy.unwrapx  s    }}##D))rB   c                 8    U R                   R                  U5      $ rP   )rQ   
unwrap_iov)r=   r   s     r@   r   NegotiateProxy.unwrap_iov{  s     }}'',,rB   headerc                 8    U R                   R                  X5      $ rP   )rQ   unwrap_winrm)r=   r   r   s      r@   r   NegotiateProxy.unwrap_winrm  s    }}))&77rB   c                 4    U R                   R                  XS9$ )N)r   )rQ   r   )r=   r   r   s      r@   r   NegotiateProxy.sign  s    }}!!$!00rB   micc                 8    U R                   R                  X5      $ rP   )rQ   r   )r=   r   r   s      r@   r   NegotiateProxy.verify  s    }}##D..rB   c                 :    U R                   U R                     S   $ )Nr   )r3   rz   rS   s    r@   rQ   NegotiateProxy._context  s    !!$"3"34Q77rB   c                 x    U R                   (       a  U R                   $ [        [        U R                  5      5      $ rP   )r4   nextiterr3   rS   s    r@   rz   NegotiateProxy._chosen_mech  s-    %%%D++,--rB   c                     / $ rP    rS   s    r@   _context_attr_map NegotiateProxy._context_attr_map  s    	rB   c                 .    U R                   R                  $ rP   )rQ   r   rS   s    r@   r   &NegotiateProxy._requires_mech_list_mic  s    }}444rB   c                     U R                  U R                  5       Vs/ s H  oS:w  d  M
  UPM     nnU Vs/ s H  n[        [        U5      PM     sn$ s  snf s  snf )zKGet a list of mechs that can be used in priority order (highest to lowest).r   )rG   r(   getattrr   )r=   prG   s      r@   r   #NegotiateProxy._preferred_mech_list  sU    *.*B*B4<<*Pe*PQYdTdq*Pe-@A-@#-@AA fAs   	AAAr   c           	         U R                   =(       d    0 nSnU(       Gd-  U R                  U R                  U R                  U R                  S.nU R                  5       nU H  nU(       a  UR                  U;  a  M  UR                  n [        R                  SU S35        U R                  [        R                  ) -  n	US:X  a+  S[        R                  " U	S9;   a  U	[        R                  -  n	U R                   S:X  a  ["        R$                  " SXS.UD6n
O#["        R&                  " U R(                  4XS.UD6n
S	U
l        XU'   M     0 U l        / nUR3                  5        HR  u  pz U R                   S:X  a  U
R5                  US9OSnX4U R0                  U'   UR7                  UR                  5        MT     U(       d
  [9        SUS9eU$ ! [,         a.  nUn[        R                  S
U[/        U5      5         SnAGM  SnAff = f! [,         a7  nUn[        R                  SUR                  [/        U5      5         SnAM  SnAff = f)z;Builds a new context list that are available to the client.N)r"   r#   r$   r%   zAttempting to create z' context when building SPNEGO mech listrD   rF   r   )r'   r(   Tz3Failed to create context for SPNEGO protocol %s: %sr   rj   z7Failed to create first token for SPNEGO protocol %s: %sz$Unable to negotiate common mechanism)r   r   r   )r2   rc   rd   r$   r%   r   r   namerq   rr   r(   r   use_negotiater   rG   use_ntlmr&   spnegoserverclientr/   _is_wrapped	Exceptionstrr3   re   r   appendr   )r=   r   r$   available_contextslast_errcontext_kwargsall_protocolsmechr'   r(   r   r   r   first_tokens                 r@   r   $NegotiateProxy._rebuild_context_list  s#    "55;! NN==$($9$9#//	<N !557M%$**J">99II 5hZ?fgh #ll.>.L.L-LLG6)f	8U8U^e8f.f#3#<#<<zzX-"(--"e"eVd"e"(--0A0A"xH"xiw"x*.G'/6t,' &2  	/557MDQUQ[Q[_iQigll<LlMos )0'=Dt$TZZ( 8 #0Vckll+ !  HIISU]_bcd_ef  		SUYU^U^`cde`fgs1   
B?G,!H

H"HH

I,IIr   c                 6    U R                   R                  US9  g )Nr   )rQ   r   )r=   r   s     r@   r   'NegotiateProxy._reset_ntlm_crypto_state  s    ...ArB   )__chosen_mechr2   r0   r3   r/   r6   r5   r7   r9   r<   r8   rP   )r*   r   )NN)TN)T)A__name__
__module____qualname____firstlineno____doc__r   defaultr   rZ   typingOptionalUnionr   r   Listr   Anyr.   classmethodrG   r:   rM   propertyrR   rV   rY   r]   bytesr`   rf   r   Tuplerv   rw   rx   ry   r	   r   intr   r   Iterabler   r   r   r   r   r
   r   r   r   r   r   r   r   rQ   r   rz   r   r   r   r   r   __static_attributes____classcell__)r?   s   @r@   r   r   +   s    ]a)-)-(,@D","4"4#$4$9$9 K//&,,sJJ@W/W"XY K //#& K //#&	 K
 % K !//*<= K   K  K  K " K ** K 
 K  KD &//:J*K W]WbWbcfWg   d   N&//#"6 N N $   Uj U U QV__S%9 Q Q HU H H

 ,0% AE	%//%(% !//*<=	%
 
	%R ,0@DU///%(U/ !//*<=U/ 
fooe,fooe.DdJ	K	U/r ,0 AE	//%( !//*<=	
 
	6vu'= Y^I_ . -1*.)??5)) ') 
		)V3%7 3B B B6??3;O B[e B $(	E__S!E E __S!	E
 
E.u . .*5 *\ *-__S!- 
-85 8 8% 81 1V__S%9 1U 1/5 /u / / 8, 8 8 .g . . 6;;v||JO/L#M   5 5 5Bfkk'&: B 9=@D;OOFKK$45; !//*<=; 
S		;zB B B BrB   r   )(rs   loggingr   r   r   spnego._contextr   r   r   r   r   r   r	   r
   r   r   spnego._credentialr   r   spnego._gssr   spnego._spnegor   r   r   r   r   spnego._sspir   spnego.channel_bindingsr   spnego.exceptionsr   r   r   r   	getLoggerr   rq   r   r   rB   r@   <module>r     sk           = #  # 6  !uB\ uBrB   