
    i
                        S SK r S SKrS SKrS SKrS SKrS SKJrJrJrJ	r	J
r
JrJrJrJrJr  S SKJrJrJrJrJr  S SKJrJrJrJrJrJrJrJrJrJ r J!r!J"r"  S SK#J$r$J%r%J&r&J'r'J(r(J)r)J*r*J+r+J,r,J-r-  S SK.J/r/J0r0  S SK1J2r2  S SK3J4r4  S S	K5J6r6J7r7J8r8J9r9J:r:J;r;J<r<J=r=J>r>  S S
K?J@r@JArA  \R                  " \C5      rDS\R                  \F   4S jrG  SS\R                  \F   S\R                  \F   S\R                  \F   S\R                  \R                  \F   \R                  \F   \I\I4   4S jjrJS\R                  \F   4S jrK " S S5      rL " S S\5      rMg)    N)
IOVContextProxy
ContextReqIOVUnwrapResultIOVWrapResultSecPkgContextSizesUnwrapResultWinRMWrapResult
WrapResultsplit_username)
CredentialCredentialCacheNTLMHashPasswordunify_credentials)	RC4Handlecompute_response_v1compute_response_v2hmac_md5lmowfv1md5ntowfv1ntowfv2rc4initrc4ksealkeysignkey)
AuthenticateAvFlagsAvId	ChallengeFileTime	NegotiateNegotiateFlagsNTClientChallengeV2
TargetInfoVersion)sealsign)to_text)GssChannelBindings)	BadBindingsErrorBadMICError	ErrorCodeInvalidTokenErrorNegotiateOptionsNoContextErrorOperationNotAvailableErrorSpnegoErrorUnsupportedQop)
BufferTypeIOVResBufferreturnc                      [         R                  R                  SS5      n U (       d  g[        U SS9n[         R                  R                  U5      (       a  U$ g)zGet the path to the NTLM credential store.

Returns the path to the NTLM credential store specified by the environment variable `NTLM_USER_FILE`.

Returns:
    Optional[bytes]: The path to the NTLM credential file or None if not set or found.
NTLM_USER_FILENzutf-8)encoding)osenvirongetr*   pathisfile)user_file_path	file_paths     F/home/james-whalen/.local/lib/python3.13/site-packages/spnego/_ntlm.py_get_credential_filerC   J   sG     ZZ^^$4d;N9I	ww~~i      storedomainusernamec                 R   U (       d	  [        SS9eU=(       d    SnS[        S[        R                  [        R                  [        [        [        R
                  [           [        R
                  [           [        R
                  [           4      4S jn[        U SS9 nUR                  5       R                  5       nU" U5       H  u  pgpn
U(       aH  UR                  5       UR                  5       :X  d  M2  UR                  5       UR                  5       :X  d  MV  U	(       d  [        U=(       d    S5      n	U
(       d  [        U=(       d    S5      n
U(       d  UnU(       d  U=(       d    S	nXX4s  sS	S	S	5        $    [        [        R                  S
S9e! , (       d  f       g	= f)a#  Look up NTLM credentials from the common flat file.

Retrieves the LM and NT hash for use with authentication or validating a credential from an initiator.

Each line in the store can be in the Heimdal format `DOMAIN:USER:PASSWORD` like::

    testdom:testuser:Password01
    :testuser@TESTDOM.COM:Password01

Or it can use the `smbpasswd`_ file format `USERNAME:UID:LM_HASH:NT_HASH:ACCT_FLAGS:TIMESTAMP` like::

    testuser:1000:278623D830DABE161104594F8C2EF12B:C3C6F4FD8A02A6C1268F1A8074B6E7E0:[U]:LCT-1589398321
    TESTDOM estuser:1000:4588C64B89437893AAD3B435B51404EE:65202355FA01AEF26B89B19E00F52679:[U]:LCT-1589398321
    testuser@TESTDOM.COM:1000:00000000000000000000000000000000:8ADB9B997580D69E69CAA2BBB68F4697:[U]:LCT-1589398321

While only the `USERNAME`, `LM_HASH`, and `NT_HASH` fields are used, the colons are still required to differentiate
between the 2 formats. See `ntlm hash generator`_ for ways to generate the `LM_HASH` and `NT_HASH`.

The username is case insensitive but the format of the domain and user part must match up with the value used as
the username specified by the caller.

While each line can use a different format, it is recommended to stick to 1 throughout the file.

The same env var and format can also be read with gss-ntlmssp.

Args:
    store: The credential store to lookup the credential from.
    domain: The domain for the user to get the credentials for. Should be `None` for a user in the UPN form.
    username: The username to get the credentials for. If omitted then the first entry in the store is used.

Returns:
    Tuple[str, str, bytes, bytes]: The domain, username, LM, and NT hash of the user specified.

.. _smbpasswd:
    https://www.samba.org/samba/docs/current/man-html/smbpasswd.5.html

.. _ntlm hash generator:
    https://asecuritysite.com/encryption/lmhash
zhNo username or password was specified and the credential cache did not exist or contained no credentialscontext_msg textr7   c              3     #    U R                  5        H  nUR                  S5      n[        U5      S:X  a  US   US   US   S S 4v   M7  [        U5      S:X  d  MH  [        US   5      u  p4[        R
                  " US   R                  5       5      n[        R
                  " US   R                  5       5      nU=(       d    SU=(       d    SS XV4v   M     g 7f)N:   r            rK   )
splitlinessplitlenr   base64	b16decodeupper)rL   line
line_splitdomain_entry
user_entrylm_entrynt_entrys          rB   store_lines$_get_credential.<locals>.store_lines   s      OO%DCJ:!# mZ]JqM4MMZA%+9*Q-+H(!++JqM,?,?,AB!++JqM,?,?,AB"(b**:D(TT &s   ACA=Crb)modeNzJFailed to find any matching credential in NTLM_USER_FILE credential store.)r2   strtypingIteratorTupleOptionalbytesopenreaddecoderX   r   r   r3   r.   failure)rE   rF   rG   r_   fd	cred_textline_domain	line_userline_passwordlm_hashnt_hashs              rB   _get_credentialrt   ]   sW   X ( C
 	
 \rFUU	c30DfooV[F\^d^m^mns^t&tu	vU  
e$	2GGI$$&	GRS\G]CKMG 0IOO4E E&,,.\g\m\m\oJo%m&9r:G%m&9r:G  (H(0DF99% 
 	 H^$ !!h + 
 	s    !AF: FAF>F
F&c                      S[         R                  ;   a  [         R                  S   n O#[        R                  " 5       R	                  5       n U (       a  [        U 5      $ S$ )a[  Get the current workstation name.

This gets the current workstation name that respects `NETBIOS_COMPUTER_NAME`. The env var is used by the library
that gss-ntlmssp calls and makes sure that this Python implementation is a closer in its behaviour.

Returns:
    Optional[str]: The workstation to supply in the NTLM authentication message or None.
NETBIOS_COMPUTER_NAMEN)r;   r<   socketgethostnamerX   r*   )workstations    rB   _get_workstationrz      sL     "**,jj!89 ((*002 $/7;8D8rD   c                   F    \ rS rSr SS\R
                  \   SS4S jjrSrg)_NTLMCredential   N
credentialr7   c                    S U l         U   [        U[        5      (       ao  SU l        UR                  U l         [        UR                  5      u  U l        U l        [        UR                  5      U l	        [        UR                  5      U l        g [        U[        5      (       a  SU l        UR                  U l         [        UR                  5      u  U l        U l        UR                  (       a.  [        R                  " UR                  R                  5       5      OSU l	        UR                  (       a.  [        R                  " UR                  R                  5       5      OSU l        g S =p#[        U[         5      (       a(  UR                  U l         [        UR                  5      u  p#[#        5       U l        [%        U R                  X#5      u  U l        U l        U l	        U l        g )Nexplicit                   )_raw_username
isinstancer   _storerG   r   rF   r   passwordrr   r   rs   r   rV   rW   rX   r   rC   rt   )selfr~   rF   rG   s       rB   __init___NTLMCredential.__init__   sh    48j(++$DK!+!4!4D)7
8K8K)L&DK":#6#67DL":#6#67DL
H--$DK!+!4!4D)7
8K8K)L&DKKUK]K]6++J,>,>,D,D,FGcoDLKUK]K]6++J,>,>,D,D,FGcoDL !%$F*o66%/%8%8"#1*2E2E#F .0DKETUYU`U`bhEsBDKdlrD   )r   r   rF   rr   rs   rG   N)	__name__
__module____qualname____firstlineno__rd   rg   r   r   __static_attributes__ rD   rB   r|   r|      s0     37tOOJ/t 
t trD   r|   c                   >  ^  \ rS rSrSrSSSSS\R                  SS\R                  4	S\	R                  \	R                  \\\	R                  \   4      S\	R                  \   S\	R                  \   S	\	R                  \   S
\	R                  \   S\S\S\S\S\	R                   SS4U 4S jjjr\S>S\	R                  \   S\	R                  \   4S jj5       r\S\4S j5       r\S\	R                  \   4S j5       r\S\4S j5       r\S\	R                  \   4S j5       r\S\4S j5       rS?S jr S>SS.S\	R                  \   S
\	R                  \   S\	R                  \   4S jjjr S>SS.S\	R                  \   S
\	R                  \   S\4S jjjrSS.S\S
\	R                  \   S\	R                  \   4S jjrS\S\4S jr S\S
\	R                  \   SS4S  jr!S\"4S! jr#S@S"\S#\S$\	R                  \$   S\%4S% jjr&  S@S&\	RN                  \(   S#\S$\	R                  \$   S\)4S' jjr*S"\S\+4S( jr,S"\S\-4S) jr.S&\	RN                  \(   S\/4S* jr0S+\S"\S\4S, jr1S>S"\S$\	R                  \$   S\4S- jjr2S"\S.\S\$4S/ jr3\S\	R                  \	Rh                  \\$4      4S0 j5       r5\S\4S1 j5       r6\S\$4S2 j5       r7\S\$4S3 j5       r8S4\S5\S6\S7\S\4
S8 jr9S6\:S9\;S
\	R                  \   S\	Rh                  \\\4   4S: jr<SAS;\SS4S< jjr=S=r>U =r?$ )B	NTLMProxy   zA context wrapper for a Python managed NTLM context.

This is a context that can be used on Linux to generate NTLM without any system dependencies.
NinitiatentlmrG   r   hostnameservicechannel_bindingscontext_requsageprotocoloptionskwargsr7   c
           
        > [        XSS9n[        [        U ]  XXEXgX5        SU l        S U l        U R                  [        R                  -  [        R                  -  [        R                  -  [        R                  -  [        R                  -  [        R                  -  [        R                  -  [        R                  -  [        R                   -  [        R"                  -  U l        [%        [&        R(                  R+                  SS5      5      nUS:  d  US:  a  [-        [.        R0                  SU-  S	9eUS:X  a$  U =R                  [        R                  ) -  sl        U R2                  S
:X  ai  [5        [7        S U 5       5      5      U l        US:  U l        US:  U l        US:  U l        US:  a$  U =R                  [        R                  ) -  sl        O3US:  U l        US:  U l        SU l        [?        5       (       d	  [A        SS	9eS U l!        S U l"        SU l#        S U l$        S U l%        S U l&        S U l'        S U l(        SU l)        SU l*        g )Nr   )required_protocolFLM_COMPAT_LEVELrO   r      z3Invalid LM_COMPAT_LEVEL %d, must be between 0 and 5rI   r   c              3   J   #    U  H  nS UR                   ;   d  M  Uv   M     g7f)r   N)supported_protocols).0cs     rB   	<genexpr>%NTLMProxy.__init__.<locals>.<genexpr>&  s      3n{!fXYXmXmNmAA{s   #	#rQ   rP      TzpNTLM acceptor requires NTLM credential cache to be provided through the env var NTLM_USER_FILE set to a filepath)+r   superr   r   	_complete_credential_context_reqr$   key_128key_56key_exchextended_session_securityalways_signr   lm_keyrequest_targetoemunicodeintr;   r<   r=   r3   r.   rl   r   r|   next_lm_nt_v1_nt_v2rC   r2   _temp_negotiate_temp_challenge_mic_required_session_key_sign_key_out_sign_key_in_handle_out
_handle_in_NTLMProxy__seq_num_in_NTLMProxy__seq_num_out)r   rG   r   r   r   r   r   r   r   r   r   credentialslm_compat_level	__class__s                rB   r   NTLMProxy.__init__   sV    (fUi'7kRZ	
 =A $$%##$ %%& 66	7
 (() !!" ##$ ++,   	! $$
% 	& bjjnn->BCQ/A"5!!/dgv/v  a."J"J!JJ::#.t3n{3n/noD&*DH)A-DK)A-DK"!!n&;&;%;;! '*DH)A-DKDK ())0 !S  <@;?" 5959487;6:rD   c                     S/$ Nr   r   )clsr   s     rB   available_protocolsNTLMProxy.available_protocolsG  s	    xrD   c                     g)NTr   )r   s    rB   iov_availableNTLMProxy.iov_availableK  s    rD   c                    U R                   S:X  at  U R                  (       ac  U R                  (       aR  U R                  R                  (       a  U R                  R                  S-   OSnU< U R                  R                  < 3$ g )Naccept\rK   )r   completer   rF   rG   )r   domain_parts     rB   client_principalNTLMProxy.client_principalO  s]    ::!dmm8H8H<@<L<L<S<S$**11D8Y[K($*:*:*C*CDDrD   c                     U R                   $ r   )r   r   s    rB   r   NTLMProxy.completeW  s    ~~rD   c                     gr   r   r   s    rB   negotiated_protocolNTLMProxy.negotiated_protocol[  s    rD   c                 ,    U R                   =(       d    S$ )NrD   )r   r   s    rB   session_keyNTLMProxy.session_key_  s      'C'rD   c                    S nU R                   (       a  U R                  S:X  a  [        U R                   R                  =(       d    S[        R
                  " U R                   R                  5      R                  5       [        R
                  " U R                   R                  5      R                  5       S9n[        UU R                  U R                  U R                  U R                  U R                  U R                  U R                  S9$ )Nr   rK   )rG   rr   rs   )rG   r   r   r   r   r   r   r   )r   r   r   r   rV   	b16encoderr   rk   rs   r   	_hostname_servicer   r   r   r   )r   creds     rB   new_contextNTLMProxy.new_contextc  s    *.

j 8))77=2(()9)9)A)ABIIK(()9)9)A)ABIIKD ^^MM!22((**]]LL	
 		
rD   r   in_tokenc                   U R                   (       dA  [        R                  S[        R                  " U=(       d    S5      R                  5       5        [        U SU R                  -  5      " UUS9nU R                   (       dA  [        R                  S[        R                  " U=(       d    S5      R                  5       5        U R                  (       Ga"  S U l	        S U l
        U R                  S:X  a  SOSnU R                  =(       d    Sn[        U R                  XPR                  5      U l        [        U R                  XT5      U l        U R                  [         R"                  -  (       aT  [%        ['        U R                  XPR                  5      5      U l        [%        ['        U R                  XT5      5      U l        U$ [%        ['        U R                  XPR                  5      5      =U l        U l        U$ )NzNTLM step input: %srD   z_step_%s)r   r   zNTLM step output: %sr   r   )_is_wrappedlogdebugrV   	b64encoderk   getattrr   r   r   r   r   r   _context_attrr   r   r$   r   r   r   r   r   )r   r   r   	out_tokenin_usager   s         rB   stepNTLMProxy.stepw  sy    II+V-=-=ho#-N-U-U-WXD*tzz"9:-
	
 II,f.>.>y?OC.P.W.W.YZ>>>#'D #'D #'::#;xH++2sK ")););[**!UD '(:(:K RD !!N$L$LL#*743E3E{T^T^+_#` ")'$2D2Dk*\"]  6=WTEWEWYdfpfp=q5rr 4?rD   c                   U R                   (       dF  [        U R                  [        R                  " 5       S9U l         U R                   R                  5       $ U=(       d    Sn[        R                  " U5      n[        R                  " [        U R                  5      nUR                  UR                  S.nUR                  [        R                   -  (       a%  [        R                  " 5       US'   [#        5       US'   U R%                  UUU=(       d    U R&                  S9u  pgnUR                  [        R(                  -  (       a  UR                  [        R*                  -  (       d"  UR                  [        R,                  -  (       a4  [.        R0                  " S5      U l        [5        XR2                  5      US'   OXl        S	US'   OXl        [7        UR                  Xv40 UD6n	U R8                  (       aH  U R;                  U R2                  U R                   R                  5       XR                  5       5      U	l        U	R                  U l        S
U l         U	R                  5       $ )N)versionrD   )domain_namerG   r   ry   r      encrypted_session_key    T)!r   r#   r   r'   get_currentpackr!   unpackrd   castr|   r   rF   rG   flagsr$   r   rz   _compute_responser   r   r)   r(   r;   urandomr   r   r   r   _calculate_micmicr   r   )
r   r   r   	challenger~   auth_kwargsnt_challengelm_challengekey_exchange_keyauthenticates
             rB   _step_initiateNTLMProxy._step_initiate  s    ##
 $-T->->H[H[H]#^D '',,..?s$$X.	 [[$2B2BC
%,,"++5

 ??^333%,%8%8%:K	")9);K&7;7M7M-F1F1F 8N 8
4$4 ??^444 !4!44	.J]J]8]$&JJrN!7;<LN_N_7`34 %5!7>34 !1#IOO\_S^_#22!!4#7#7#<#<#>J[J[J] L *//  ""rD   c                    U R                   (       d  U R                  U5      $ U R                  UU=(       d    U R                  S9  g )Nr   )r   _step_accept_negotiate_step_accept_authenticater   )r   r   r   s      rB   _step_acceptNTLMProxy._step_accept  sI     ##..x88 **!1!JT5J5J +  rD   tokenc                    [         R                  " U5      nUR                  [        R                  -  [        R
                  -  [        R                  -  [        R                  -  [        R                  -  nU[        R                  -  (       a  U[        R                  ) -  nO/U[        R                  -  S:X  a  [        [        R                  SS9eU[        R                  -  (       a  U[        R                  ) -  n[         R"                  " S5      n[%        [&        R(                  " 5       5      R+                  5       n[-        5       nXV[.        R0                  '   SU[.        R2                  '   [%        [&        R4                  " 5       5      U[.        R6                  '   [8        R:                  " 5       U[.        R<                  '   [?        X4XVS9nX l         Xpl!        URE                  5       $ )z1Process the Negotiate message from the initiator.r   zaNeither NEGOTIATE_OEM or NEGOTIATE_UNICODE flags were set, cannot derive encoding for text fieldsrI      WORKSTATION)target_nametarget_info)#r#   r   r   r$   r   r   r   r  target_type_serverr   r   r3   r.   rl   r   r   r;   r   r*   rw   rx   rX   r&   r    nb_computer_namenb_domain_namegetfqdndns_computer_namer"   now	timestampr!   r   r   r   )r   r  	negotiater   server_challenger  r  r  s           rB   r   NTLMProxy._step_accept_negotiate  s   $$U+	 OO++,!!" (() ((	)
 //0 	 >)))n((((E^'''1,!!>  >;;;n++++E::a=f002399; l-8D))*+8D''(.5fnn6F.GD**+&.llnDNN#e;h	((~~rD   c           	      $	   [         R                  " [        U R                  5      n[         R                  " [        U R
                  5      nUR                  n[        R                  " U5      nUR                  (       a2  UR                  (       d*  UR                  (       a  UR                  S:X  a	  [        SS9eUR                  nUR                  (       a  UR                   SU 3n[        [        US95      U l        SnUR                  (       GaJ  [#        UR                  5      S:  Ga0  [%        UR                  U R                   R&                  UR                  5      n	[(        R                  " UR                  SS 5      n
U
R*                  nU
R,                  nU
R.                  n[1        XXU5      u  pnU(       aZ  [2        R4                  U;  a	  [7        S	S9eU[2        R4                     n[9        UR;                  5       5      nUUS
4;  a	  [7        SS9eUR=                  [2        R>                  S5      [@        RB                  -  (       a  URB                  nOU RD                  (       d	  [G        SS9eUR                  (       d  U RH                  (       d	  [G        SS9eSnUR>                  [J        RL                  -  (       a  UR                  =(       d    SSS n[O        UR>                  U R                   R&                  U R                   RP                  UUU RH                  (       + S9u  pnSnUR                  (       a  UR                  U:H  nO UR                  (       a  UR                  U:H  nU(       d	  [G        SS9eUR>                  [J        RR                  -  (       ai  UR>                  [J        RT                  -  (       d"  UR>                  [J        RV                  -  (       a%  [Y        UURZ                  =(       d    S5      U l.        OUU l.        U(       a^  S
Ul!        U R_                  U R`                  UR;                  5       UR;                  5       UR;                  5       5      nUU:w  a	  [G        SS9eUR>                  U l1        SU l2        g)z4Process the Authenticate message from the initiator.r   z-Anonymous user authentication not implementedrI   r   )rG   N   r   zAAcceptor bindings specified but not present in initiator responser   z1Acceptor bindings do not match initiator bindingsr   z2Acceptor settings are set to reject NTv1 responsesz0Acceptor settings are set to reject LM responsess           r  no_lm_responseFz$Invalid NTLM response from initiatorrD   z*Invalid MIC in NTLM authentication messageT)3rd   r   r#   r   r!   r   r  r   r   	user_nament_challenge_responselm_challenge_responser2   r   r|   r   r   rU   r   rs   r%   
time_stampchallenge_from_clientav_pairsr   r    r   r,   r   r   r=   r   r   r  r   r/   r   r$   r   r   rr   r   r)   r(   r   encrypted_random_session_keyr   r  r   r   r   )r   r  r   r  r  r  authrG   expected_micrs   r  timeclient_challenger  expected_ntexpected_lmr  expected_bindingsactual_bindingsauth_success
actual_mics                        rB   r  #NTLMProxy._step_accept_authenticate  s   KK	4+?+?@	KK	4+?+?@	$55""5) ~~**D4N4NRVRlRlpwRw,9hii>>**+2hZ8H*?H+MN%%%#d.H.H*IB*Ndnnd.>.>.F.FHXHXYG.55d6P6PQSQT6UVL**D+AA&//K9L+;;:6K&6  ((;*$j  %00E0E$F!"%&6&;&;&=">$_l,KK*7jkktzz1-;#xx ;;'4hii//'4fgg*zzNDDD$($>$>$M+rPQ#R 9L

  ((  ((  #'88|:6K&6 %%55DL''55DL#0VWW::///JJ,,,

^=P=P0P $%5t7X7X7_\_ `D !1D#DH,,T-=-=y~~?OQZQ_Q_QacgclclcnoJ\)'4`aa!ZZrD   c                 H    U R                   (       d	  [        SS9e[        SS9$ )Nz;Cannot get message sizes until context has been establishedrI   r   )header)r   r1   r   r   s    rB   query_message_sizesNTLMProxy.query_message_sizesv  s     }} -jkk!,,rD   dataencryptqopc                    U(       a  [        SU-  S9eU R                  [        R                  -  S:X  a*  U R                  [        R                  -  S:X  a	  [        SS9eU R                  (       a  U R                  c	  [        SS9e[        U R                  U R                  U R                  U R                  U5      u  pE[        XT-   SS9$ )N+Unsupported QoP value %s specified for NTLMrI   r   .NTLM wrap without integrity or confidentiality.Cannot wrap until context has been establishedT)r:  	encrypted)r4   context_attrr   	integrityconfidentialityr2   r   r   r1   r(   r   _seq_num_outr   )r   r:  r;  r<  msg	signatures         rB   wrapNTLMProxy.wrap|  s     -Z]`-`aaz333q8T=N=NQ[QkQk=kop=p,9ijj4#5#5#= -]^^
 y$??rD   iovc           
         U(       a  [        SU-  S9eU R                  [        R                  -  S:X  a*  U R                  [        R                  -  S:X  a	  [        SS9eU R                  (       a  U R                  c	  [        SS9eSnSn/ nU R                  US 5      n/ n[        U5       GH  u  pU
R                  [        R                  :X  a  US:w  a	  [        SS9eU	nS	nGO(U
R                  [        R                  :X  a[  US:w  a	  [        S
S9e[!        U
R                  ["        5      (       d  [        SU	 S3S9eU	nU
R                  nUR%                  U5        OU
R                  [        R&                  [        R(                  4;   aa  [!        U
R                  ["        5      (       d$  [        SU
R                  R*                   SU	 S3S9eU
R                  nUR%                  U5        O [        SU
R                  R*                   3S9eUR%                  [-        U
R                  U5      5        GM     US:X  a	  [        SS9eUS:X  a	  [        SS9e[/        U R0                  U R                  U R                  U R2                  X   S   =(       d    S	S	R5                  U5      S9u  p[-        [        R                  U5      X'   [-        [        R                  U5      X'   [7        [9        U5      SS9$ )Nr>  rI   r   r?  r@  c                     U $ r   r   bs    rB   <lambda>$NTLMProxy.wrap_iov.<locals>.<lambda>      arD   z4wrap_iov must only be used with 1 header IOV buffer.rD   z2wrap_iov must only be used with 1 data IOV buffer.zwrap_iov IOV data buffer at [] must be byteszwrap_iov IOV  buffer at [z%wrap_iov unsupported IOV buffer type z%wrap_iov no IOV header buffer presentz#wrap_iov no IOV data buffer presentrP   )to_signT)rA  )r4   rB  r   rC  rD  r2   r   r   r1   _build_iov_list	enumeratetyper5   r7  r/   r:  r   rh   append	sign_onlydata_readonlynamer6   r(   r   rE  joinr   tuple)r   rJ  r;  r<  
header_idxdata_idxsignature_inputbuffersresidxbufferr:  enc_msgrG  s                 rB   wrap_iovNTLMProxy.wrap_iov  s     -Z]`-`aaz333q8T=N=NQ[QkQk=kop=p,9ijj4#5#5#= -]^^
&&sK8)+$W-KC{{j///#+8noo 

/r>+8lmm!&++u55+:WX[W\\k8lmm{{&&t,!5!5z7O7O PP!&++u55+&3FKK4D4D3E\RUQVVe$f  {{&&t, (6[\b\g\g\l\l[m4nooJJ|FKK67? .B #0WXXr>#0UVV!M!#HH_-
 'z'8'8)D$Z__g>U3Z488rD   c                 Z    U R                  U5      R                  n[        US S USS  SS9$ )Nr   r   )r7  r:  padding_length)rH  r:  r
   )r   r:  enc_datas      rB   
wrap_winrmNTLMProxy.wrap_winrm  s1    99T?''hsm(23-XYZZrD   c                     U R                   (       d	  [        SS9eUS S nU R                   R                  USS  5      nU R                  X25        [	        USSS9$ )N0Cannot unwrap until context has been establishedrI   r   Tr   )r:  rA  r<  )r   r1   updateverifyr	   )r   r:  rG  rF  s       rB   unwrapNTLMProxy.unwrap  sU     -_``"I	oo$$T"#Y/C#!<<rD   c                 N   U R                   [        R                  -  S:X  a*  U R                   [        R                  -  S:X  a	  [	        SS9eU R
                  (       a  U R                  c	  [        SS9eU R                  US 5      n[        U5      S:X  a  US   R                  [        R                  :X  a  US   R                  [        R                  :X  a  [        US   R                  [        5      (       a  U R!                  US   R                  5      n[#        [%        [        R                  US   R                  5      [%        [        R                  UR                  5      4UR&                  UR(                  S9$ S	nS	nS	n/ n/ n[+        U5       GHV  u  p[        U
R                  [        5      (       d$  [-        S
U
R                  R.                   SU	 S3S9eU
R                  nU
R                  [        R0                  :X  a  US	:w  a	  [-        SS9eU	nOU
R                  [        R                  :X  a.  US	:w  a	  [-        SS9eU	n[        U5      nUR3                  S5        O`U
R                  [        R4                  [        R6                  4;   a  UR3                  U5        O [-        SU
R                  R.                   3S9eUR3                  [%        U
R                  U5      5        GMY     US	:X  a	  [-        SS9eUS	:X  a	  [-        SS9eU R
                  R9                  X   R                  =(       d    S5      n[%        [        R                  U5      X'   XU'   U R;                  SR=                  U5      X   R                  =(       d    S5        [#        [?        U5      SSS9$ )Nr   z0NTLM unwrap without integrity or confidentialityrI   ro  c                     U $ r   r   rN  s    rB   rP  &NTLMProxy.unwrap_iov.<locals>.<lambda>  rR  rD   rQ   rP   )rA  r<  rL  zunwrap_iov IOV rT  rS  z6unwrap_iov must only be used with 1 header IOV buffer.z4unwrap_iov must only be used with 1 data IOV buffer.rD   z'unwrap_iov unsupported IOV buffer type z'unwrap_iov no IOV header buffer presentz%unwrap_iov no IOV data buffer presentT) rB  r   rC  rD  r2   r   r   r1   rV  rU   rX  r5   streamr:  r   rh   rr  r   r6   rA  r<  rW  r/   r\  r7  rY  rZ  r[  rp  rq  r]  r^  )r   rJ  rb  
unwrap_resr_  r`  data_sig_idxra  rc  rd  re  r:  decs                rB   
unwrap_iovNTLMProxy.unwrap_iov  s    z333q8T=N=NQ[QkQk=kop=p,9kll$"3"3"; -_``&&sK8 LA
:#4#44
:??271:??E22WQZ__5J" !2!2GAJOOD *//B %..NN  
.0)+$W-KC fkk511'"1&++2B2B1C<PSuTc d  ;;D{{j///#+8pqq 

/r>+8noo"?3&&s+!5!5z7O7O PP&&t, (6]^d^i^i^n^n]o4pqqJJ|FKK67= .@ #0YZZr>#0WXXoo$$S]%7%7%>3?$Z__c:(+%CHH_-s/C/C/JsKuSzTqAArD   r7  c                     U R                   (       d	  [        SS9eU R                   R                  U5      nU R                  X15        U$ )Nro  rI   )r   r1   rp  rq  )r   r7  r:  rF  s       rB   unwrap_winrmNTLMProxy.unwrap_winrm;  s:     -_``oo$$T*C 
rD   c                     U(       a  [        SU-  S9eU R                  (       a  U R                  c	  [        SS9e[	        U R
                  U R                  U R                  U R                  U5      $ )Nr>  rI   z.Cannot sign until context has been established)r4   r   r   r1   r)   r   rE  )r   r:  r<  s      rB   r)   NTLMProxy.signD  sk     -Z]`-`aa4#5#5#= -]^^
 	
rD   r  c                     U R                   (       a  U R                  c	  [        SS9e[        U R                  U R                   U R                  U R
                  U5      nX2:w  a	  [        SS9eg)Nz0Cannot verify until context has been establishedrI   z.Invalid Message integrity Check (MIC) detectedr   )r   r   r1   r)   r   _seq_num_inr-   )r   r:  r  expected_sigs       rB   rq  NTLMProxy.verifyS  sf    $"3"3"; -_``OO
 *Z[[rD   c                     [         R                  [        R                  4[         R                  [        R                  4[         R
                  [        R                  4[         R                  [        R                  4/$ r   )r   replay_detectr$   r)   sequence_detectrD  r(   rC  r   s    rB   _context_attr_mapNTLMProxy._context_attr_mapd  s^     %%~':':;'')<)<='')<)<=!!>#6#67	
 	
rD   c                 L    U R                   (       d  SU l        gU R                  $ )NTF)r   r   r   s    rB   _requires_mech_list_mic!NTLMProxy._requires_mech_list_micn  s"     ~~!%D!!!rD   c                     U R                   [        R                  -  (       a#  U R                  nU =R                  S-  sl        U$ U R                  nU =R                  S-  sl        U$ NrP   )r   r$   r   r   r   r   nums     rB   r  NTLMProxy._seq_num_inx  s\     H HH##C" 
 $$C!#
rD   c                 H    U R                   nU =R                   S-  sl         U$ r  )r   r  s     rB   rE  NTLMProxy._seq_num_out  s#      a
rD   r   r  r  r  c                 $    [        XU-   U-   5      $ )z4Calculates the MIC value for the negotiated context.)r   )r   r   r  r  r  s        rB   r  NTLMProxy._calculate_mic  s     %:\%IJJrD   r~   c           	         [         R                  " S5      nU R                  (       Ga  UR                  (       a  UR                  R	                  5       O	[        5       n[        R                  U;   a  U[        R                     nSU l        O[        R                  " 5       nU(       a*  [        UR                  5       5      U[        R                  '   U R                  =(       d    SU[        R                  '   U R                  (       aK  UR!                  [        R"                  [%        S5      5      [$        R&                  -  U[        R"                  '   [)        UR*                  =(       d    SUR,                  UR.                  5      n[1        XqR2                  XFU5      u  pn
U R                  (       a  Sn	XU
4$ [5        UR"                  UR,                  UR6                  UR2                  UU R8                  (       + S9$ )z9Compute the NT and LM responses and the key exchange key.r  TrK   r   s                           r"  )r;   r   r   r  copyr&   r    r  r   r"   r  r   r   r   spnr  r=   r   r   r  r   rG   rs   rF   r   r  r   rr   r   )r   r  r~   r   r.  r  r-  	ntv2_hashr  r  r  s              rB   r   NTLMProxy._compute_response  sz    ::a=;;;:C:O:O)//446U_UaK~~,"4>>2%)"  ||~  589I9N9N9P5QD112,0HHNK(()!!*5//$**gaj*QT[T_T_*_DJJ'
 3 3 9r:;M;MzO`O`aI;N557G{<8L(8 !!+/??? '""""** #'88| rD   outgoingc                 T    U(       a  SOSn[        U SU 35      R                  5         g )Noutin_handle_)r   reset)r   r  	directions      rB   _reset_ntlm_crypto_state"NTLMProxy._reset_ntlm_crypto_state  s%    %E4	,-335rD   )__seq_num_in__seq_num_outr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )r7   r   )TN)T)@r   r   r   r   __doc__r   defaultr0   nonerd   rg   Unionrc   r   Listr+   Anyr   classmethodr   boolr   propertyr   r   r   rh   r   r   r   r	  r  r  r  r   r8  r   r   rH  Iterabler   r   rg  r
   rl  r	   rr  r   r{  r~  r)   rq  rf   r  r  r  rE  r  r!   r|   r   r  r   __classcell__)r   s   @rB   r   r      s1    ]a)-)-(,@D","4"4$4$9$9R//&,,sJJ@W/W"XYR //#&R //#&	R
 %R !//*<=R  R R R "R **R 
R Rh &//:J*K W]WbWbcfWg   d   &//#"6   $   V__S%9   (U ( (
, ,0( AE	(//%(( !//*<=	(
 
	(X ,0;# AE	;#//%(;# !//*<=	;#
 
;#B AE	 !//*<=	
 
	 ( E ( e ( T\u \XjHk \pt \|-%7 -@ @ @6??3;O @[e @. $(	H9__S!H9 H9 __S!	H9
 
H9T[u [ [=5 =\ =QB__S!QB 
QBf5  % 
 
V__S%9 
U 
5 u  " 
6;;v||JO/L#M 
 
 " " " 	S 	 	 c  
KK K 	K
 K 
K.. $. !//*<=	.
 
eUE)	*.`6 6 6 6rD   r   )NN)NrV   loggingr;   rw   rd   spnego._contextr   r   r   r   r   r   r	   r
   r   r   spnego._credentialr   r   r   r   r   spnego._ntlm_raw.cryptor   r   r   r   r   r   r   r   r   r   r   r   spnego._ntlm_raw.messagesr   r   r    r!   r"   r#   r$   r%   r&   r'   spnego._ntlm_raw.securityr(   r)   spnego._textr*   spnego.channel_bindingsr+   spnego.exceptionsr,   r-   r.   r/   r0   r1   r2   r3   r4   
spnego.iovr5   r6   	getLoggerr   r   rg   rc   rC   rf   rh   rt   rz   r|   r   r   rD   rB   <module>r     s;     	           1   6
 
 
 0!fooc2 * $(%)[??3[OOC [ ooc"[ \\&//#&(<eUJK	[|9&//#. 9&t t>Y6 Y6rD   