
    iK                        S SK r S SKrS SKrS SKJrJrJrJrJrJ	r	J
r
JrJrJrJrJrJrJrJrJrJrJr  S SKJr  S SKJr  S SKJr  S\R8                  \\R<                  \   \R>                  \S4   \R@                  \   4   S\!4S	 jr"   SS
\!S\RF                  \   S\$S\RF                  \   S\RJ                  4
S jjr& " S S\ RN                  5      r( " S S\ RR                  5      r* " S S5      r+ " S S5      r, " S S5      r-g)    N)TagClassTypeTagNumberget_sequence_value	pack_asn1pack_asn1_bit_stringpack_asn1_enumeratedpack_asn1_general_stringpack_asn1_object_identifierpack_asn1_octet_stringpack_asn1_sequenceunpack_asn1unpack_asn1_bit_stringunpack_asn1_enumeratedunpack_asn1_general_stringunpack_asn1_object_identifierunpack_asn1_octet_stringunpack_asn1_sequenceunpack_asn1_tagged_sequence)GSSMech)KerberosV5Msg)NTLMMessage	mech_list.returnc                     [        U [        [        [        45      (       d  U /n [	        U  Vs/ s H  n[        U5      PM     sn5      $ s  snf )a  Packs a list of OIDs for the mechListMIC value.

Will pack a list of object identifiers to the raw byte string value for the mechListMIC.

Args:
    mech_list: The list of OIDs to back

Returns:
    bytes: The byte string of the packed ASN.1 MechTypeList SEQUENCE OF value.
)
isinstancelisttuplesetr   r
   )r   oids     H/home/james-whalen/.local/lib/python3.13/site-packages/spnego/_spnego.pypack_mech_type_listr!   !   sB     i$s!344K	9U9C:3?9UVVUs   A	b_datamechunwrapencodingc                    U R                  S5      (       a  U(       a  [        R                  " XS9$ U $ U(       a#  UR                  (       a  [	        U SS 5      S   nO[	        U 5      S   nUR
                  [        R                  :X  aD  U(       a=  UR                  (       a,  [        R                  " [	        UR                  5      S   5      $ UR
                  [        R                  :X  a  UR                  S:w  a  [        SUR                  -  5      e[        R                  UR                  5      nU(       a  U$  [        R                  " UR                  5      nU(       a@  U[        R                   :X  d  UR                  (       a  U(       a  [#        UR$                  US9$ U $ UR
                  [        R&                  :X  av  UR                  S:X  a  [(        R                  UR                  5      $ UR                  S:X  a  [*        R                  UR                  5      $ [        S	UR                  -  5      eU(       a  [        R                  " U5      $ U $ ! [         a    Sn GNf = f)
aU  Unpacks a raw GSSAPI/SPNEGO token to a Python object.

Unpacks the byte string into a Python object that represents the token passed in. This can return many different
token types such as:

* NTLM message(s)
* SPNEGO/Negotiate init or response
* Kerberos message(s)

Args:
    b_data: The raw byte string to unpack.
    mech: A hint as to what the byte string is for.
    unwrap: Whether to unwrap raw bytes to a structured message or return the raw tokens bytes.
    encoding: Optional encoding used when unwrapping NTLM messages.

Returns:
    any: The unpacked SPNEGO, Kerberos, or NTLM token.
s   NTLMSSP )r%      Nr   z:Expecting a tag number of 0 not %s for InitialContextTokenr#      z9Unknown NegotiationToken CHOICE %d, only expecting 0 or 1)
startswithr   unpackis_kerberos_oidr   	tag_classr   applicationr   r"   
tag_number
ValueErrorInitialContextTokenr   from_oid	this_mechspnegounpack_tokeninner_context_tokencontext_specificNegTokenInitNegTokenResp)r"   r#   r$   r%   raw_datainitial_context_tokenr3   s          r    r5   r5   4   s   2 ((%%f@@ M$$vabz*1- v&q)X111dt?S?S##K$@$CDD			x33	3!#Y\d\o\oopp 3 : :8?? K ((	(()>)H)HII
 )w~~5):S:SX^ 5 I IPYZZ			x88	8!#&&x77  A%&&x77 X[c[n[nnoo	##H-- 3  	I	s   = I I)(I)c                   f    \ rS rSrSrSrSrSrSrSr	Sr
\S	\R                  S \4   4S
 j5       rSrg)ContextFlags   r   r)   r'               r   c                     [         R                  S[         R                  S[         R                  S[         R                  S[         R
                  S[         R                  S[         R                  S0$ )N	delegFlag
mutualFlag
replayFlagsequenceFlaganonFlagconfFlag	integFlag)r=   delegmutualreplaysequenceanonconfintegclss    r    native_labelsContextFlags.native_labels   s[     !!>zz
 	
     N)__name__
__module____qualname____firstlineno__rK   rL   rM   rN   rO   rP   rQ   classmethodtypingDictstrrT   __static_attributes__rW   rV   r    r=   r=      sL    EFFHDDE	
fkk.#*=> 	
 	
rV   r=   c                   Z    \ rS rSrSrSrSrSr\S\	R                  S \4   4S j5       rSrg	)
NegState   r   r)   r'   r?   r   c                     [         R                  S[         R                  S[         R                  S[         R                  S0$ )Nzaccept-completezaccept-incompleterejectzrequest-mic)rb   accept_completeaccept_incompletere   request_micrR   s    r    rT   NegState.native_labels   s:     $$&7&&(;OOX  -	
 	
rV   rW   N)rX   rY   rZ   r[   rf   rg   re   rh   r\   r]   r^   r_   rT   r`   rW   rV   r    rb   rb      s=    OFK
fkk*c/: 
 
rV   rb   c                       \ rS rSrSrS\R                  \\4   S\	SS4S jr
\S\R                  4S j5       rS\	4S	 jr\S
\	SS 4S j5       rSrg)r1      a  GSSAPI InitialContextToken object.

The InitialContextToken is the ASN.1 structure that contains the first GSSAPI token that is sent across the wire.
The ASN.1 definition for this structure is defined in `RFC 2743 3.1`_::

    MechType ::= OBJECT IDENTIFIER
    -- data structure definitions
    -- callers must be able to distinguish among
    -- InitialContextToken, SubsequentContextToken,
    -- PerMsgToken, and SealedMessage data elements
    -- based on the usage in which they occur

    InitialContextToken ::=
    -- option indication (delegation, etc.) indicated within
    -- mechanism-specific token
    [APPLICATION 0] IMPLICIT SEQUENCE {
        thisMech MechType,
        innerContextToken ANY DEFINED BY thisMech
           -- contents mechanism-specific
           -- ASN.1 structure not required
        }

Args:
    mech: The OID that defines the structure of the `token`.
    token: The token of the GSSAPI value.

Attributes:
    this_mech (str): The object identifier that identifies what the inner_context_token is for.
    inner_context_token (bytes): The token value as defined by `this_mech`.

.. _RFC 2743 3.1:
    https://www.rfc-editor.org/rfc/rfc2743#section-3.1.
r#   tokenr   Nc                 ^    [        U[        5      (       a  UR                  nXl        X l        g N)r   r   valuer3   r6   )selfr#   rl   s      r    __init__InitialContextToken.__init__   s#    dG$$::D#( rV   c                      [         R                  " U R                  5      n[	        U R
                  US9$ ! [         a    S n N"f = f)Nr(   )r   r2   r3   r0   r5   r6   )rp   r#   s     r    rl   InitialContextToken.token   sF    	##DNN3D D444@@  	D	s    6 AAc           
      x    [        [        R                  SS[        U R                  SS9U R
                  -   5      $ )z/Packs the InitialContextToken as a byte string.Tr   )tag)r   r   r.   r
   r3   r6   )rp   s    r    packInitialContextToken.pack   s7      'DADD\D\\	
 	
rV   r"   c                 H    [        U 5      u  p[        U5      n[        X25      $ )z*Unpacks the InitialContextToken TLV value.)r   r   r1   )r"   r3   r6   r#   s       r    r+   InitialContextToken.unpack   s&     *5V)<&	,Y7"4==rV   )r6   r3   )rX   rY   rZ   r[   __doc__r]   Unionr   r_   bytesrq   propertyAnyrl   rw   staticmethodr+   r`   rW   rV   r    r1   r1      s     D)V\\'3,7 ) )$ ) Avzz A A
e 
 >u >!6 > >rV   r1   c                   .   \ rS rSrSr      SS\R                  \R                  \      S\R                  \	   S\R                  \
   S\R                  \
   S\R                  \
   S	\R                  \
   S
S4S jjrS
\
4S jr\S\
S
S 4S j5       rSrg)r8      a	  The NegTokenInit GSSAPI value.

This is the initial negotiation message token in a GSSAPI exchange. Typically the `NegTokenInit` value is sent
when sending the first authentication token. The `NegTokenInit2` token is an extension that adds the `negHints`
field. Unfortunately as the tag number for the `mechListMIC` is the same for `negHints` unpacking the value
requires some extra checks.

The ASN.1 definition for the NegTokenInit structure is defined in `RFC 4178 4.2.1`_::

    NegTokenInit ::= SEQUENCE {
        mechTypes       [0] MechTypeList,
        reqFlags        [1] ContextFlags  OPTIONAL,
        -- inherited from RFC 2478 for backward compatibility,
        -- RECOMMENDED to be left out
        mechToken       [2] OCTET STRING  OPTIONAL,
        mechListMIC     [3] OCTET STRING  OPTIONAL,
        ...
    }
    ContextFlags ::= BIT STRING {
        delegFlag       (0),
        mutualFlag      (1),
        replayFlag      (2),
        sequenceFlag    (3),
        anonFlag        (4),
        confFlag        (5),
        integFlag       (6)
    } (SIZE (32))

The ASN.1 definition for the `NegTokenInit2`_ structure is defined as::

    NegHints ::= SEQUENCE {
        hintName[0] GeneralString OPTIONAL,
        hintAddress[1] OCTET STRING OPTIONAL
    }
    NegTokenInit2 ::= SEQUENCE {
        mechTypes[0] MechTypeList OPTIONAL,
        reqFlags [1] ContextFlags OPTIONAL,
        mechToken [2] OCTET STRING OPTIONAL,
        negHints [3] NegHints OPTIONAL,
        mechListMIC [4] OCTET STRING OPTIONAL,
        ...
    }

Args:
    mech_types: One or more security mechanisms available for the initiator, in decreasing preference order.
    req_flags: Should be omitted, service options that are requested to establish the context.
    mech_token: Contains the optimistic mechanism token.
    hint_name: Used for the NegTokenInit2 structure only, should be omitted.
    hint_address: Used for the NegTokenINit2 structure only, should be omitted.
    mech_list_mic: The message integrity code (MIC) token.

Attributes:
    mech_types (List[str]): See args.
    req_flags (ContextFlags): See args.
    mech_token (bytes): See args.
    hint_name (bytes): See args.
    hint_address (bytes): See args.
    mech_list_mic (bytes): See args.

.. _RFC 4178 4.2.1:
    https://www.rfc-editor.org/rfc/rfc4178.html#section-4.2.1

.. _NegTokenInit2:
    https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-spng/8e71cf53-e867-4b79-b5b5-38c92be3d472
N
mech_types	req_flags
mech_token	hint_namehint_addressmech_list_micr   c                 `    U=(       d    / U l         X l        X0l        X@l        XPl        X`l        g rn   )r   r   r   r   r   r   )rp   r   r   r   r   r   r   s          r    rq   NegTokenInit.__init__9  s+     %*"$"(*rV   c           	      b   S[         R                  [         R                  [        [         R                  [         R
                  4      S[         R                  [           4S jnU R                  b!  [        R                  " SU R                  5      OSnSU R                  [        4SU[        4SU R                  [        4/nU" SU R                   ["        4SU R$                  [        4/5      nU(       a;  UR'                  S	U[(        45        UR'                  S
U R*                  [        45        O"UR'                  S	U R*                  [        45        U" U5      n[)        U5      n[-        [.        R0                  R2                  [5        [6        R8                  SSU5      5      R                  5       $ )z(Packs the NegTokenInit as a byte string.	value_mapr   c                     / nU  H;  u  p#nUc  M  UR                  [        [        R                  SX$" U5      5      5        M=     U$ )NT)appendr   r   r7   )r   elementsrv   ro   	pack_funcs        r    pack_elements(NegTokenInit.pack.<locals>.pack_elementsL  sI     H)2%I$OOIh.G.GsT]^cTd$ef *3 OrV   NBr   r)   r'   r?   r@   T)r]   IterableTupleintr   CallableListr}   r   structrw   r   r!   r   r   r   r   r	   r   r   r   r   r1   r   r4   ro   r   r   r7   )rp   r   r   base_map	neg_hintsinit_sequencer"   s          r    rw   NegTokenInit.packI  s^   	v||CV__4T'UV	[[	 9=8RFKKT^^4X\	!45	/0!78Q
 "DNN$<=D%%'=>
	 OOQ	+=>?OOQ 2 24JKL OOQ 2 24JKL%h/ $M2"7>>#7#78C\C\^bdegm9nottvvrV   r"   c                    [        [        U 5      S   5      n[        USSS[        5      =(       d    /  Vs/ s H  n[	        U5      PM     nn[        USSS[
        5      nU(       a  [        [        U5      S   5      n[        USSS[        5      nS	=n=pxS
U;   a  US
   R                  n	US
   R                  n
U	[        R                  :X  aS  U
[        R                  :X  a?  [        US
   R                  5      n[        USSS[         5      n[        USSS[        5      nO[        US
SS[        5      nU(       d  [        USSS[        5      n[#        X4XVXx5      $ s  snf )z#Unpacks the NegTokenInit TLV value.r   r8   	mechTypesr)   reqFlagsr'   	mechTokenNr?   NegHintshintNamehintAddressmechListMICr@   NegTokenInit2)r   r   r   r   r   r   r=   	bytearrayr   r-   r/   r   	universalr   rN   r"   r   r8   )r"   neg_seqmr   r   r   r   r   r   r-   r/   r   s               r    r+   NegTokenInit.unpacks  sb    .k&.A!.DE (NKQefljll
l *!,l 	 

 'w>:Oef	 %Yy%9"%=>I'NKQij
377	7L<  
,,I ..JH...:AWAW3W7
8I8IJ	
 /y!ZUop	1)Q
M[st !37A~}^v w.w?M[stMJ:,ffM
s   E)r   r   r   r   r   r   )NNNNNN)rX   rY   rZ   r[   r{   r]   Optionalr   r_   r=   r}   rq   rw   r   r+   r`   rW   rV   r    r8   r8      s    @H 9=37-1,0/304+OOFKK$45+ ??<0+ OOE*	+
 ??5)+ ooe,+ u-+ 
+ (we (wT *gu *g *g *grV   r8   c                       \ rS rSrSr    SS\R                  \   S\R                  \   S\R                  \	   S\R                  \	   SS4
S	 jjr
S\	4S
 jr\S\	SS 4S j5       rSrg)r9   i  aI  The NegTokenResp GSSAPI value.

This is the message token in a GSSAPI exchange that is used for subsequent messages after the `NegTokenInit` has
been exchanged.

The ASN.1 definition for the NegTokenResp structure is defined in `RFC 4178 4.2.2`_::

    NegTokenResp ::= SEQUENCE {
        negState       [0] ENUMERATED {
            accept-completed    (0),
            accept-incomplete   (1),
            reject              (2),
            request-mic         (3)
        }                                 OPTIONAL,
        -- REQUIRED in the first reply from the target
        supportedMech   [1] MechType      OPTIONAL,
        -- present only in the first reply from the target
        responseToken   [2] OCTET STRING  OPTIONAL,
        mechListMIC     [3] OCTET STRING  OPTIONAL,
        ...
    }

Args:
    neg_state: The state of the negotiation.
    supported_mech: Should only be present in the first reply, must be one of the mech(s) offered by the initiator.
    response_token: Contains the token specific to the mechanism selected.
    mech_list_mic: The message integrity code (MIC) token.

Attributes:
    neg_state (NegState): See args.
    supported_mech (str): See args.
    response_token (bytes): See args.
    mech_list_mic (bytes): See args.

.. _RFC 4178 4.2.2:
    https://www.rfc-editor.org/rfc/rfc4178.html#section-4.2.2
N	neg_statesupported_mechresponse_tokenr   r   c                 4    Xl         X l        X0l        X@l        g rn   )r   r   r   r   )rp   r   r   r   r   s        r    rq   NegTokenResp.__init__  s     #,,*rV   c                 j   SU R                   [        4SU R                  [        4SU R                  [
        4SU R                  [
        4/n/ nU H;  u  p4nUc  M  UR                  [        [        R                  SX5" U5      5      5        M=     [        U5      n[        [        R                  SSU5      $ )z(Packs the NegTokenResp as a byte string.r   r)   r'   r?   T)r   r   r   r
   r   r   r   r   r   r   r7   r   )rp   r   r   rv   ro   r   r"   s          r    rw   NegTokenResp.pack  s      45##%@A##%;<""$:;	g
	 %.!C	 	(*C*CT3PYZ_P` ab &/
 $H-22D!VDDrV   r"   c                     [        [        U 5      S   5      n[        USSS[        5      nUb  [	        U5      n[        USSS[
        5      n[        USSS[        5      n[        USSS	[        5      n[        X#XE5      $ )
z#Unpacks the NegTokenResp TLV value.r   r9   negStater)   supportedMechr'   responseTokenr?   r   )r   r   r   r   rb   r   r   r9   )r"   r   r   r   r   r   s         r    r+   NegTokenResp.unpack  s     .k&.A!.DE&w>:Oef	  +I+GQYvw+GQYqr*7A~}VnoI~UUrV   )r   r   r   r   )NNNN)rX   rY   rZ   r[   r{   r]   r   rb   r_   r}   rq   rw   r   r+   r`   rW   rV   r    r9   r9     s    $P 04/31504
+??8,
+ ,
+ .	
+
 u-
+ 

+Ee E" Vu V V VrV   r9   )NFN).enumr   r]   spnego._asn1r   r   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   spnego._contextr   spnego._kerberosr   spnego._ntlm_raw.messagesr   r|   r_   r   r   Setr}   r!   r   boolr   r5   IntFlagr=   IntEnumrb   r1   r8   r9   rW   rV   r    <module>r      s"         ( $ * 1W||CS!16<<S3I6::VY?Z[W
W* &*%)	QQ
//'
"Q Q ooc"	Q
 ZZQj
4<< 
.
t|| 
 C> C>Lhg hgVQV QVrV   