
    i}M                    j   S SK Jr  S SKrS SKrS SKrS SKrS SKrS SK	J
r
JrJrJrJrJrJrJrJrJrJr  S SKJrJrJrJrJr  S SKJr  S SKJrJrJ r J!r!  S SKJ"r#  S SK$J%r%J&r&J'r'  \RP                  " \)5      r*\RV                  S	:X  a  S SK,r,S
r-OSr-SS jr.SS jr/          SS jr0 " S S\5      r1g)    )annotationsN)IOVContextProxy
ContextReqIOVUnwrapResultIOVWrapResultSecPkgContextSizesUnwrapResultWinRMWrapResult
WrapResultsplit_usernamewrap_system_error)
CredentialCredentialCacheKerberosKeytabPasswordunify_credentials)GssChannelBindings)InvalidCredentialErrorNegotiateOptionsNoContextErrorSpnegoError)WinError)
BufferType	IOVBufferIOVResBufferntTFc                 $    [         (       a  / SQ$ / $ )z4Return a list of protocols that SSPIProxy can offer.)kerberos	negotiatentlm)HAS_SSPI     F/home/james-whalen/.local/lib/python3.13/site-packages/spnego/_sspi.py_available_protocolsr&   4   s    x00	r$   c                   / nU  H  n[        UR                  5      nUR                  [        R                  R
                  R                  -  (       a  [        R                  nOFUR                  [        R                  R
                  R                  -  (       a  [        R                  n[        [        U5      UR                  S9nUR                  U5        M     [        U5      $ )z5Converts SSPI IOV buffer to generic IOVBuffer result.)typedata)intbuffer_typebuffer_flagssspilibrawSecBufferFlags SECBUFFER_READONLY_WITH_CHECKSUMr   	sign_onlySECBUFFER_READONLYdata_readonlyr   r)   appendtuple)iovbuffersir+   buffer_entrys        r%   _create_iov_resultr:   <   s    G!--(>>GKK66WWW$..K^^gkk88KKK$22K#K)@qvvN|$  >r$   c                D   UU US:X  a$  [         R                  R                  R                  O#[         R                  R                  R                  S.nU GH  n[        U[        5      (       ap  [        UR                  5      u  pg[         R                  R                  UUUR                  S9n[         R                  R                  " S0 UDSU0D6R                  s  $ [        U[        5      (       a,  [         R                  R                  " S0 UD6R                  s  $ [        U[        5      (       d  M  UR                  (       d	  [!        SS9e[        UR                  5      u  pg[#        UR$                  SS9 n	U	R'                  5       n
S	S	S	5        [         R                  R)                  [         R                  R*                  R,                  W
UUS
9n[         R                  R                  " S0 UDSU0D6R                  s  $    [!        SS9e! , (       d  f       N= f)a  Get the SSPI credential.

Will get an SSPI credential for the protocol specified. Currently only
supports Password or CredentialCache credential types.

Args:
    principal: The principal to use for the AcquireCredentialsHandle call
    protocol: The protocol of the credential.
    usage: Either `initiate` for a client context or `accept` for a server
        context.
    credentials: List of credentials to retrieve from.

Returns:
    sspilib.raw.CredHandle: The handle to the SSPI credential to use.
initiate)package	principalcredential_use)usernamedomainpassword	auth_dataz6KerberosKeytab for SSPI requires a principal to be setcontext_msgrb)modeN)credential_type
credentialr@   rA   z#No applicable credentials availabler#   )r-   r.   CredentialUseSECPKG_CRED_OUTBOUNDSECPKG_CRED_INBOUND
isinstancer   r   r@   WinNTAuthIdentityrB   acquire_credentials_handlerI   r   r   r>   r   openkeytabread!WinNTAuthIdentityPackedCredentialWinNTAuthCredentialTypeSEC_WINNT_AUTH_DATA_TYPE_KEYTAB)r>   protocolusagecredentialscredential_kwargscredrA   r@   	pass_datakt_filerQ   kt_datas               r%   _get_sspi_credentialr^   L   s   ,  
" KK%%::**>>+ dH%%-dmm<F55! 6 I ;;99c<McYbcnnno..;;99N<MNYYYn-->>,9qrr-dnn=Fdkk-  . kkCC ' C C c c!!	 D G ;;99a<MaY`alll; > !-R
SS .-s   ;H
H	c            	        ^  \ rS rSrSrSSSSS\R                  SS\R                  4	                     S#U 4S jjjr	\
 S$   S%S jj5       r\S&S j5       r\S'S	 j5       r\S&S
 j5       r\\" \S5      S(S j5       5       rS)S jr\" \S5       S$SS.     S*S jjj5       rS+S jr  S,       S-S jjr\" \S5        S,       S.S jj5       rS/S jrS0S jr\" \S5          S1S j5       rS2S jr\" \S5       S$     S3S jj5       r\" \S5      S4S j5       r\S5S j5       r\S6S j5       rS7S  jr     S8S! jr!S"r"U =r#$ )9	SSPIProxy   a  SSPI proxy class for pure SSPI on Windows.

This proxy class for SSPI exposes this library into a common interface for SPNEGO authentication. This context
uses compiled C code to interface directly into the SSPI functions on Windows to provide a native SPNEGO
implementation.
Nr<   r    c
           
       > [         (       d  [        S5      e[        X5      n[        [        U ]  XXEXgX5        U   U(       a  U R                  U5      U l        OS U l        SU l        SU l	        SU l
        SU l        S U l        SU l        U
R                  SS 5      nU(       d!   US:X  a  U R                  OS n[!        XX{5      nXl        g ! ["         a  n[%        USS9UeS nAff = f)Nz:SSPIProxy requires the Windows only sspilib python packager   F_sspi_credentialacceptzGetting SSPI credential)
base_errorrE   )r"   ImportErrorr   superr`   __init___get_native_bindings_native_channel_bindings_block_size_max_signature_security_trailer	_complete_context_SSPIProxy__seq_numgetspnr^   NativeErrorr   _credential)selfr@   rB   hostnameservicechannel_bindingscontext_reqrW   rV   optionskwargsrX   sspi_credentialr>   win_err	__class__s                  r%   rh   SSPIProxy.__init__   s     xZ[[';i'7kRZ	
 	,0,E,EFV,WD),0D)!"7; **%7>j(-(9DHHt	"6yE"_ +  j!WB[\biijs   $ C 
C%C  C%c                    [        5       $ N)r&   )clsrz   s     r%   available_protocolsSSPIProxy.available_protocols   s    
 $%%r$   c                   U R                   S:X  a{  [        R                  R                  [        R
                  " [        R                  R                  U R                  5      [        R                  R                  5      nUR                  $ g )Nrd   )
rW   r-   r.   query_context_attributestcast
CtxtHandlero   SecPkgContextNamesr@   )ru   namess     r%   client_principalSSPIProxy.client_principal   sZ    ::!KK88w{{--t}}=..E >>!r$   c                    U R                   $ r   )rn   ru   s    r%   completeSSPIProxy.complete   s    ~~r$   c                   [         R                  R                  [        R                  " [         R                  R
                  U R                  5      [         R                  R                  5      nUR                  R                  5       $ r   )
r-   r.   r   r   r   r   ro   SecPkgContextPackageInfonamelower)ru   package_infos     r%   negotiated_protocolSSPIProxy.negotiated_protocol   sX     {{;;FF7;;))4==9KK00
   &&((r$   zRetrieving session keyc                    [         R                  R                  [        R                  " [         R                  R
                  U R                  5      [         R                  R                  5      nUR                  $ r   )	r-   r.   r   r   r   r   ro   SecPkgContextSessionKeysession_key)ru   r   s     r%   r   SSPIProxy.session_key   sO     kk::FF7;;))4==9KK//
 &&&r$   c                    [        U R                  U R                  U R                  U R                  U R
                  U R                  U R                  U R                  S9$ )N)rv   rw   rx   ry   rW   rV   rz   rc   )	r`   	_hostname_servicerx   ry   rW   rV   rz   rt   r   s    r%   new_contextSSPIProxy.new_context   sM    ^^MM!22((**]]LL!--	
 		
r$   zProcessing security token)rx   c          
     $   U R                   (       dA  [        R                  S[        R                  " U=(       d    S5      R                  5       5        / nU(       a\  [        U5      nUR                  [        R                  R                  U[        R                  R                  R                  5      5        U(       a  U R                  U5      nOU R                  nU(       a  UR                  UR                  5       5        S nU(       a  [        R                  R!                  U5      n[        R                  R!                  [        R                  R                  S [        R                  R                  R                  5      /5      nU R"                  S:X  a  U R$                  [        R&                  R(                  -  n[        R                  R+                  U R,                  U R.                  U R0                  =(       d    SU[        R                  R2                  R4                  UUS9nUR6                  n	UR8                  U l        OU R$                  [        R:                  R<                  -  n[        R                  R?                  U R,                  U R.                  UU[        R                  R2                  R4                  US9nUR6                  n	UR8                  U l        US   R@                  =(       d    S n
[C        URD                  5      U l#        U	[        R                  RH                  RJ                  :X  a|  SU l&        [        R                  RO                  U R.                  [        R                  RP                  5      nURR                  U l*        URV                  U l,        URZ                  U l.        U R                   (       dA  [        R                  S	[        R                  " U
=(       d    S5      R                  5       5        U
$ )
NzSSPI step input: %sr$   r<    )rI   contexttarget_namery   target_data_repinput_buffersoutput_buffers)rI   r   r   ry   r   r   r   TzSSPI step output: %s)/_is_wrappedlogdebugbase64	b64encodedecode	bytearrayr4   r-   r.   	SecBufferSecBufferTypeSECBUFFER_TOKENri   rj   dangerous_get_sec_bufferSecBufferDescrW   _context_reqIscReqISC_REQ_ALLOCATE_MEMORYinitialize_security_contextrt   ro   rr   TargetDataRepSECURITY_NATIVE_DREPstatusr   AscReqASC_REQ_ALLOCATE_MEMORYaccept_security_contextr)   r*   
attributes_context_attrNtStatusSEC_E_OKrn   r   r	   
block_sizerk   max_signaturerl   security_trailerrm   )ru   in_tokenrx   
sec_tokensnative_channel_bindings	in_buffer
out_bufferry   resr   	out_token
attr_sizess               r%   stepSSPIProxy.step   s    II+V-=-=ho#-N-U-U-WX24
 *Hgkk33Hgkk>W>W>g>ghi &*&?&?@P&Q#&*&C&C#"5NNPQ6:	11*=I[[..%%dGKK,E,E,U,UV

 ::#++gnn.T.TTK++99++ HHN' ' 9 9 N N') : C ZZFKKDM++gnn.T.TTK++55++'' ' 9 9 N N) 6 C ZZFKKDMqM&&.$	 0W[[))222!DN ==dmmW[[MkMklJ)44D",":":D%/%@%@D"II,f.>.>y?OC.P.W.W.YZr$   c                \    U R                   (       d	  [        SS9e[        U R                   S9$ )Nz;Cannot get message sizes until context has been establishedrD   )header)rm   r   r	   r   s    r%   query_message_sizesSSPIProxy.query_message_sizesG  s(    %% -jkk!)?)?@@r$   c                   U R                  [        R                  U[        R                  /X#S9n[	        SR                  UR                   Vs/ s H!  oUR                  (       d  M  UR                  PM#     sn5      UR                  S9$ s  snf )N)encryptqopr$   )r)   	encrypted)	wrap_iovr   r   paddingr   joinr7   r)   r   )ru   r)   r   r   r   rs         r%   wrapSSPIProxy.wrapM  sg     mmZ..j6H6HISZmdsxx(OA(OP\_\i\ijj(Os   B
&B
zWrapping IOV bufferc                L   U=(       d    SnU(       a7  U[         R                  R                  R                  -  (       a  [	        S5      eU(       d'  U[         R                  R                  R                  -  nU R                  XR                  5      n[         R                  R                  U5      n[         R                  R                  [        R                  " [         R                  R                  U R                  5      UUU R                  S9  [        [        U5      US9$ )Nr   z;Cannot set qop with SECQOP_WRAP_NO_ENCRYPT and encrypt=True)r   messageseq_no)r7   r   )r-   r.   QopFlagsSECQOP_WRAP_NO_ENCRYPT
ValueError_build_iov_list_convert_iov_bufferr   encrypt_messager   r   r   ro   _seq_numr   r:   )ru   r6   r   r   r7   
iov_buffers         r%   r   SSPIProxy.wrap_iovV  s     hQsW[[11HHHZ[[7;;''>>>C&&s,D,DE[[..w7
##FF7;;))4==9==	 	$ 	
 %7
%CwWWr$   c                    U R                  [        R                  U/5      R                  nUS   R                  =(       d    SnUS   R                  =(       d    Sn[        X4SS9$ )Nr   r$      )r   r)   padding_length)r   r   r   r7   r)   r   )ru   r)   r6   r   enc_datas        r%   
wrap_winrmSSPIProxy.wrap_winrmo  sR    mmZ..56>>Q#q6;;%#fANNr$   c                    U R                  [        R                  U4[        R                  /5      nUR                  S   R                  =(       d    Sn[        X2R                  UR                  S9$ )Nr   r$   )r)   r   r   )
unwrap_iovr   streamr)   r7   r
   r   r   )ru   r)   r   dec_datas       r%   unwrapSSPIProxy.unwrapv  sQ    oo
 1 148*//JK;;q>&&-#]]PPr$   zUnwrapping IOV bufferc                   U R                  XR                  5      n[        R                  R	                  U5      n[        R                  R                  [        R                  " [        R                  R                  U R                  5      UU R                  S9nU[        R                  R                  R                  -  S:H  n[        [        U5      XTS9$ )N)r   r   )r7   r   r   )r   r   r-   r.   r   decrypt_messager   r   r   ro   r   r   r   r   r:   )ru   r6   r7   r   r   r   s         r%   r   SSPIProxy.unwrap_iov|  s    
 &&s,D,DE[[..w7
kk))FF7;;))4==9== * 

 '++..EEEJ	'9*'EQZddr$   c                    U R                  [        R                  U4U/5      R                  nUS   R                  =(       d    S$ )Nr   r$   )r   r   r   r7   r)   )ru   r   r)   r6   s       r%   unwrap_winrmSSPIProxy.unwrap_winrm  s9    oo
 1 16:DABJJ1v{{!c!r$   zSigning messagec                z   [        U5      n[        U R                  5      n[        R                  R	                  [        R                  R                  U[        R                  R                  R                  5      [        R                  R                  U[        R                  R                  R                  5      /5      n[        R                  R                  [        R                  " [        R                  R                  U R                  5      U=(       d    SUU R                  5        US   R                  $ )Nr   r   )r   rl   r-   r.   r   r   r   SECBUFFER_DATAr   make_signaturer   r   r   ro   r   r)   )ru   r)   r   	signaturer6   s        r%   signSSPIProxy.sign  s     d112	kk''%%dGKK,E,E,T,TU%%i1J1J1Z1Z[
 	""FF7;;))4==9H1MM		
 1v{{r$   zVerifying messagec                4   [        U5      n[        U5      n[        R                  R                  [        R                  R	                  U[        R                  R
                  R                  5      [        R                  R	                  U[        R                  R
                  R                  5      /5      n[        R                  R                  [        R                  " [        R                  R                  U R                  5      UU R                  5      $ r   )r   r-   r.   r   r   r   r   r   verify_signaturer   r   r   ro   r   )ru   r)   micr6   s       r%   verifySSPIProxy.verify  s    nkk''%%dGKK,E,E,T,TU%%c7;;+D+D+T+TU
 {{++FF7;;))4==9MM
 	
r$   c                f   / nU R                   S:X  a4  UR                  [        R                  S45        [        R
                  nSnO[        R                  nSnUR                  [        R                  S4[        R                  S4[        R                  S4[        R                  S4[        R                  S4[        R                  S	4[        R                  S
4[        R                  S4[        R                   S4/	5        / nU H&  u  pVUR                  U[#        X# SU 35      45        M(     U$ )Nr<   REQ_NO_INTEGRITYISCASCREQ_DELEGATEREQ_MUTUAL_AUTHREQ_REPLAY_DETECTREQ_SEQUENCE_DETECTREQ_CONFIDENTIALITYREQ_INTEGRITYREQ_USE_DCE_STYLEREQ_IDENTIFY_)rW   r4   r   no_integrityr-   r   r   extenddelegatedelegate_policymutual_authreplay_detectsequence_detectconfidentiality	integrity	dce_styleidentifygetattr)ru   attr_mapsspi_reqsspi_prefixattrsspnego_flaggssapi_names          r%   _context_attr_mapSSPIProxy._context_attr_map  s     ::#OOZ446HIJ~~HK~~HK $$n5++^<''):;))+>?++-BC++-BC%%7%%':;$$n5	
 (0$KLL+wx=+9W'XYZ )1 r$   c                H    U R                   nU =R                   S-  sl         U$ )Nr   )rp   )ru   nums     r%   r   SSPIProxy._seq_num  s    nn!
r$   c                   [        5       n[        UR                  [        5      (       a  [        UR                  5      nGO4[        UR                  [        5      (       a5  [        UR                  [
        5      (       d  [        UR                  5      nO[        R                  U R                  [        R                  U R                  [        R                  U R                  0nUR                  nUc  UR                  U;   nU(       ak  UR                  U;  aD  [        S[        UR                  5      R                  < SUR                  R                  < 35      e[        X1R                     5      n[	        UR                  5      nSnU[        R                   :X  aI  ["        R$                  R&                  R(                  n["        R$                  R*                  R,                  nO\U[        R.                  :X  aH  ["        R$                  R&                  R(                  n["        R$                  R*                  R0                  n["        R$                  R3                  X%U5      $ )Nz$Cannot auto allocate buffer of type .r   )r   rM   r)   bytesr*   boolr   r   rm   r   rk   trailerr(   r   __name__r   r1   r-   r.   r   r   r/   r0   r3   r2   r   )ru   bufferr)   auto_alloc_sizeallocr+   r,   s          r%   r   SSPIProxy._convert_iov_buffer  s   {fkk5))V[[)DS))*V[[$2O2OV[[)D !!4#9#9""D$4$4""D$:$:O KKE}6;;o5$GKFKKGXGaGacicncncscst  !!=> &++&*...!++33BBK";;55VVLJ444!++33BBK";;55HHL{{$$TEEr$   c                    [         R                  " [        UR                  5      UR                  [        UR
                  5      UR                  UR                  S9$ )z>Gets the raw byte value of the SEC_CHANNEL_BINDINGS structure.)initiator_addr_typeinitiator_addracceptor_addr_typeacceptor_addrapplication_data)r-   SecChannelBindingsr*   initiator_addrtypeinitiator_addressacceptor_addrtypeacceptor_addressr:  )ru   rx   s     r%   ri   SSPIProxy._get_native_bindings
  sP    
 )) #$4$G$G H+=="#3#E#EF*;;->>
 	
r$   )		__seq_numrk   rn   ro   r   rt   rl   rj   rm   )r@   z*str | Credential | list[Credential] | NonerB   
str | Nonerv   rB  rw   rB  rx   GssChannelBindings | Nonery   r   rW   strrV   rD  rz   r   r{   zt.AnyreturnNoner   )rz   zNegotiateOptions | NonerE  	list[str])rE  rB  )rE  r.  )rE  r-  )rE  r`   )r   bytes | Nonerx   rC  rE  rH  )rE  r	   )TN)r)   r-  r   r.  r   
int | NonerE  r   )r6   collections.abc.Iterable[IOV]r   r.  r   rI  rE  r   )r)   r-  rE  r   )r)   r-  rE  r
   )r6   rJ  rE  r   )r   r-  r)   r-  rE  r-  )r)   r-  r   rI  rE  r-  )r)   r-  r  r-  rE  r*   )rE  zlist[tuple[ContextReq, int]])rE  r*   )r1  r   rE  zsspilib.raw.SecBuffer)rx   r   rE  zsspilib.SecChannelBindings)$r0  
__module____qualname____firstlineno____doc__r   defaultr   nonerh   classmethodr   propertyr   r   r   r   rs   r   r   r   r   r   r   r   r   r   r   r   r  r&  r   r   ri   __static_attributes____classcell__)r~   s   @r%   r`   r`      s    @D##"6:","4"4#$4$9$9,+<,+ ,+ 	,+
 ,+ 4,+  ,+ ,+ ,+ ",+ ,+ 
,+ ,+\  ,0&(& 
& &     ) ) {$<=' > '

 {$?@ "&L 7;	LL 4	L
 
L AL\A 	kk k 	k
 
k {$9: 	X*X X 	X
 
X ;X0OQ {$;<e*e 
e =e " {$56   
	 7, {$78
 9
     D  
&FP
,
 
$
 
r$   r`   )rE  rG  )r6   zsspilib.raw.SecBufferDescrE  ztuple[IOVResBuffer, ...])
r>   rB  rV   rD  rW   rD  rX   zlist[Credential]rE  zsspilib.raw.CredHandle)2
__future__r   r   collections.abccollectionsloggingostypingr   spnego._contextr   r   r   r   r   r	   r
   r   r   r   r   spnego._credentialr   r   r   r   r   spnego.channel_bindingsr   spnego.exceptionsr   r   r   r   r   rs   
spnego.iovr   r   r   	getLoggerr0  r   r   r-   r"   r&   r:   r^   r`   r#   r$   r%   <module>ra     s    #    	      7  6 : :!77d?HH >T>T>T >T "	>T
 >TBH
 H
r$   