U vf,@sdZddlmZddlmZddlmZddlmZGdddZ Gd d d e Z Gd d d e Z Gd dde Z Gddde Z Gddde ZedddgZGdddeZGdddeZGdddZdS)z Modern, adaptable authentication machinery. Replaces certain parts of `.SSHClient`. For a concrete implementation, see the ``OpenSSHAuthStrategy`` class in `Fabric `_. ) namedtuple)AgentKey) get_logger)AuthenticationExceptionc@s0eZdZdZddZddZddZdd Zd S) AuthSourcez Some SSH authentication source, such as a password, private key, or agent. See subclasses in this module for concrete implementations. All implementations must accept at least a ``username`` (``str``) kwarg. cCs ||_dSNusername)selfr r G/opt/alt/python38/lib/python3.8/site-packages/paramiko/auth_strategy.py__init__szAuthSource.__init__cKs0dd|D}d|}|jjd|dS)NcSsg|]\}}|d|qS)=r ).0kvr r r sz$AuthSource._repr..z, ())itemsjoin __class____name__)r kwargspairsZjoinedr r r _reprs zAuthSource._reprcCs|Sr)rr r r r __repr__"szAuthSource.__repr__cCstdS)z) Perform authentication. NNotImplementedErrorr transportr r r authenticate%szAuthSource.authenticateN)r __module__ __qualname____doc__rrrr#r r r r rs rc@seZdZdZddZdS)NoneAuthzS Auth type "none", ie https://www.rfc-editor.org/rfc/rfc4252#section-5.2 . cCs ||jSr)Z auth_noner r!r r r r#1szNoneAuth.authenticateNrr$r%r&r#r r r r r',sr'cs4eZdZdZfddZfddZddZZS)Passworda Password authentication. :param callable password_getter: A lazy callable that should return a `str` password value at authentication time, such as a `functools.partial` wrapping `getpass.getpass`, an API call to a secrets store, or similar. If you already know the password at instantiation time, you should simply use something like ``lambda: "my literal"`` (for a literal, but also, shame on you!) or ``lambda: variable_name`` (for something stored in a variable). cstj|d||_dSNr )superrpassword_getter)r r r,rr r rDszPassword.__init__cstj|jdS)N)user)r+rr rr-r r rHszPassword.__repr__cCs|}||j|Sr)r,Z auth_passwordr )r r"passwordr r r r#MszPassword.authenticate)rr$r%r&rrr# __classcell__r r r-r r)5s  r)c@seZdZdZddZdS) PrivateKeya Essentially a mixin for private keys. Knows how to auth, but leaves key material discovery/loading/decryption to subclasses. Subclasses **must** ensure that they've set ``self.pkey`` to a decrypted `.PKey` instance before calling ``super().authenticate``; typically either in their ``__init__``, or in an overridden ``authenticate`` prior to its `super` call. cCs||j|jSr)Zauth_publickeyr pkeyr!r r r r#eszPrivateKey.authenticateNr(r r r r r1Xs r1cs,eZdZdZfddZfddZZS)InMemoryPrivateKeyz1 An in-memory, decrypted `.PKey` object. cstj|d||_dSr*)r+rr2)r r r2r-r r rnszInMemoryPrivateKey.__init__cs(tj|jd}t|jtr$|d7}|S)N)r2z [agent])r+rr2 isinstancer)r repr-r r rss zInMemoryPrivateKey.__repr__rr$r%r&rrr0r r r-r r3is r3cs(eZdZdZfddZddZZS)OnDiskPrivateKeya Some on-disk private key that needs opening and possibly decrypting. :param str source: String tracking where this key's path was specified; should be one of ``"ssh-config"``, ``"python-config"``, or ``"implicit-home"``. :param Path path: The filesystem path this key was loaded from. :param PKey pkey: The `PKey` object this auth source uses/represents. cs>tj|d||_d}||kr.td|||_||_dS)Nr )z ssh-configz python-configz implicit-homez source argument must be one of: )r+rsource ValueErrorpathr2)r r r8r:r2allowedr-r r rszOnDiskPrivateKey.__init__cCs|j|j|jt|jdS)N)keyr8r:)rr2r8strr:rr r r rs zOnDiskPrivateKey.__repr__r6r r r-r r7|s r7 SourceResultr8resultcs(eZdZdZfddZddZZS) AuthResulta Represents a partial or complete SSH authentication attempt. This class conceptually extends `AuthStrategy` by pairing the former's authentication **sources** with the **results** of trying to authenticate with them. `AuthResult` is a (subclass of) `list` of `namedtuple`, which are of the form ``namedtuple('SourceResult', 'source', 'result')`` (where the ``source`` member is an `AuthSource` and the ``result`` member is either a return value from the relevant `.Transport` method, or an exception object). .. note:: Transport auth method results are always themselves a ``list`` of "next allowable authentication methods". In the simple case of "you just authenticated successfully", it's an empty list; if your auth was rejected but you're allowed to try again, it will be a list of string method names like ``pubkey`` or ``password``. The ``__str__`` of this class represents the empty-list scenario as the word ``success``, which should make reading the result of an authentication session more obvious to humans. Instances also have a `strategy` attribute referencing the `AuthStrategy` which was attempted. cs||_tj||dSr)strategyr+r)r rAargsrr-r r rszAuthResult.__init__cCsddd|DS)N css$|]}|jd|jpdVqdS)z -> successN)r8r?)rxr r r sz%AuthResult.__str__..)rrr r r __str__s zAuthResult.__str__)rr$r%r&rrGr0r r r-r r@s r@c@s eZdZdZddZddZdS) AuthFailurea Basic exception wrapping an `AuthResult` indicating overall auth failure. Note that `AuthFailure` descends from `AuthenticationException` but is generally "higher level"; the latter is now only raised by individual `AuthSource` attempts and should typically only be seen by users when encapsulated in this class. It subclasses `AuthenticationException` primarily for backwards compatibility reasons. cCs ||_dSrr?)r r?r r r rszAuthFailure.__init__cCsdt|jS)NrC)r=r?rr r r rGszAuthFailure.__str__N)rr$r%r&rrGr r r r rHs rHc@s(eZdZdZddZddZddZdS) AuthStrategya This class represents one or more attempts to auth with an SSH server. By default, subclasses must at least accept an ``ssh_config`` (`.SSHConfig`) keyword argument, but may opt to accept more as needed for their particular strategy. cCs||_tt|_dSr) ssh_configrrlog)r rKr r r rszAuthStrategy.__init__cCstdS)a[ Generator yielding `AuthSource` instances, in the order to try. This is the primary override point for subclasses: you figure out what sources you need, and ``yield`` them. Subclasses _of_ subclasses may find themselves wanting to do things like filtering or discarding around a call to `super`. Nrrr r r get_sourcess zAuthStrategy.get_sourcesc Csd}t|d}|D]}|jd|z||}d}WnFtk r}z(|}|jj}|jd|d|W5d}~XYnX| t |||rqq|st |d|S) z Handles attempting `AuthSource` instances yielded from `get_sources`. You *normally* won't need to override this, but it's an option for advanced users. F)rAzTrying TzAuthentication via z failed with NrI) r@rMrLdebugr# Exceptionrrinfoappendr>rH)r r"Z succeededZoverall_resultr8r?eZ source_classr r r r#s&    zAuthStrategy.authenticateN)rr$r%r&rrMr#r r r r rJs rJN)r& collectionsrZagentrutilrZ ssh_exceptionrrr'r)r1r3r7r>listr@rHrJr r r r s     #! .