🔐 Sid Gifari File Manager Pro
v8.0.5 | 2026-08-08 06:21:01 | PHP 8.2.32
📂
/ (Root)
/
opt
/
alt
/
python38
/
lib
/
python3.8
/
site-packages
/
paramiko
/
__pycache__
📍 /opt/alt/python38/lib/python3.8/site-packages/paramiko/__pycache__
🔄 Refresh
✏️
Editing: ssh_gss.cpython-38.pyc
Read Only
U v��f�p � @ sJ d Z ddlZddlZddlZdZdZdZzDddlZeed�rTej dkrTdZej fZndZej j ej jjfZW n^ eefk r� z(ddlZddlZddlZd ZejfZW n ek r� d ZdZY nX Y nX dd lmZ dd lmZ dd lmZ ddd�Z G dd� d�Z G dd� de �Z edk �r&e Z G dd� de �Z G dd� de �Z!dS )z� This module provides GSS-API / SSPI authentication as defined in :rfc:`4462`. .. note:: Credential delegation is not supported in server mode. .. seealso:: :doc:`/api/kex_gss` .. versionadded:: 1.15 � NT� � __title__z python-gssapi�MIT�PYTHON-GSSAPI-NEW�SSPIF)�MSG_USERAUTH_REQUEST)� SSHException)�__version_info__c C sL t dkrt| |�S t dkr$t| |�S t dkr@tjdkr@t| |�S td��dS )a� Provide SSH2 GSS-API / SSPI authentication. :param str auth_method: The name of the SSH authentication mechanism (gssapi-with-mic or gss-keyex) :param bool gss_deleg_creds: Delegate client credentials or not. We delegate credentials by default. :return: Either an `._SSH_GSSAPI_OLD` or `._SSH_GSSAPI_NEW` (Unix) object or an `_SSH_SSPI` (Windows) object :rtype: object :raises: ``ImportError`` -- If no GSS-API / SSPI module could be imported. :see: `RFC 4462 <http://www.ietf.org/rfc/rfc4462.txt>`_ :note: Check for the available API and return either an `._SSH_GSSAPI_OLD` (MIT GSSAPI using python-gssapi package) object, an `._SSH_GSSAPI_NEW` (MIT GSSAPI using gssapi package) object or an `._SSH_SSPI` (MS SSPI) object. If there is no supported API available, ``None`` will be returned. r r r �ntz)Unable to import a GSS-API / SSPI module!N)�_API�_SSH_GSSAPI_OLD�_SSH_GSSAPI_NEW�os�name� _SSH_SSPI� ImportError)� auth_method�gss_deleg_credsr r �A/opt/alt/python38/lib/python3.8/site-packages/paramiko/ssh_gss.py�GSSAuthN s r c @ sJ e Zd ZdZdd� Zdd� Zdd� Zdd d �Zd d � Zd d� Z dd� Z dS )� _SSH_GSSAuthzs Contains the shared variables and methods of `._SSH_GSSAPI_OLD`, `._SSH_GSSAPI_NEW` and `._SSH_SSPI`. c C sL || _ || _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ dS )�� :param str auth_method: The name of the SSH authentication mechanism (gssapi-with-mic or gss-keyex) :param bool gss_deleg_creds: Delegate client credentials or not Nzssh-connectionz1.2.840.113554.1.2.2F) � _auth_method�_gss_deleg_creds� _gss_host� _username� _session_id�_service� _krb5_mech� _gss_ctxt�_gss_ctxt_status� _gss_srv_ctxt�_gss_srv_ctxt_statusZcc_file��selfr r r r r �__init__t s z_SSH_GSSAuth.__init__c C s |� d�r|| _dS )z� This is just a setter to use a non default service. I added this method, because RFC 4462 doesn't specify "ssh-connection" as the only service value. :param str service: The desired SSH service zssh-N)�findr )r$ �servicer r r � set_service� s z_SSH_GSSAuth.set_servicec C s || _ dS )z� Setter for C{username}. If GSS-API Key Exchange is performed, the username is not set by C{ssh_init_sec_context}. :param str username: The name of the user who attempts to login N)r )r$ �usernamer r r � set_username� s z_SSH_GSSAuth.set_username�clientc C s\ ddl m} ddlm} | �d�}|�|| j��}| �t|��}|dkrP|| S || | S )a� This method returns a single OID, because we only support the Kerberos V5 mechanism. :param str mode: Client for client mode and server for server mode :return: A byte sequence containing the number of supported OIDs, the length of the OID and the actual OID encoded with DER :note: In server mode we just return the OID length and the DER encoded OID. r )�ObjectIdentifier)�encoder� �server)Zpyasn1.type.univr, �pyasn1.codec.derr- � _make_uint32�encoder �len)r$ �moder, r- ZOIDsZkrb5_OIDZOID_lenr r r � ssh_gss_oids� s z_SSH_GSSAuth.ssh_gss_oidsc C s0 ddl m} |�|�\}}|�� | jkr,dS dS )z� Check if the given OID is the Kerberos V5 OID (server mode). :param str desired_mech: The desired GSS-API mechanism of the client :return: ``True`` if the given OID is supported, otherwise C{False} r ��decoderFT)r0 r7 �decode�__str__r )r$ � desired_mechr7 �mech�__r r r �ssh_check_mech� s z_SSH_GSSAuth.ssh_check_mechc C s t �d|�S )z� Create a 32 bit unsigned integer (The byte sequence of an integer). :param int integer: The integer value to convert :return: The byte sequence of an 32 bit integer z!I)�struct�pack)r$ �integerr r r r1 � s z_SSH_GSSAuth._make_uint32c C s� | � t|��}||7 }|t�dt�7 }|| � t|��7 }||�� 7 }|| � t|��7 }||�� 7 }|| � t|��7 }||�� 7 }|S )a� Create the SSH2 MIC filed for gssapi-with-mic. :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :param str service: The requested SSH service :param str auth_method: The requested SSH authentication mechanism :return: The MIC as defined in RFC 4462. The contents of the MIC field are: string session_identifier, byte SSH_MSG_USERAUTH_REQUEST, string user-name, string service (ssh-connection), string authentication-method (gssapi-with-mic or gssapi-keyex) �B)r1 r3 r> r? r r2 )r$ � session_idr) r' r Zmicr r r �_ssh_build_mic� s z_SSH_GSSAuth._ssh_build_micN)r+ ) �__name__� __module__� __qualname__�__doc__r% r( r* r5 r= r1 rC r r r r r n s r c @ sT e Zd ZdZdd� Zddd�Zddd �Zdd d �Zdd d �Ze dd� �Z dd� Z dS )r z� Implementation of the GSS-API MIT Kerberos Authentication for SSH2, using the older (unmaintained) python-gssapi package. :see: `.GSSAuth` c C sB t �| ||� | jr,tjtjtjtjf| _ntjtjtjf| _dS �r N) r r% r �gssapiZC_PROT_READY_FLAGZ C_INTEG_FLAGZ C_MUTUAL_FLAGZ C_DELEG_FLAG� _gss_flagsr# r r r r% � s ��z_SSH_GSSAPI_OLD.__init__Nc C s ddl m} || _|| _t�d| j tj�}t�� }| j|_ |dkrTtj � | j �}n4|� |�\} } | �� | j krztd��ntj � | j �}d} z:|dkr�tj|||j d�| _| j�| �} n | j�|�} W n6 tjk r� d�t�� d | j�} t�| ��Y nX | jj| _| S ) a� Initialize a GSS-API context. :param str username: The name of the user who attempts to login :param str target: The hostname of the target to connect to :param str desired_mech: The negotiated GSS-API mechanism ("pseudo negotiated" mechanism, because we support just the krb5 mechanism :-)) :param str recv_token: The GSS-API token received from the Server :raises: `.SSHException` -- Is raised if the desired mechanism of the client is not supported :return: A ``String`` if the GSS-API has returned a token or ``None`` if no token was returned r r6 �host@N�Unsupported mechanism OID.)Z peer_nameZ mech_typeZ req_flagsz {} Target: {}r. )r0 r7 r r rI �NameZC_NT_HOSTBASED_SERVICE�ContextrJ �flagsZOIDZmech_from_stringr r8 r9 r Z InitContextr �step� GSSException�format�sys�exc_info� establishedr ) r$ �targetr: r) � recv_tokenr7 � targ_name�ctx� krb5_mechr; r< �token�messager r r �ssh_init_sec_context s< � � z$_SSH_GSSAPI_OLD.ssh_init_sec_contextFc C sB || _ |s0| �| j | j| j| j�}| j�|�}n| j�| j �}|S )a� Create the MIC token for a SSH2 message. :param str session_id: The SSH session ID :param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not :return: gssapi-with-mic: Returns the MIC token from GSS-API for the message we created with ``_ssh_build_mic``. gssapi-keyex: Returns the MIC token from GSS-API with the SSH session ID as message. )r rC r r r r Zget_micr! �r$ rB Zgss_kex� mic_field� mic_tokenr r r � ssh_get_micA s �z_SSH_GSSAPI_OLD.ssh_get_micc C s: || _ || _| jdkr t�� | _| j�|�}| jj| _|S )� Accept a GSS-API context (server mode). :param str hostname: The servers hostname :param str username: The name of the user who attempts to login :param str recv_token: The GSS-API Token received from the server, if it's not the initial call. :return: A ``String`` if the GSS-API has returned a token or ``None`` if no token was returned N)r r r! rI Z AcceptContextrP rU r" �r$ �hostnamerW r) r[ r r r �ssh_accept_sec_context\ s z&_SSH_GSSAPI_OLD.ssh_accept_sec_contextc C sR || _ || _| jdk r>| �| j | j| j| j�}| j�||� n| j�| j |� dS )at Verify the MIC token for a SSH2 message. :param str mic_token: The MIC token received from the client :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :return: None if the MIC check was successful :raises: ``gssapi.GSSException`` -- if the MIC check failed N)r r rC r r r! Z verify_micr �r$ r` rB r) r_ r r r � ssh_check_micp s �z _SSH_GSSAPI_OLD.ssh_check_micc C s | j jdk rdS dS )�� Checks if credentials are delegated (server mode). :return: ``True`` if credentials are delegated, otherwise ``False`` NTF)r! Zdelegated_cred�r$ r r r �credentials_delegated� s z%_SSH_GSSAPI_OLD.credentials_delegatedc C s t �dS )a~ Save the Client token in a file. This is used by the SSH server to store the client credentials if credentials are delegated (server mode). :param str client_token: The GSS-API token received form the client :raises: ``NotImplementedError`` -- Credential delegation is currently not supported in server mode N��NotImplementedError�r$ Z client_tokenr r r �save_client_creds� s z!_SSH_GSSAPI_OLD.save_client_creds)NNN)F)N)N� rD rE rF rG r% r] ra re rg �propertyrj rn r r r r r � s � 4 r )� � c @ sT e Zd ZdZdd� Zddd�Zddd �Zdd d �Zdd d �Ze dd� �Z dd� Z dS )r z� Implementation of the GSS-API MIT Kerberos Authentication for SSH2, using the newer, currently maintained gssapi package. :see: `.GSSAuth` c C sP t �| ||� | jr4tjjtjjtjjtjjf| _ ntjjtjjtjjf| _ dS rH ) r r% r rI ZRequirementFlagZprotection_readyZ integrityZmutual_authenticationZdelegate_to_peerrJ r# r r r r% � s ��z_SSH_GSSAPI_NEW.__init__Nc C s� ddl m} || _|| _tjd| j tjjd�}|dk r\|�|�\}}|� � | j kr\t d��tj j } d} |dkr�tj|| j| dd�| _| j�| �} n | j�|�} | jj| _| S ) ae Initialize a GSS-API context. :param str username: The name of the user who attempts to login :param str target: The hostname of the target to connect to :param str desired_mech: The negotiated GSS-API mechanism ("pseudo negotiated" mechanism, because we support just the krb5 mechanism :-)) :param str recv_token: The GSS-API token received from the Server :raises: `.SSHException` -- Is raised if the desired mechanism of the client is not supported :raises: ``gssapi.exceptions.GSSError`` if there is an error signaled by the GSS-API implementation :return: A ``String`` if the GSS-API has returned a token or ``None`` if no token was returned r r6 rK )Z name_typeNrL Zinitiate)r rO r; �usage)r0 r7 r r rI rM ZNameTypeZhostbased_servicer8 r9 r r ZMechTypeZkerberos�SecurityContextrJ r rP �completer ) r$ rV r: r) rW r7 rX r; r< rZ r[ r r r r] � s0 �� z$_SSH_GSSAPI_NEW.ssh_init_sec_contextFc C sB || _ |s0| �| j | j| j| j�}| j�|�}n| j�| j �}|S )a� Create the MIC token for a SSH2 message. :param str session_id: The SSH session ID :param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not :return: gssapi-with-mic: Returns the MIC token from GSS-API for the message we created with ``_ssh_build_mic``. gssapi-keyex: Returns the MIC token from GSS-API with the SSH session ID as message. :rtype: str )r rC r r r r Z get_signaturer! r^ r r r ra � s �z_SSH_GSSAPI_NEW.ssh_get_micc C s> || _ || _| jdkr$tjdd�| _| j�|�}| jj| _|S )rb N�accept)rs )r r r! rI rt rP ru r" rc r r r re s z&_SSH_GSSAPI_NEW.ssh_accept_sec_contextc C sR || _ || _| jdk r>| �| j | j| j| j�}| j�||� n| j�| j |� dS )a{ Verify the MIC token for a SSH2 message. :param str mic_token: The MIC token received from the client :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :return: None if the MIC check was successful :raises: ``gssapi.exceptions.GSSError`` -- if the MIC check failed N)r r rC r r r! Zverify_signaturer rf r r r rg $ s �z _SSH_GSSAPI_NEW.ssh_check_micc C s | j jdk rdS dS )z� Checks if credentials are delegated (server mode). :return: ``True`` if credentials are delegated, otherwise ``False`` :rtype: bool NTF)r! Zdelegated_credsri r r r rj > s z%_SSH_GSSAPI_NEW.credentials_delegatedc C s t �dS )aw Save the Client token in a file. This is used by the SSH server to store the client credentials if credentials are delegated (server mode). :param str client_token: The GSS-API token received form the client :raises: ``NotImplementedError`` -- Credential delegation is currently not supported in server mode Nrk rm r r r rn J s z!_SSH_GSSAPI_NEW.save_client_creds)NNN)F)N)Nro r r r r r � s � . r c @ sR e Zd ZdZdd� Zddd�Zddd �Zd d � Zdd d �Ze dd� �Z dd� Z dS )r zf Implementation of the Microsoft SSPI Kerberos Authentication for SSH2. :see: `.GSSAuth` c C s< t �| ||� | jr*tjtjB tjB | _ntjtjB | _dS rH )r r% r �sspiconZISC_REQ_INTEGRITYZISC_REQ_MUTUAL_AUTH�ISC_REQ_DELEGATErJ r# r r r r% ^ s ��� �z_SSH_SSPI.__init__Nc C s� ddl m} || _|| _d}d| j }|dk rR|�|�\}} |�� | jkrRtd��z:|dkrptj d| j |d�| _ | j � |�\}} | d j } W n< tjk r� } z | jd�| j�7 _� W 5 d} ~ X Y nX |dkr�d | _d} | S ) a� Initialize a SSPI context. :param str username: The name of the user who attempts to login :param str target: The FQDN of the target to connect to :param str desired_mech: The negotiated SSPI mechanism ("pseudo negotiated" mechanism, because we support just the krb5 mechanism :-)) :param recv_token: The SSPI token received from the Server :raises: `.SSHException` -- Is raised if the desired mechanism of the client is not supported :return: A ``String`` if the SSPI has returned a token or ``None`` if no token was returned r r6 �host/NrL �Kerberos)ZscflagsZ targetspnz , Target: {}T)r0 r7 r r r8 r9 r r �sspiZ ClientAuthrJ r � authorize�Buffer� pywintypes�error�strerrorrR r ) r$ rV r: r) rW r7 r rX r; r< r[ �er r r r] q s2 �z _SSH_SSPI.ssh_init_sec_contextFc C sB || _ |s0| �| j | j| j| j�}| j�|�}n| j�| j �}|S )a� Create the MIC token for a SSH2 message. :param str session_id: The SSH session ID :param bool gss_kex: Generate the MIC for Key Exchange with SSPI or not :return: gssapi-with-mic: Returns the MIC token from SSPI for the message we created with ``_ssh_build_mic``. gssapi-keyex: Returns the MIC token from SSPI with the SSH session ID as message. )r rC r r r r �signr! r^ r r r ra � s �z_SSH_SSPI.ssh_get_micc C sV || _ || _d| j }tjd|d�| _| j�|�\}}|d j}|dkrRd| _d}|S )a� Accept a SSPI context (server mode). :param str hostname: The servers FQDN :param str username: The name of the user who attempts to login :param str recv_token: The SSPI Token received from the server, if it's not the initial call. :return: A ``String`` if the SSPI has returned a token or ``None`` if no token was returned ry rz )Zspnr TN)r r r{ Z ServerAuthr! r| r} r" )r$ rd r) rW rX r r[ r r r re � s z _SSH_SSPI.ssh_accept_sec_contextc C sP || _ || _|dk r<| �| j | j| j| j�}| j�||� n| j�| j |� dS )ak Verify the MIC token for a SSH2 message. :param str mic_token: The MIC token received from the client :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :return: None if the MIC check was successful :raises: ``sspi.error`` -- if the MIC check failed N)r r rC r r r! �verifyr rf r r r rg � s �z_SSH_SSPI.ssh_check_micc C s | j tj@ o| jp| j S )rh )rJ rw rx r" ri r r r rj � s �z _SSH_SSPI.credentials_delegatedc C s t �dS )a{ Save the Client token in a file. This is used by the SSH server to store the client credentails if credentials are delegated (server mode). :param str client_token: The SSPI token received form the client :raises: ``NotImplementedError`` -- Credential delegation is currently not supported in server mode Nrk rm r r r rn � s z_SSH_SSPI.save_client_creds)NNN)F)Nro r r r r r W s � 4 r )T)"rG r> r rS ZGSS_AUTH_AVAILABLEZGSS_EXCEPTIONSr rI �hasattrr rQ � exceptionsZ GeneralError�raw�miscZGSSErrorr �OSErrorr~ rw r{ r Zparamiko.commonr Zparamiko.ssh_exceptionr Zparamiko._versionr r r r Z _SSH_GSSAPIr r r r r r �<module> sL � 5 0
💾 Save Changes
❌ Cancel