U
vù¾fþ§ ã @ s8 d Z ddlZddlZddlZddlZddlmZmZmZm Z m
Z
m Z m Z m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( ddl)m*Z* ddl+m,Z,m-Z- ddl.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4 ddl5m6Z6m7Z7 G d d
„ d
ƒZ8G d d „ d ƒZ9G d
d„ de8ƒZ:dS )z
`.AuthHandler`
é N)#ÚcMSG_SERVICE_REQUESTÚcMSG_DISCONNECTÚ DISCONNECT_SERVICE_NOT_AVAILABLEÚ)DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLEÚcMSG_USERAUTH_REQUESTÚcMSG_SERVICE_ACCEPTÚDEBUGÚAUTH_SUCCESSFULÚINFOÚcMSG_USERAUTH_SUCCESSÚcMSG_USERAUTH_FAILUREÚAUTH_PARTIALLY_SUCCESSFULÚcMSG_USERAUTH_INFO_REQUESTÚWARNINGÚ AUTH_FAILEDÚcMSG_USERAUTH_PK_OKÚcMSG_USERAUTH_INFO_RESPONSEÚMSG_SERVICE_REQUESTÚMSG_SERVICE_ACCEPTÚMSG_USERAUTH_REQUESTÚMSG_USERAUTH_SUCCESSÚMSG_USERAUTH_FAILUREÚMSG_USERAUTH_BANNERÚMSG_USERAUTH_INFO_REQUESTÚMSG_USERAUTH_INFO_RESPONSEÚ cMSG_USERAUTH_GSSAPI_RESPONSEÚcMSG_USERAUTH_GSSAPI_TOKENÚcMSG_USERAUTH_GSSAPI_MICÚ MSG_USERAUTH_GSSAPI_RESPONSEÚMSG_USERAUTH_GSSAPI_TOKENÚMSG_USERAUTH_GSSAPI_ERRORÚMSG_USERAUTH_GSSAPI_ERRTOKÚMSG_USERAUTH_GSSAPI_MICÚ MSG_NAMESÚcMSG_USERAUTH_BANNER)ÚMessage)ÚbÚu)Ú SSHExceptionÚAuthenticationExceptionÚBadAuthenticationTypeÚPartialAuthentication)ÚInteractiveQuery)ÚGSSAuthÚGSS_EXCEPTIONSc @ s. e Zd ZdZdd„ Zdd„ Zdd„ Zdd „ Zd
d „ Zd d
„ Z dd„ Z
dHdd„Z dd„ Z dd„ Z
dd„ Zdd„ Zdd „ Zd d „ Zd d „ Zd!d"„ Zd#d$„ Zd%d&„ Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Zd/d0„ Zd1d2„ Zd3d4„ Z d5d6„ Z d7d8„ Z d9d:„ Z d;d<„ Z d=d>„ Z!d?d@„ Z"e#dAdB„ ƒZ$e#dCdD„ ƒZ%e#dEdF„ ƒZ&dGS )IÚ AuthHandlerzC
Internal class to handle the mechanics of authentication.
c C s^ t |¡| _d | _d| _d | _d| _d | _d | _d | _ d | _
d | _ d | _ d| _
d | _d| _d S )NFÚ r T)ÚweakrefÚproxyÚ transportÚusernameÚ
authenticatedÚ
auth_eventÚ auth_methodÚbannerÚpasswordÚ private_keyÚinteractive_handlerÚ
submethodsÚ
auth_usernameÚauth_fail_countÚgss_hostÚgss_deleg_creds)Úselfr3 © rB úF/opt/alt/python38/lib/python3.8/site-packages/paramiko/auth_handler.pyÚ__init__R s zAuthHandler.__init__c G s | j j|Ž S ©N)r3 Ú_log)rA ÚargsrB rB rC rF d s zAuthHandler._logc C s | j S rE )r5 ©rA rB rB rC Úis_authenticatedg s z AuthHandler.is_authenticatedc C s | j jr| jS | jS d S rE )r3 Ú server_moder= r4 rH rB rB rC Ú get_usernamej s zAuthHandler.get_usernamec C s> | j j ¡ z || _d| _|| _| ¡ W 5 | j j ¡ X d S ©NÚnone©r3 ÚlockÚacquireÚreleaser6 r7 r4 Ú
_request_auth©rA r4 ÚeventrB rB rC Ú auth_nonep s zAuthHandler.auth_nonec C sD | j j ¡ z$|| _d| _|| _|| _| ¡ W 5 | j j ¡ X d S )NÚ publickey) r3 rO rP rQ r6 r7 r4 r: rR )rA r4 ÚkeyrT rB rB rC Úauth_publickeyz s zAuthHandler.auth_publickeyc C sD | j j ¡ z$|| _d| _|| _|| _| ¡ W 5 | j j ¡ X d S )Nr9 ) r3 rO rP rQ r6 r7 r4 r9 rR )rA r4 r9 rT rB rB rC Ú
auth_password… s zAuthHandler.auth_passwordr0 c C sJ | j j ¡ z*|| _d| _|| _|| _|| _| ¡ W 5 | j j ¡ X dS )úK
response_list = handler(title, instructions, prompt_list)
úkeyboard-interactiveN)
r3 rO rP rQ r6 r7 r4 r; r< rR )rA r4 ÚhandlerrT r< rB rB rC Úauth_interactive s z AuthHandler.auth_interactivec C sJ | j j ¡ z*|| _d| _|| _|| _|| _| ¡ W 5 | j j ¡ X d S )Núgssapi-with-mic)
r3 rO rP rQ r6 r7 r4 r? r@ rR )rA r4 r? r@ rT rB rB rC Úauth_gssapi_with_micŸ s z AuthHandler.auth_gssapi_with_micc C s> | j j ¡ z || _d| _|| _| ¡ W 5 | j j ¡ X d S )Nú gssapi-keyexrN rS rB rB rC Úauth_gssapi_keyex« s z AuthHandler.auth_gssapi_keyexc C s | j d k r| j ¡ d S rE )r6 ÚsetrH rB rB rC Úabortµ s
zAuthHandler.abortc C s* t ƒ }| t¡ | d¡ | j |¡ d S ©Nú ssh-userauth)r% Úadd_byter Ú
add_stringr3 Ú
_send_message©rA ÚmrB rB rC rR » s
zAuthHandler._request_authc C sH t ƒ }| t¡ | t¡ | d¡ | d¡ | j |¡ | j ¡ d S )NzService not availableÚen) r% rf r Úadd_intr rg r3 rh Úcloseri rB rB rC Ú!_disconnect_service_not_availableÁ s
z-AuthHandler._disconnect_service_not_availablec C sH t ƒ }| t¡ | t¡ | d¡ | d¡ | j |¡ | j ¡ d S )Nz No more auth methods availablerk ) r% rf r rl r rg r3 rh rm ri rB rB rC Ú_disconnect_no_more_authÊ s
z$AuthHandler._disconnect_no_more_authc C s& |j r|j j|j jfS | ¡ |fS dS )z
Given any key, return its type/algorithm & bits-to-sign.
Intended for input to or verification of, key signatures.
N)Z public_blobÚkey_typeZkey_blobÚget_name)rA rW rB rB rC Ú_get_key_type_and_bitsÓ s z"AuthHandler._get_key_type_and_bitsc C sp t ƒ }| | jj¡ | t¡ | |¡ | |¡ | d¡ | d¡ | |¡\}}| |¡ | |¡ | ¡ S )NrV T) r% rg r3 Ú
session_idrf r Ú add_booleanrr Zasbytes)rA rW Úservicer4 Ú algorithmrj Ú_ÚbitsrB rB rC Ú_get_session_blobß s
z AuthHandler._get_session_blobc C s d }| j jd k r t ¡ | j j }| d¡ | j ¡ s^| j ¡ }|d ksRt|jtƒrZt dƒ}|‚|
¡ rhq†|d k r |t ¡ kr t dƒ‚q | ¡ s¾| j ¡ }|d kr¨t dƒ}t|jt ƒrº|j
S |‚g S )Ngš™™™™™¹?z5Authentication failed: transport shut down or saw EOFzAuthentication timeout.zAuthentication failed.)r3 Z auth_timeoutÚtimeÚwaitÚ is_activeZ
get_exceptionÚ
issubclassÚ __class__ÚEOFErrorr) Úis_setrI r+ Z
allowed_types)rA rT Zmax_tsÚerB rB rC Úwait_for_responseì s.
ÿ
z AuthHandler.wait_for_responsec C s’ | ¡ }| jjr†|dkr†tƒ }| t¡ | |¡ | j |¡ | jj ¡ \}}|r‚tƒ }| t
¡ | |¡ | |¡ | j |¡ d S | ¡ d S rd ) Úget_textr3 rJ r% rf r rg rh Ú
server_objectZ
get_bannerr$ rn )rA rj ru r8 ÚlanguagerB rB rC Ú_parse_service_request
s
z"AuthHandler._parse_service_requestc C sF | j j}| dd¡|kr2d}| t| |¡¡ d S | j j| t|ƒƒS )Nú-cert-v01@openssh.comr0 zO s z:AuthHandler._finalize_pubkey_algorithm..z Our pubkey algorithm list: {}zFAn RSA key was specified, but no RSA pubkey algorithms are configured!zserver-sig-algsr0 ú,z Server-side algorithm list: {}r z)No common pubkey algorithms exist! Dying.z=Unable to agree on a pubkey algorithm for signing a {!r} key!)rF r rŠ ÚendswithÚreÚsearchr3 Úremote_versionZ_agreed_pubkey_algorithmrˆ r( r' Zserver_extensionsÚgetr& ÚsplitÚlistÚfilterÚ __contains__r) r’ )rA rp r r Zserver_algo_strZ server_algosZ agreementr rB rB rC Ú_finalize_pubkey_algorithm3 sl ÿþ ÿ ÿÿÿ
ÿþ ÿ z&AuthHandler._finalize_pubkey_algorithmc
C sÞ | ¡ }|dkrÈ| td¡ tƒ }| t¡ | | j¡ | d¡ | | j¡ | jdkr|| d¡ t
| j ƒ}| |¡ n>| jdkrî| d¡ | | j
¡\}}| |¡}| |¡ | |¡ | | j
d| j|¡}| j
||¡}| |¡ nÌ| jdkr| d ¡ | | j¡ n¦| jd
krXt| j| jƒ} | | ¡ ¡ | j |¡ | jj ¡ \}
}|
tkr|| |¡ | jj ¡ \}
}|
t krÚ| ¡ } tƒ }| t ¡ z | | | j | | j¡¡ W n2 t!k
rì } z| "| ¡ W Y ¢S d } ~ X Y nX | j |¡ | jj ¡ \}
}|
t#krú| ¡ }
z| | j | | j|
¡}W n2 t!k
rf } z| "| ¡ W Y ¢S d } ~ X Y nX |d krxq´n&tƒ }| t ¡ | |¡ | j $|¡ qút%d &t'|
¡ƒ‚tƒ }| t(¡ | | )| jj*¡¡ n||
t+krît%d ƒ‚nh|
t,kr,| -¡ }| -¡ }| ¡ }| ¡ t%d
&|||¡ƒ‚n*|
t.krD| /|¡ d S t%d &t'|
¡ƒ‚nb| jdkrœ| jj0rœ| jj1}| 2| j¡ | )| jj*¡}| |¡ n | jdkrªnt%d &| j¡ƒ‚| j |¡ n| td &|¡¡ d S )Nre zuserauth is OKússh-connectionr9 FrV Tr[ r0 r^ zReceived Package: {}z Server returned an error tokenzCGSS-API Error:
Major Status: {}
Minor Status: {}
Error Message: {}
r` rM zUnknown auth method "{}"z!Service request "{}" accepted (?))3rƒ rF r r% rf r rg r4 r7 rt r& r9 rr r: r¡ ry Ú
sign_ssh_datar< r- r@ Ú add_bytesÚ ssh_gss_oidsr3 rh Z
packetizerZ read_messager Ú_parse_userauth_bannerr Ú
get_stringr Zssh_init_sec_contextr? r. Ú_handle_local_gss_failurer Ú send_messager( rŠ r# r Z ssh_get_micrs r! r Úget_intr Ú_parse_userauth_failureZ gss_kex_usedÚ kexgss_ctxtZ set_username)rA rj ru r9 rp rx rv ÚblobÚsigÚsshgssÚptypeZmechr Z srv_tokenZ
next_tokenZ
maj_statusZ
min_statusÚerr_msgZkexgssÚ mic_tokenrB rB rC Ú_parse_service_accept{ sä
ü
ÿÿ
ü
ÿ
ûÿ
ÿÿþ
ÿ ÿz!AuthHandler._parse_service_acceptc C s t ƒ }|tkr2| td |¡¡ | t¡ d| _n\| td |¡¡ | t¡ | | j
j |¡¡ |t
krv| d¡ n| d¡ | jd7 _| j
|¡ | jdkr¬| ¡ |tkr¾| j
¡ d S )NzAuth granted ({}).TzAuth rejected ({}).Fé é
)r% r rF r
rŠ rf r r5 r rg r3 r„ Zget_allowed_authsr
rt r> rh ro Ú
_auth_trigger)rA r4 ÚmethodÚresultrj rB rB rC Ú_send_auth_result s&
ÿ
z AuthHandler._send_auth_resultc C s| t ƒ }| t¡ | |j¡ | |j¡ | tƒ ¡ | t|j ƒ¡ |j D ] }| |d ¡ |
|d ¡ qJ| j |¡ d S )Nr r´ )
r% rf r rg ÚnameÚ instructionsÚbytesrl ÚlenÚpromptsrt r3 rh )rA Úqrj ÚprB rB rC Ú_interactive_query s
z AuthHandler._interactive_queryc
C sˆ | j js| |||¡}t ƒ }|
t ¡ | t
|ƒ¡ |D ]}| |¡ qŠ| j |¡ d S )Nr[ z Illegal info request from server)r7 r( rƒ rÄ rª ÚrangeÚappendrà r; r% rf r rl r½ rg r3 rh ) rA rj Útitler» r¾ Z prompt_listÚiZ
response_listÚrrB rB rC Ú _parse_userauth_info_request s(
ÿ
z(AuthHandler._parse_userauth_info_requestc C sr | j jstdƒ‚| ¡ }g }t|ƒD ]}| | ¡ ¡ q$| j j |¡}t |t
ƒr^| |¡ d S | | j
d|¡ d S )Nz!Illegal info response from serverr[ )r3 rJ r( rª rÔ rÕ rƒ r„ Z check_auth_interactive_responserÊ r, rÁ r¹ r= )rA rj ÚnÚ responsesr× r¸ rB rB rC Ú _parse_userauth_info_response s" ÿ
ÿz)AuthHandler._parse_userauth_info_responsec C sR || j _| td |¡¡ | td | j¡¡ d| _d | _| j d k rN| j
¡ d S )NzGSSAPI failure: {}rÑ F) r3 rÒ rF r rŠ r
r7 r5 r4 r6 rb )rA r rB rB rC r¨ * s
z%AuthHandler._handle_local_gss_failurec C s t | jt| jt| jiS rE )r r† r rÏ r rÜ rH rB rB rC Ú_server_handler_table< s úz!AuthHandler._server_handler_tablec
C s" t | jt| jt| jt| jt| j iS rE )
r r³ r rÐ r r« r r¦ r rÙ rH rB rB rC Ú_client_handler_tableH s ûz!AuthHandler._client_handler_tablec C s | j jr| jS | jS d S rE )r3 rJ rÝ rÞ rH rB rB rC Ú_handler_tableT s zAuthHandler._handler_tableN)r0 )'rÉ Ú
__module__Ú __qualname__Ú__doc__rD rF rI rK rU rX rY r] r_ ra rc rR rn ro rr ry r‚ r† rŽ r’ r¡ r³ r¹ rÁ rÏ rÐ r« r¦ rÙ rÜ r¨ ÚpropertyrÝ rÞ rß rB rB rB rC r/ M sP
H
2
r/ c @ sœ e Zd ZdZdZdd„ Zdd„ Zedd„ ƒZed d
„ ƒZ ed d „ ƒZ
ed
d„ ƒZ dd„ Z dd„ Z
dd„ Zdd„ Zdd„ Zeeeeee
eeiZedd„ ƒZdS ) rË z°A specialized Auth handler for gssapi-with-mic
During the GSSAPI token exchange we need a modified dispatch table,
because the packet type numbers are not unique.
r^ c C s || _ || _d S rE )Ú _delegater¯ )rA Zdelegater¯ rB rB rC rD e s z!GssapiWithMicAuthHandler.__init__c C s | ¡ | j ¡ S rE )Ú _restore_delegate_auth_handlerrä rc rH rB rB rC rc i s z GssapiWithMicAuthHandler.abortc C s | j jS rE )rä r3 rH rB rB rC r3 m s z"GssapiWithMicAuthHandler.transportc C s | j jS rE )rä r¹ rH rB rB rC r¹ q s z*GssapiWithMicAuthHandler._send_auth_resultc C s | j jS rE )rä r= rH rB rB rC r= u s z&GssapiWithMicAuthHandler.auth_usernamec C s | j jS rE )rä r? rH rB rB rC r? y s z!GssapiWithMicAuthHandler.gss_hostc C s | j | j_d S rE )rä r3 rÌ rH rB rB rC rå } s z7GssapiWithMicAuthHandler._restore_delegate_auth_handlerc
C s° | ¡ }| j}z| | j|| j¡}W nJ tk
rn } z,|| j_t}| ¡ |
| j| j |¡ ‚ W 5 d }~X Y nX |d k r¬t ƒ }|
t¡ | |¡ tttf| j_| j |¡ d S rE )r§ r¯ Zssh_accept_sec_contextr? r= rÈ r3 rÒ r rå r¹ r· r% rf r rg r r" r rÍ rh )rA rj Z client_tokenr¯ Útokenr r¸ rB rB rC Ú _parse_userauth_gssapi_token€ s. ÿ
ýz5GssapiWithMicAuthHandler._parse_userauth_gssapi_tokenc
C sœ | ¡ }| j}| j}| ¡ z| || jj|¡ W n@ tk
rr } z"|| j_t }|
|| j |¡ ‚ W 5 d }~X Y nX t }| jj
||¡ |
|| j |¡ d S rE )r§ r¯ r= rå rÎ r3 rs rÈ rÒ r r¹ r· r r„ Zcheck_auth_gssapi_with_mic)rA rj r² r¯ r4 r r¸ rB rB rC Ú_parse_userauth_gssapi_micš s* ÿ ÿz3GssapiWithMicAuthHandler._parse_userauth_gssapi_micc C s | ¡ | j |¡S rE )rå rä r† ri rB rB rC r† ² s z/GssapiWithMicAuthHandler._parse_service_requestc C s | ¡ | j |¡S rE )rå rä rÏ ri rB rB rC rÏ ¶ s z0GssapiWithMicAuthHandler._parse_userauth_requestc C s | j S rE )Ú(_GssapiWithMicAuthHandler__handler_tablerH rB rB rC rß Á s z'GssapiWithMicAuthHandler._handler_tableN)rÉ rà rá râ r· rD rc rã r3 r¹ r= r? rå rç rè r† rÏ r r r r" ré rß rB rB rB rC rË \ s8
ürË c sX e Zd ZdZe‡ fdd„ƒZddd„Zdd„ Zd d
„ Zd d „ Z ddd„Z
dd„ Z ‡ Z S )ÚAuthOnlyHandlerzU
AuthHandler, and just auth, no service requests!
.. versionadded:: 3.2
c s t ƒ j ¡ }|t= |S rE )ÚsuperrÞ Úcopyr )rA Zmy_table©r~ rB rC rÞ Ó s z%AuthOnlyHandler._client_handler_tableNc C sx || _ || _tƒ }| t¡ | |¡ | d¡ | |¡ ||ƒ | jj | j |¡ W 5 Q R X t
¡ | _ | | j ¡S )a³
Submit a userauth request message & wait for response.
Performs the transport message send call, sets self.auth_event, and
will lock-n-block as necessary to both send, and wait for response to,
the USERAUTH_REQUEST.
Most callers will want to supply a callback to ``finish_message``,
which accepts a Message ``m`` and may call mutator methods on it to add
more fields.
r¢ )
r7 r4 r% rf r rg r3 rO rh Ú threadingÚEventr6 r‚ )rA r4 r· Zfinish_messagerj rB rB rC Úsend_auth_requestÙ s
z!AuthOnlyHandler.send_auth_requestc C s | |d¡S rL ©rð )rA r4 rB rB rC rU s zAuthOnlyHandler.auth_nonec sH | ˆ¡\}‰| |¡‰ | ˆd|ˆ ¡‰‡ ‡‡‡fdd„}| |d|¡S )Nr¢ c s4 | d¡ | ˆ ¡ | ˆ¡ | ˆ ˆˆ ¡¡ d S )NT)rt rg r£ ©rj ©rv rx r rW rB rC Úfinish s
z.AuthOnlyHandler.auth_publickey..finishrV )rr r¡ ry rð )rA r4 rW rp rô rB ró rC rX s
ü
z AuthOnlyHandler.auth_publickeyc s ‡ fdd„}| |d|¡S )Nc s | d¡ | tˆ ƒ¡ d S )NF)rt rg r& rò ©r9 rB rC rô s
z-AuthOnlyHandler.auth_password..finishr9 rñ )rA r4 r9 rô rB rõ rC rY s z AuthOnlyHandler.auth_passwordr0 c s& d| _ || _‡ fdd„}| |d|¡S )rZ Zkeyboard_interactivec s | d¡ | ˆ ¡ d S )Nr0 )rg rò ©r< rB rC rô / s
z0AuthOnlyHandler.auth_interactive..finishr[ )r7 r; rð )rA r4 r\ r< rô rB rö rC r] % s z AuthOnlyHandler.auth_interactivec C st d}| t|¡ | dd¡}||ks,||krN||kr8|n|}d|›d}|}n|d }|›d|›}| t|¡ |S )NzdServer did not send a server-sig-algs list; defaulting to something in our preferred algorithms listr‡ r0 zCurrent key type, z&, is in our preferred list; using thatr z3 not in our list - trying first list item instead, )rF r r‰ )rA rp r r‘ Znoncert_key_typeÚactualÚalgorB rB rC r’ 8 s z1AuthOnlyHandler._choose_fallback_pubkey_algorithm)N)r0 )
rÉ rà rá râ rã rÞ rð rU rX rY r] r’ Ú
__classcell__rB rB rí rC rê È s
)
rê );râ r1 rî rz r™ Zparamiko.commonr r r r r r r r r
r r r
r r r r r r r r r r r r r r r r r r r r! r" r# r$ Zparamiko.messager% Z
paramiko.utilr& r' Zparamiko.ssh_exceptionr( r) r* r+ Zparamiko.serverr, Zparamiko.ssh_gssr- r. r/ rË rê rB rB rB rC Ú s& ”% l