U
vf_ @ s d Z ddlZddlmZ ddlmZmZmZmZm Z m
Z
ddl m Z ddl
mZ ddlmZ edd \ZZZZZed
d \ZZd d
edd D \ZZZZ Z dd
ed
d D \Z Z G dd dZ G dd de Z!G dd dZ"G dd dZ#dS )a
This module provides GSS-API / SSPI Key Exchange as defined in :rfc:`4462`.
.. note:: Credential delegation is not supported in server mode.
.. note::
`RFC 4462 Section 2.2
`_ says we are not
required to implement GSS-API error messages. Thus, in many methods within
this module, if an error occurs an exception will be thrown and the
connection will be terminated.
.. seealso:: :doc:`/api/ssh_gss`
.. versionadded:: 1.15
N)sha1)DEBUGmax_byte zero_bytebyte_chr byte_maskbyte_ord)util)Message) SSHException # ( * c C s g | ] }t |qS r .0cr r A/opt/alt/python38/lib/python3.8/site-packages/paramiko/kex_gss.py
F s r c C s g | ] }t |qS r r r r r r r G s c @ s| e Zd ZdZdZdZeded Ze d Z
dZ dd Z d
d Z
d d
Zdd Zdd Zdd Zdd Zdd Zdd ZdS ) KexGSSGroup1z
GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange as defined in `RFC
4462 Section 2 `_
lE 8 {3If?E yZ3V58noPe?a-
tBL
y3W[ s
z"KexGSSGroup1._parse_kexgss_hostkeyc C sZ | j jsV| }t }|t || jj| j |d | j
| | j t t
t n dS )z
Parse the SSH2_MSG_KEXGSS_CONTINUE message.
:param `.Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE
message
r' Z
recv_tokenNr r) rQ r
r/ c_MSG_KEXGSS_CONTINUEr1 r r2 r send_messager- r6 r7 r8 r$ r: srv_tokenr r r r? s"
z#KexGSSGroup1._parse_kexgss_continuec C s< | j jdkrt | j _| | _| jdk s:| j| jd krBtd| }| }d}|rb| }t | j| j
| j}t }| | j j
| j j| j j| j j || j j || j || j || tt| }| j || |dk r| jj| j|d | j || n| j || d| j _ | j dS )z
Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).
:param `.Message` m: The content of the
SSH2_MSG_KEXGSS_COMPLETE message
NrH Server kex "f" is out of rangerU T) r rR NullHostKey get_mpintr" r, r rQ get_booleanr* r r
add
local_versionremote_versionlocal_kex_initremote_kex_initr1 __str__r3 r! r strdigest_set_K_Hr r2 r
ssh_check_mic gss_kex_used_activate_outboundr$ r: mic_tokenboolrZ KhmHr r r r@ sB
z#KexGSSGroup1._parse_kexgss_completec C s | }| | _| jdk s,| j| jd kr4tdt| j| j| j}t | j_ | jj
}t }| | jj
| jj| jj| jj || || j || j || t| }| j|| | j| j|}t }| jjrj| jj | jj dd}| t || j || |dk r@| d || n
| d | j!| d| j_"| j# n0| t$ || | j!| | j%t&t't( dS )z
Parse the SSH2_MSG_KEXGSS_INIT message (server mode).
:param `.Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
rH Client kex "e" is out of rangeTZgss_kexNF))rQ r] r! r, r r* r r\ r rR rd r
r_ ra r` rc rb r1 r3 r" r asbytesrf rg r ssh_accept_sec_contextr _gss_srv_ctxt_status ssh_get_mic
session_idr/ c_MSG_KEXGSS_COMPLETE add_booleanr4 ri rj rW r- r6 r7 r8 r$ r: Z client_tokenrn keyro rp rZ rl r r r r= s`
z KexGSSGroup1._parse_kexgss_initc C s6 | }| }| }| td|||dS )a
Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
The server may send a GSS-API error message. if it does, we display
the error by throwing an exception (client mode).
:param `.Message` m: The content of the SSH2_MSG_KEXGSS_ERROR message
:raise SSHException: Contains GSS-API major and minor status as well as
the error message and the language tag of the
message
CGSS-API Error:
Major Status: {}
Minor Status: {}
Error Message: {}
Nget_intrQ r rB r$ r: Z
maj_statusZ
min_statuserr_msgr r r rA * s z KexGSSGroup1._parse_kexgss_errorN)__name__
__module__ __qualname____doc__r, r+ r r rK r rL NAMEr% r; rF r( r> r? r@ r= rA r r r r r L s
-8r c @ s e Zd ZdZdZdZdZdS )
KexGSSGroup14z
GSS-API / SSPI Authenticated Diffie-Hellman Group14 Key Exchange as defined
in `RFC 4462 Section 2
`_
l &UG9
tcb0]Q\-:$90.`U_b;YS7x]Ek `:xds! ,w =HG2Cdc_.K?&j_c}z[\V_1M.D^ /1v5 I jV&|
/mVlR<6#{n4(EY91T:g8 H Apcb4BBj~H r z)gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==N)r r r r r, r+ r r r r r r D s r c @ sx e Zd ZdZdZdZdZdZdd Zdd Z d
d Z
d d
Z dd Z dd Z
dd Zdd Zdd Zdd Zdd Zd S ) KexGSSGexz
GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange as defined in
`RFC 4462 Section 2 `_
z%gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g== i c C sD || _ | j j| _d | _d | _d | _d | _d | _d | _d | _ d| _
d S )NF) r r r r pqgr r! r" old_styler# r r r r% [ s
zKexGSSGex.__init__c C sr | j jr| j t dS | j j| _t }|t || j || j
|| j | j | | j t
dS )zV
Start the GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange
N)r r) r- MSG_KEXGSS_GROUPREQr r
r/ c_MSG_KEXGSS_GROUPREQadd_intmin_bitspreferred_bitsmax_bitsr4 MSG_KEXGSS_GROUPr9 r r r r; g s
zKexGSSGex.start_kexc C s |t kr| |S |tkr$| |S |tkr6| |S |tkrH| |S |tkrZ| |S |t
krl| |S |t kr~|
|S d}t||dS )r< z'KexGex asked to handle packet type {:d}N)r _parse_kexgss_groupreqr _parse_kexgss_groupr. _parse_kexgss_gex_initr5 r> r6 r? r7 r@ r8 rA r rB rC r r r rF z s
zKexGSSGex.parse_nextc C s | j d d }t|d}t|d }t|}d}|d@ sL|dK }|dL }q2t|}t|d ||dd }t|d}|dkrL||k rLqqL|| _ d S )NrH r r rG )
r r Z deflate_longr lenrI rJ r rM r )r$ r ZqnormZqhbyteZ
byte_countZqmaskrN r r r r r( s
zKexGSSGex._generate_xc C s | }| }| }|| jkr(| j}|| jk r8| j}||krD|}||k rP|}|| _|| _|| _| j }|dkr|td| jtd ||| |
|||\| _ | _ t
}|t || j || j | j| | jt dS )z
Parse the SSH2_MSG_KEXGSS_GROUPREQ message (server mode).
:param `.Message` m: The content of the
SSH2_MSG_KEXGSS_GROUPREQ message
Nz-Can't do server-side gex with no modulus packz Picking p ({} <= {} <= {} bits))r~ r r r r Z_get_modulus_packr _logr rB Z get_modulusr r r
r/ c_MSG_KEXGSS_GROUPr3 r4 r- r. )r$ r: ZminbitsZ
preferredbitsZmaxbitspackr r r r s@
z KexGSSGex._parse_kexgss_groupreqc C s | | _| | _t| j}|dk s0|dkr>td|| jt d| |
t | j| j | j| _
t }|t || jj| jd || j
| j| | jtttt dS )z
Parse the SSH2_MSG_KEXGSS_GROUP message (client mode).
:param `Message` m: The content of the SSH2_MSG_KEXGSS_GROUP message
r r z 1 s
z KexGSSGex._parse_kexgss_hostkeyc C sZ | j jsV| }t }|t || jj| j |d | j
| | j t t
t n dS )z
Parse the SSH2_MSG_KEXGSS_CONTINUE message.
:param `Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE message
rU NrV rY r r r r? > s"
z KexGSSGex._parse_kexgss_continuec C s| | j jdkrt | j _| | _| }| }d}|r@| }| jdk sZ| j| jd krbtdt | j| j
| j}t }| | j j
| j j| j j| j j| j j | js|| j || j | js|| j || j || j || j || j || t| }| j || |dk rX| j j | j |d | j !|| n| j !|| d| j _"| j # dS )z
Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).
:param `Message` m: The content of the SSH2_MSG_KEXGSS_COMPLETE message
NrH r[ rU T)$r rR r\ r] r" rQ r^ r r r* r r
r_ r` ra rb rc rd r r r r r r3 r r! r rs rf rg r r2 r rh ri rj rk r r r r@ T sP
z KexGSSGex._parse_kexgss_completec C s6 | }| }| }| td|||dS )a
Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
The server may send a GSS-API error message. if it does, we display
the error by throwing an exception (client mode).
:param `Message` m: The content of the SSH2_MSG_KEXGSS_ERROR message
:raise SSHException: Contains GSS-API major and minor status as well as
the error message and the language tag of the
message
r| Nr} r r r r rA s z KexGSSGex._parse_kexgss_errorN)r r r r r r r r r% r; rF r( r r r r> r? r@ rA r r r r r P s ,!>
2r c @ s( e Zd ZdZdd Zdd Zdd ZdS ) r\ z
This class represents the Null Host Key for GSS-API Key Exchange as defined
in `RFC 4462 Section 5
`_
c C s
d| _ d S )N r{ r$ r r r r% s zNullHostKey.__init__c C s | j S Nr r r r r rd s zNullHostKey.__str__c C s | j S r r r r r r get_name s zNullHostKey.get_nameN)r r r r r% rd r r r r r r\ s r\ )$r rI hashlibr Zparamiko.commonr r r r r r Zparamikor Zparamiko.messager
Zparamiko.ssh_exceptionr ranger. r6 r7 r5 r8 r r r0 rW rx Zc_MSG_KEXGSS_HOSTKEYZc_MSG_KEXGSS_ERRORr r r r r r\ r r r r s>
y R