i>dZddlZddlZejZGddZGddeZGddeZed krd Zej ej zej zej zej zZejdeejdd\ZZeejZed eeeee Zeee ZedejdejddZdZdZejrereedj redz Ze!e\Z"Zedezejreedj dkrnJedz Ze!e\Z"Zedezejereedj edej#edej$dZ%e&e%Z'e(e%e'e)e%\Z*Z'e+e*e'Z,e,e%ksJe-e%Z.e/e.\Z0Z1ede1e%e0ksJe-e%dZ.e/e.\Z0Z1ede1e%e0ksJeddSdS)a6 Helper classes for SSPI authentication via the win32security module. SSPI authentication involves a token-exchange "dance", the exact details of which depends on the authentication provider used. There are also a number of complex flags and constants that need to be used - in most cases, there are reasonable defaults. These classes attempt to hide these details from you until you really need to know. They are not designed to handle all cases, just the common ones. If you need finer control than offered here, just use the win32security functions directly. NcLeZdZdZdZdZdZdZdZdZ dZ d d Z d Z d S) _BaseAuthc.|dS)N)resetselfs UVVWWWq q  !!&$*@*@*B*BCCCCCr ctj}|tjt |t j||d_|tjdt j|j || }|dj}||t j k fS)a< GSSAPI's unwrap with SSPI. https://learn.microsoft.com/en-us/windows/win32/secauthn/sspi-kerberos-interoperability-with-gssapi Usable mainly with Kerberos SSPI package, but this is not enforced. Return the clear text, and a boolean that is True if the token was encrypted. rr) rrrrrrSECBUFFER_STREAMr"r r r*rSECQOP_WRAP_NO_ENCRYPT)rtokenbufferpfQOPrs r unwrapz_BaseAuth.unwrapds244  )#e**g6N O O   !q   m3Aw7MNNOOO ((1G1G1I1IJJ 1I u >>???r Fc|jtj}|d}|d}t j}|t jt|tj ||d_ |t j|tj |t j|tj |rdn tj }|j||||dj |dj z|dj z}|S)a7 GSSAPI's wrap with SSPI. https://learn.microsoft.com/en-us/windows/win32/secauthn/sspi-kerberos-interoperability-with-gssapi Usable mainly with Kerberos SSPI package, but this is not enforced. Wrap a message to be sent to the other side. Encrypted if encrypt is True. r BlockSizerr)r rrrrrrrrr r"r!SECBUFFER_PADDINGr9r#r) rmsgr( size_info trailer_size block_sizer;fQOPr=s r wrapz_BaseAuth.wrap}s/I44W5NOO  !23 {+ 244  m3CHHg>TUUVVVq    ),8O P P     )*g6O P P   ?qq!?   vt/E/E/G/GHHH 1I vay/ /&)2B Br c|jstd |jtj}|\|_|_dS#t$rYdSwxYw)zHAdds initiator and service names in the security context for ease of usez+Sec context is not completely authenticatedN) r ValueErrorr rrSECPKG_ATTR_NATIVE_NAMESrrerror)rnamess r _amend_ctx_namez_BaseAuth._amend_ctx_namesv! LJKK K ;I44W5UVVE 6; 2D !2!2!2     DD s$A AAN)F) __name__ __module__ __qualname__r rrr(r,r2r6r>rHrNr r rrs222         D D D@@@2####J ; ; ; ; ;r rc4eZdZdZddddejfdZdZdS) ClientAuthz;Manages the client side of an SSPI authentication handshakeNct|3tjtjztjztjz}||_||_||_tj ||_ tj ||j dtj d|\|_ |_t|dSNName)rISC_REQ_INTEGRITYISC_REQ_SEQUENCE_DETECTISC_REQ_REPLAY_DETECTISC_REQ_CONFIDENTIALITYscflagsdatarep targetspnrQuerySecurityPackageInfopkg_infoAcquireCredentialsHandleSECPKG_CRED_OUTBOUND credentialscredentials_expiryrr )rpkg_name client_name auth_infor^r\r]s r r zClientAuth.__init__s ?)12/012    "%>xHH   2  M& !  (         # 4     r c (|ut|tjs[tj}tj|jdt j}||_|||}tj}tj|jdt j}|||j }|j tj |_ tj |j ||j |j|j||j |\}}}||_||_|t jt jfvr|j ||dk|_|jr|||fS)zVPerform *one* step of the client authentication process. Pass None for the first roundNMaxTokenr) isinstancerrrr`rr!r"rr PyCtxtHandleTypeInitializeSecurityContextrcr^r\r] ctxt_attr ctxt_expirySEC_I_COMPLETE_NEEDEDSEC_I_COMPLETE_AND_CONTINUECompleteAuthTokenrrN r sec_buffer_insec_buffer_newtokenbufsec_buffer_outctxtinerrattrexps r authorizezClientAuth.authorizes  $Z =<. . $+>@@N$4 j)7+BH,HO  ! !( + + +*M&:<< 0 M* %w'>   h''' 9 %688DI&@    N L L  I    T3 70'2UV V V I ' ' 7 7 7 AX   #  " " "N""r rOrPrQ__doc__rSECURITY_NETWORK_DREPr r{rRr r rTrTsREE -!!!!@,#,#,#,#,#r rTc0eZdZdZddejfdZdZdS) ServerAuthz;Manages the server side of an SSPI authentication handshakeNct||_||_|3tjtjztjztjz}||_tj ||_ tj ||j dtj dd\|_ |_t|dSrV)spnr]rASC_REQ_INTEGRITYASC_REQ_SEQUENCE_DETECTASC_REQ_REPLAY_DETECTASC_REQ_CONFIDENTIALITYr\rr_r`raSECPKG_CRED_INBOUNDrcrdrr )rrerr\r]s r r zServerAuth.__init__s ?)12/012  %>xHH  2 v&(CT4      # 4     r c |ut|tjs[tj}tj|jdt j}||_|||}tj}tj|jdt j}|||j }|j tj |_ tj |j |||j |j|j |\}}}||_||_|t jt jfvr|j ||dk|_|jr|||fS)z8Perform *one* step of the server authentication process.Nrir)rjrrrr`rr!r"rr rkAcceptSecurityContextrcr\r]rmrnrorprqrrNrrs r r{zServerAuth.authorize s}  $Z =<. . $+>@@N$4 j)7+BH,HO  ! !( + + +*M&:<< 0 M* %w'>   h''' 9 %688DI&<     L L I   T3 70'2UV V V I ' ' 7 7 7 AX   #  " " "N""r r|rRr r rrsIEE!$8U!!!!6-#-#-#-#-#r r__main__KerberoszWe are:)r\r^)r\z SSP : {} ({})rWCommentrzClient step %szServer step %sz%Initiator name from the service side:z%Service name from the client side: shelloz encrypted ?T)r(zcool!)2r}rrrLrrTrrOsspISC_REQ_MUTUAL_AUTHrXrYr[rZflagsrar cred_handlerzQueryCredentialsAttributesSECPKG_CRED_ATTR_NAMEScredprint sspiclient sspiserverformatr` sec_buffer client_step server_steprrr"r{rxrrr$r2r5r6r( encryptedr, decryptedrHwrappedr> unwrapped was_encryptedrRr r rs$   V;V;V;V;V;V;V;V;rO#O#O#O#O#O#O#O#dK#K#K#K#K#K#K#K#\ z C #  # $  ) *  ) *  '  ( >}= c7.dK  1 1'2P Q QD E)TC$???JC///J E   ')R:S:S .q $..z::Z ,---  # JqM,@(A(AQ(F(F q $..z::Z ,---& .: .##jm>R:S:S . E 1:3LMMM E 1:3JKKK D //$  CdC    ''--NIs""9c22I     ood##G)0099I} E-''' 9    oodDo11G)0099I} E-''' 9     E'NNNNN[r