?????????? ????????? - ??????????????? - /home/agenciai/.local/lib/python3.9/site-packages/mysql/connector/plugins/__pycache__/authentication_ldap_sasl_client.cpython-39.pyc
???????
a ��Jh] � @ s� d Z ddlZddlmZmZ ddlmZmZ ddlm Z m Z m Z m Z m Z mZ ddlmZ ddlmZ dd lmZmZ dd lmZ dd lmZ e r�dd lmZ z ddlZW n e y� ed �d�Y n0 ddl m Z m Z! ddl"m#Z# dZ$G dd� de#�Z%dS )z LDAP SASL Authentication Plugin.� N)� b64decode� b64encode)�sha1�sha256)� TYPE_CHECKING�Any�Callable�List�Optional�Tuple)�uuid4� )� ERR_STATUS)�InterfaceError�ProgrammingError)�logger)� StrOrBytes)� MySQLSocketzwModule gssapi is required for GSSAPI authentication mechanism but was not found. Unable to authenticate with the server)�normalize_unicode_string�"validate_normalized_unicode_string� )�MySQLAuthPlugin� MySQLLdapSaslPasswordAuthPluginc @ s e Zd ZU dZg d�Zee ed< eZ e ed< dZ e e ed< dZ eed< dZe e ed< dZe e ed < d Zeed < dZe e ed < dZe ej ed < dZejed< dZe e ed< dZe e ed< ee e e d�dd��Z e e e d�dd�Z ee ee d�dd�Z eeed�dd ��Z e d �d d �Z!e e d �d d!�Z"e e e#e e e$f d"�d#d$�Z%e e d%�d&d'�Z&e ee e d(�d)d*�Z'e d �d+d,�Z(e dd-�d.d/�Z)e e d0�d1d2�Z*e+e$d3�d4d5�Z,e+e$d6�d7d8�Z-e.ed �d9d:��Z/e.e$d �d;d<��Z0d=e ee d>�d?d@�Z1dS )Ar a5 Class implementing the MySQL ldap sasl authentication plugin. The MySQL's ldap sasl authentication plugin support two authentication methods SCRAM-SHA-1 and GSSAPI (using Kerberos). This implementation only support SCRAM-SHA-1 and SCRAM-SHA-256. SCRAM-SHA-1 amd SCRAM-SHA-256 This method requires 2 messages from client and 2 responses from server. The first message from client will be generated by prepare_password(), after receive the response from the server, it is required that this response is passed back to auth_continue() which will return the second message from the client. After send this second message to the server, the second server respond needs to be passed to auth_finalize() to finish the authentication process. )z SCRAM-SHA-1z SCRAM-SHA-256ZGSSAPI�sasl_mechanisms�def_digest_modeN� client_nonce� client_salt� server_salt�krb_service_principalr � iterations�server_auth_var� target_name�ctx� servers_first� server_nonce)�bytes1�bytes2�returnc C s t dd� t| |�D ��S )Nc S s g | ]\}}||A �qS � r( )�.0�b1�b2r( r( �l/home/agenciai/.local/lib/python3.9/site-packages/mysql/connector/plugins/authentication_ldap_sasl_client.py� <listcomp>c � z8MySQLLdapSaslPasswordAuthPlugin._xor.<locals>.<listcomp>)�bytes�zip)r% r& r( r( r, �_xora s z$MySQLLdapSaslPasswordAuthPlugin._xor)�password�saltr' c C s t �||| j�}|�� S )N)�hmac�newr �digest)�selfr2 r3 Z digest_makerr( r( r, �_hmace s z%MySQLLdapSaslPasswordAuthPlugin._hmac)r2 r3 �countr' c C sJ |� � }| �||d �}|}t|d �D ] }| �||�}| �||�}q(|S )z�Prepares Hi Hi(password, salt, iterations) where Hi(p,s,i) is defined as PBKDF2 (HMAC, p, s, i, output length of H). s r )�encoder8 �ranger1 )r7 r2 r3 r9 �pw�hiZaux�_r( r( r, �_hii s z#MySQLLdapSaslPasswordAuthPlugin._hi)�stringr' c C s* t | �}t|�}|d ur&td|� ���|S )Nz broken_rule: )� norm_ustr� valid_normr )r@ Znorm_strZ broken_ruler( r( r, � _normalizev s z*MySQLLdapSaslPasswordAuthPlugin._normalize)r' c C sH d}t t� ��dd�| _|j| �| j�| jd�}t|t �rD|�d�}|S )aq This method generates the first message to the server to start the The client-first message consists of a gs2-header, the desired username, and a randomly generated client nonce cnonce. The first message from the server has the form: b'n,a=<user_name>,n=<user_name>,r=<client_nonce> Returns client's first message z.n,a={user_name},n={user_name},r={client_nonce}�-� )� user_namer �utf8) �strr �replacer �formatrC � _username� isinstancer: )r7 Z cfm_fprnatZcfmr( r( r, �_first_message~ s � z.MySQLLdapSaslPasswordAuthPlugin._first_messagec C s t jjj| j�d�t jjd�}zrt �� }t � d� z |j W nP t jj j y� } z2t �d|� |�|� td|� ��|�W Y d}~n d}~0 0 W n� t jjj�y@ } z�| js�td|� ��|�z0t � d� t jj|| j�d�d d �}|d }W n< t jjj�y* } z td |� ��|�W Y d}~n d}~0 0 W Y d}~n d}~0 0 t jjt jjt jjf}| j�rh| j}nd }t � d|� t j|t jj d�}|| _ t j ||t |�d d�| _ z| j �!� } W n< t jjj�y� } z td|� ��|�W Y d}~n d}~0 0 t � d| � | S )z�Get a TGT Authentication request and initiates security context. This method will contact the Kerberos KDC in order of obtain a TGT. rG )Z name_typezE# Stored credentials found, if password was given it will be ignored.z Credentials has expired: %szCredentials has expired: Nz-Unable to retrieve stored credentials error: z5# Attempt to retrieve credentials with given passwordZinitiate)�usager z8Unable to retrieve credentials with the given password: z ldap/ldapauthz# service principal: %s)�name�creds�flagsrN z%Unable to initiate security context: z# initial client token: %s)"�gssapi�raw�names� import_namerK r: ZNameType�user� Credentialsr �debugZlifetime� exceptionsZExpiredCredentialsError�warning�acquirer �miscZGSSError� _passwordZacquire_cred_with_passwordr ZRequirementFlagZmutual_authenticationZextended_errorZdelegate_to_peerr �NameZkerberos_principalr! �SecurityContext�sumr" �step) r7 rF �cred�errZacquire_cred_resultZerr2Zflags_lZservice_principalZservkZinitial_client_tokenr( r( r, �_first_message_krb� sp �� *�� � ��.� � �& z2MySQLLdapSaslPasswordAuthPlugin._first_message_krb)�tgt_auth_challenger' c C s@ t �d|� | j�|�}t �d|� t �d| jj� || jjfS )a Continue with the Kerberos TGT service request. With the TGT authentication service given response generate a TGT service request. This method must be invoked sequentially (in a loop) until the security context is completed and an empty response needs to be send to acknowledge the server. Args: tgt_auth_challenge the challenge for the negotiation. Returns: tuple (bytearray TGS service request, bool True if context is completed otherwise False). ztgt_auth challenge: %sz# context step response: %sz# context completed?: %s)r rX r" ra �complete)r7 re �respr( r( r, �auth_continue_krb� s z1MySQLLdapSaslPasswordAuthPlugin.auth_continue_krb)�messager' c C s� | j jstd��t�d|� t�d| j j� z | j �|�}t�d|� W n: tjj j y� } z t d|� ��|�W Y d}~n d}~0 0 t�d|� t d�}t�d |� | j j |d d �}t�d |d t|d �� |jS )aP Accept handshake and generate closing handshake message for server. This method verifies the server authenticity from the given message and included signature and generates the closing handshake for the server. When this method is invoked the security context is already established and the client and server can send GSSAPI formated secure messages. To finish the authentication handshake the server sends a message with the security layer availability and the maximum buffer size. Since the connector only uses the GSSAPI authentication mechanism to authenticate the user with the server, the server will verify clients message signature and terminate the GSSAPI authentication and send two messages; an authentication acceptance b' ' and a OK packet (that must be received after sent the returned message from this method). Args: message a wrapped hssapi message from the server. Returns: bytearray closing handshake message to be send to the server. z"Security context is not completed.z# servers message: %sz# GSSAPI flags in use: %sz# unwraped: %sz!Unable to unwrap server message: Nz # unwrapped server message: %ss z# message response: %sF)Zencryptz*# wrapped message response: %s, length: %dr )r" rf r r rX Z actual_flags�unwraprR rS rY Z BadMICErrorr � bytearray�wrap�lenri )r7 ri Zunwrapedrc �responseZwrapedr( r( r, �auth_accept_close_handshake� s& & �z;MySQLLdapSaslPasswordAuthPlugin.auth_accept_close_handshake)� auth_data�kwargsr' c K s� || _ | j �� }t�d|� || jvr\d�| jdd� �}td|� d|� d| jd � d���d | j v rn| �� S | j d kr~t| _ | � � S ) z�This method will prepare the fist message to the server. Returns bytes to send to the server as the first message. z read_method_name_from_server: %sz", "N���z The sasl authentication method "z4" requested from the server is not supported. Only "z" and "z" are supported� GSSAPIs SCRAM-SHA-256) � _auth_data�decoder rX r �joinr rd r r rM )r7 rp rq Zauth_mechanismZauth_mechanismsr( r( r, � auth_response) s" ��� z-MySQLLdapSaslPasswordAuthPlugin.auth_responsec C s� | j std��| �| j�}| �|t| j�| j�}t� dt |�� � � | � |d�}t� dt |�� � � | � |��� }t� dt |�� � � | � |d�}t� dt |�� � � d�d | �| j�� �d | j� �g�}t� d |� t d | �| j�� d��� �� � }d�|| jd |� �d | j� �g�}t� d|� | � ||�� �} t� dt | �� � � | �|| �} t� dt | �� � � t | � ||�� ��� � | _t� d| j� d�d |� �d | j� �dt | �� � � �g�} t� d| � | �� S )a� This method generates the second message to the server Second message consist on the concatenation of the client and the server nonce, and cproof. c=<n,a=<user_name>>,r=<server_nonce>,p=<client_proof> where: <client_proof>: xor(<client_key>, <client_signature>) <client_key>: hmac(salted_password, b"Client Key") <client_signature>: hmac(<stored_key>, <auth_msg>) <stored_key>: h(<client_key>) <auth_msg>: <client_first_no_header>,<servers_first>, c=<client_header>,r=<server_nonce> <client_first_no_header>: n=<username>r=<client_nonce> z"Missing authentication data (seed)zsalted_password: %ss Client Keyzclient_key: %szstored_key: %ss Server Keyzserver_key: %s�,zn=�r=zclient_first_no_header: %szn,a=zc=z auth_msg: %szclient_signature: %szclient_proof: %szserver_auth_var: %szp=zsecond_message: %s)rt r rC r] r? r r r r rX r ru r8 r r6 rv rK r r: r# r$ r1 r ) r7 ZpasswZsalted_passwordZ client_keyZ stored_keyZ server_keyZclient_first_no_headerZ client_headerZauth_msgZclient_signatureZ client_proof�msgr( r( r, �_second_messageG sX �� � �� � �� z/MySQLLdapSaslPasswordAuthPlugin._second_message)r# r' c C sR |rt |ttf�s$tdt|�� ���z"|�� }|| _|�d�\}}}W n" tyh td|� ��d�Y n0 |� d�r�|� d�r�|� d�s�td|� ���| j |v r�|dd� | _ t � d | j � ntd |� ���|dd� | _t � d | jt| j�� z&|dd� }t � d |� t|�| _W n6 t�yL } z td |� ��|�W Y d}~n d}~0 0 dS )z�Validates first message from the server. Extracts the server's salt and iterations from the servers 1st response. First message from the server is in the form: <server_salt>,i=<iterations> zUnexpected server message: rx Nry zs=zi=z$Incomplete reponse from the server: r zserver_nonce: %sz:Unable to authenticate response: response not well formed zserver_salt: %s length: %sziterations: %sz-Unable to authenticate: iterations not found )rL rk r/ r �reprru r# �split� ValueError� startswithr r$ r rX r rm �intr � Exception)r7 r# Zservers_first_strZr_server_nonceZs_saltZ i_counterrc r( r( r, �_validate_first_reponse� sZ ������ ��� ��z7MySQLLdapSaslPasswordAuthPlugin._validate_first_reponse)�servers_first_responser' c C s | � |� | �� S )zwreturn the second message from the client. Returns bytes to send to the server as the second message. )r� r{ )r7 r� r( r( r, � auth_continue� s z-MySQLLdapSaslPasswordAuthPlugin.auth_continue)�servers_secondr' c C sR |r$t |t�r$t|�dks$|�d�s,td��|dd� �� }t�d|� | j|kS )aX Validates second message from the server. The client and the server prove to each other they have the same Auth variable. The second message from the server consist of the server's proof: server_proof = HMAC(<server_key>, <auth_msg>) where: <server_key>: hmac(<salted_password>, b"Server Key") <auth_msg>: <client_first_no_header>,<servers_first>, c=<client_header>,r=<server_nonce> Our server_proof must be equal to the Auth variable send on this second response. r s v=z'The server's proof is not well formatedNzserver auth variable: %s) rL rk rm r r ru r rX r )r7 r� Z server_varr( r( r, �_validate_second_reponse� s �� �� z8MySQLLdapSaslPasswordAuthPlugin._validate_second_reponse)�servers_second_responser' c C s | � |�std��dS )z�finalize the authentication process. Raises InterfaceError if the ervers_second_response is invalid. Returns True in successful authentication False otherwise. z6Authentication failed: Unable to proof server identityT)r� r )r7 r� r( r( r, � auth_finalize� s �z-MySQLLdapSaslPasswordAuthPlugin.auth_finalizec C s dS )zPlugin official name.Z authentication_ldap_sasl_clientr( �r7 r( r( r, rO � s z$MySQLLdapSaslPasswordAuthPlugin.namec C s dS )z'Signals whether or not SSL is required.Fr( r� r( r( r, � requires_ssl� s z,MySQLLdapSaslPasswordAuthPlugin.requires_sslr )�sockrp rq r' c K sd t �d|� |�d�| _| j|fi |��}|du r:td��t �d|t|�� |�|� |�� }t �d|� t|�dkr�|d d kr�|d d kr�|dd� }| � |�}|�|� |�� }|d d kr�|d d kr�| � |dd� �r�|�� }�np|d k�r\|d t k�r\d}t �d� t �d|d|d � � t �dt|�� t �d� d} d} | �s�| dk �r�t �dd| d d� t �d|� t �d|d|d � � | � ||d� �\} } t �d| � |�| �p�d� |�� }| d7 } �qL| �s�td| � d |� ���t �d |t|�� | � ||d� �} t �d | t| �� |�| � |�� }t �d |� |�� }t �d |� t|�S )!aS Handles server's `auth switch request` response. Args: sock: Pointer to the socket connection. auth_data: Plugin provided data (extracted from a packet representing an `auth switch request` response). kwargs: Custom configuration to be passed to the auth plugin when invoked. The parameters defined here will override the ones defined in the auth plugin itself. Returns: packet: Last server's response after back-and-forth communication. z# auth_data: %sr NzGot a NULL auth responsez# request: %s size: %sz # server response packet: %s� � �r �= �v rs � z*# Continue with sasl GSSAPI authenticationz# response header: %sr z# response size: %sz # Negotiate a service requestFr z%s Attempt %s %sz--------------------z<< server response: %sz# response code: %sz >> response to server: %sr. z'Unable to fulfill server request after z! attempts. Last server response: z0 last GSSAPI response from server: %s length: %dz* >> last response to server: %s length: %dz"<< final handshake from server: %sz << ok packet from server: %s)r rX �getr rw r rm �send�recvr� r� r rh ro r/ ) r7 r� rp rq rn �packetZ dec_responseZ cresponseZ rcode_sizerf �triesra Z last_stepr( r( r, �auth_switch_response� sr $ ���� z4MySQLLdapSaslPasswordAuthPlugin.auth_switch_response)2�__name__� __module__� __qualname__�__doc__r r rH �__annotations__r r r r r r r r r r r� r r! rR r^ r" r_ r# r$ � staticmethodr/ r1 r8 r? rC rM rd r �boolrh ro rw r{ r� r� rk r� r� �propertyrO r� r� r( r( r( r, r A sR J� 6� L0 �)&r� r4 �base64r r �hashlibr r �typingr r r r r r �uuidr Zauthenticationr �errorsr r r �typesr �networkr rR � ImportError�utilsr rA r rB rE r ZAUTHENTICATION_PLUGIN_CLASSr r( r( r( r, �<module> s. ��
| ver. 1.6 |
Github
|
.
| PHP 8.2.30 | ??????????? ?????????: 0 |
proxy
|
phpinfo
|
???????????