?????????? ????????? - ??????????????? - /home/agenciai/.local/lib/python3.9/site-packages/mysql/connector/plugins/__pycache__/authentication_kerberos_client.cpython-39.pyc
???????
a ��JhxT � @ s@ d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m Z m Z m Z ddl mZ ddlmZmZ dd lmZ e r�dd lmZ z ddlZW n* ey� dZejd kr�ed �d�Y n0 zddlZddlZW n ey� dZdZY n0 d dlmZ ejd k�rdndZ G dd� de�Z G dd� de �Z G dd� de �Z dS )z Kerberos Authentication Plugin.� N)�abstractmethod)�Path)� TYPE_CHECKING�Any�Optional�Tuple� )� ERR_STATUS)�InterfaceError�ProgrammingError)�logger)� MySQLSocket�ntzwModule gssapi is required for GSSAPI authentication mechanism but was not found. Unable to authenticate with the server� )�MySQLAuthPlugin�MySQLSSPIKerberosAuthPlugin�MySQLKerberosAuthPluginc @ sl e Zd ZdZeed�dd��Zeed�dd��Ze e e e e e ef d�dd ��Z d e ee d �d d �ZdS )�MySQLBaseKerberosAuthPluginz8Base class for the MySQL Kerberos authentication plugin.��returnc C s dS )zPlugin official name.Z authentication_kerberos_client� ��selfr r �k/home/agenciai/.local/lib/python3.9/site-packages/mysql/connector/plugins/authentication_kerberos_client.py�nameL s z MySQLBaseKerberosAuthPlugin.namec C s dS )z'Signals whether or not SSL is required.Fr r r r r � requires_sslQ s z(MySQLBaseKerberosAuthPlugin.requires_ssl��tgt_auth_challenger c C s dS )�! Continue with the Kerberos TGT service request. With the TGT authentication service given response generate a TGT service request. This method must be invoked sequentially (in a loop) until the security context is completed and an empty response needs to be send to acknowledge the server. Args: tgt_auth_challenge: the challenge for the negotiation. Returns: tuple (bytearray TGS service request, bool True if context is completed otherwise False). Nr )r r r r r � auth_continueV s z)MySQLBaseKerberosAuthPlugin.auth_continuer )�sock� auth_data�kwargsr c K s� t �d|� | j|fddi|��}|du r2td��t �d|t|�� |�|� |�� }t �d|� |tk�r�d}t �d � t �d |d|d � � t �d t|�� t �d � d}d}|�sJ|dk �rJt �dd|d d� t �d|� t �d|d|d � � | �||d� �\} }| �r"|�| � |�r,�qJ|�� }t �d| � |d 7 }q�|�sdtd|� d|� ���t �d|t|�� |�� }t �d|� t |�S )aS Handles server's `auth switch request` response. Args: sock: Pointer to the socket connection. auth_data: Plugin provided data (extracted from a packet representing an `auth switch request` response). kwargs: Custom configuration to be passed to the auth plugin when invoked. The parameters defined here will override the ones defined in the auth plugin itself. Returns: packet: Last server's response after back-and-forth communication. z# auth_data: %s�ignore_auth_dataFNzGot a NULL auth responsez# request: %s size: %sz # server response packet: %s� z%# Continue with GSSAPI authenticationz# Response header: %sr z# Response size: %sz # Negotiate a service requestr z%s Attempt %s %sz--------------------z<< Server response: %sz# Response code: %sz>> Response to server: %sz'Unable to fulfill server request after z! attempts. Last server response: z(Last response from server: %s length: %dz << Ok packet from server: %s) r �debug� auth_responser �len�send�recvr r �bytes) r r r! r" �response�packetZ rcode_size�complete�tries�tokenr r r �auth_switch_responsei sT ��� z0MySQLBaseKerberosAuthPlugin.auth_switch_responseN)�__name__� __module__� __qualname__�__doc__�property�strr �boolr r r r* r r r r0 r r r r r I s ��r c @ s� e Zd ZU dZdZeej ed< e e d�dd��Z e e d�dd��Z e ejjjd �d d �Ze eee e f d �d d��Zdee eee d�dd�Zee eee ef d�dd�Zeed�dd�ZdS )r z3Implement the MySQL Kerberos authentication plugin.N�contextr c C s` z:t jdd�} t| j�}|�d�dkr6|�dd�\}}|W S t jjjyZ t � � Y S 0 dS )z(Get user from credentials without realm.�initiate��usage�@���r N) �gssapi� Credentialsr6 r �find�split�raw�misc�GSSError�getpass�getuser)�creds�user�_r r r �get_user_from_credentials� s z1MySQLKerberosAuthPlugin.get_user_from_credentialsc C s` t j�dt jdkr dt �� � �n td��d��} | s<td��t� d| � dd | � �� d �i}|S ) z�Get a credentials store dictionary. Returns: dict: Credentials store dictionary with the krb5 ccache name. Raises: InterfaceError: If 'KRB5CCNAME' environment variable is empty. Z KRB5CCNAME�posixz /tmp/krb5cc_z%TEMP%Zkrb5ccz5The 'KRB5CCNAME' environment variable is set to emptyz Using krb5 ccache name: FILE:%ss ccachezFILE:�utf-8) �os�environ�getr �getuidr �joinpathr r r% �encode)Z krb5ccname�storer r r � get_store� s � �� z!MySQLKerberosAuthPlugin.get_store)�upnr c C s� t �d� t�|tjj�}| j�d�}z:tjj ||dd�}|j }tjj | � � |tj jddd� W n: tjjjy� } z td|� ��|�W Y d}~n d}~0 0 |S ) z�Acquire and store credentials through provided password. Args: upn (str): User Principal Name. Returns: gssapi.raw.creds.Creds: GSSAPI credentials. z8Attempt to acquire credentials through provided passwordrL r9 r: T)rG Zmech� overwrite� set_defaultz7Unable to acquire credentials with the given password: N)r r% r> �Name�NameTyperH � _passwordrR rB Zacquire_cred_with_passwordrG Zstore_cred_intorT �MechType�kerberosrC rD r )r rU rH �passwordZacquire_cred_resultrG �errr r r �_acquire_cred_with_password� s, �� ��z3MySQLKerberosAuthPlugin._acquire_cred_with_password�r, r c C s� t �d| dd� �d }| dd� } t �d|� d�| d|� �d }| |d� } t �d| dd� �d }t �d|� d�| dd� �d }|�� |�� fS �aY Parse authentication data. Get the SPN and REALM from the authentication data packet. Format: SPN string length two bytes <B1> <B2> + SPN string + UPN realm string length two bytes <B1> <B2> + UPN realm string Returns: tuple: With 'spn' and 'realm'. z<HNr r �<�s��struct�unpack�decode�r, Zspn_len�spnZ realm_len�realmr r r �_parse_auth_data� s z(MySQLKerberosAuthPlugin._parse_auth_data�r! r" r c K s� d}d}|rb|� dd�sbz| �|�\}}W n6 tjy` } z td|� ��|�W Y d}~n d}~0 0 |du rx| j�� d S | jr�| j� d|� �nd}t� d|� t� d|� z�t j d d �}t |j �}t� d � t� d |� |�d�d kr�|�dd�\} } n|} d} | j�r| j� d|� �n|}| j�rP| j| k�rPt� d� | jdu�rP| �|�}| �rv| |k�rv| jdu�rv| �|�}W n� t jjj�y� } z:|�r�| jdu�r�| �|�}ntd|� ��|�W Y d}~nbd}~0 t jjj�y* } z:|�r| jdu�r| �|�}ntd|� ��|�W Y d}~n d}~0 0 t jjt jjt jjf} t j|t j j d�} | � t j j �} t j!| |t"| �d d�| _#z| j#�$� }W n< t jjj�y� } z td|� ��|�W Y d}~n d}~0 0 t� d|� |S )z(Prepare the first message to the server.Nr# T� Invalid authentication data: � r< �Service Principal: %s� Realm: %sr9 r: zCached credentials foundzCached credentials UPN: %sr= r zBThe user from cached credentials doesn't match with the given userzCredentials has expired: z-Unable to retrieve cached credentials error: )Z name_type)r rG �flagsr; �%Unable to initiate security context: �Initial client token: %s)%rO rk re �error�InterruptedErrorrZ rR � _usernamer r% r> r? r6 r r@ rA r_ rB � exceptionsZExpiredCredentialsErrorr rC rD ZRequirementFlagZmutual_authenticationZextended_errorZdelegate_to_peerrX rY Zkerberos_principal� canonicalizer[ r\ �SecurityContext�sumr8 �step)r r! r" ri rj r^ rU rG Z creds_upnZ creds_userZ creds_realmrq r �cname�initial_client_tokenr r r r& sr & � $ ��� �& z%MySQLKerberosAuthPlugin.auth_responser c C s@ t �d|� | j�|�}t �d|� t �d| jj� || jjfS )r �tgt_auth challenge: %szContext step response: %s�Context completed?: %s)r r% r8 r{ r- )r r �respr r r r d s z%MySQLKerberosAuthPlugin.auth_continue)�messager c C s� | j jstd��t�d|� t�d| j j� z | j �|�}t�d|� W nF tjj j y� } z(t�d|� t d|� ��|�W Y d}~n d}~0 0 t�d|� t d �}t�d |� | j j |d d �}t�d |d t|d �� |jS )a_ Accept handshake and generate closing handshake message for server. This method verifies the server authenticity from the given message and included signature and generates the closing handshake for the server. When this method is invoked the security context is already established and the client and server can send GSSAPI formated secure messages. To finish the authentication handshake the server sends a message with the security layer availability and the maximum buffer size. Since the connector only uses the GSSAPI authentication mechanism to authenticate the user with the server, the server will verify clients message signature and terminate the GSSAPI authentication and send two messages; an authentication acceptance b' ' and a OK packet (that must be received after sent the returned message from this method). Args: message: a wrapped gssapi message from the server. Returns: bytearray (closing handshake message to be send to the server). z!Security context is not completedzServer message: %szGSSAPI flags in use: %sz Unwraped: %sz#Unable to unwrap server message: %sz!Unable to unwrap server message: Nz Unwrapped server message: %ss zMessage response: %sF)Zencryptz(Wrapped message response: %s, length: %dr )r8 r- r r r% Z actual_flags�unwrapr> rB rw Z BadMICErrorr � bytearray�wrapr' r� )r r� Zunwrapedr^ r+ Zwrapedr r r �auth_accept_close_handshake~ s( & �z3MySQLKerberosAuthPlugin.auth_accept_close_handshake)N)r1 r2 r3 r4 r8 r r> ry �__annotations__� staticmethodr6 rJ �dictrT rB rG ZCredsr_ r* r rk r r& r7 r r� r r r r r � s$ �� Q� c @ s� e Zd ZU dZdZeed< dZeed< ee e e e f d�dd��Z de e ee e d�d d �Ze e e e e ef d �d d �ZdS )r zDImplement the MySQL Kerberos authentication plugin with Windows SSPINr8 � clientauthr` c C s� t �d| dd� �d }| dd� } t �d|� d�| d|� �d }| |d� } t �d| dd� �d }t �d|� d�| dd� �d }|�� |�� fS ra rd rh r r r rk � s z,MySQLSSPIKerberosAuthPlugin._parse_auth_datarl c K s� t �d� d}d}|rl|�dd�slz| �|�\}}W n6 tjyj } z td|� ��|�W Y d}~n d}~0 0 t �d|� t �d|� tdu s�tdu r�t d��tj tj f}| j r�| j r�| j || j f}nd}|}t �d |� t �d |du � tjd ||t|�tjd �| _zZd} | j�| �\}} t �d |� t �d| � t �d| jj� | d j} t �d| jj� W n6 t�y� } z td|� ��|�W Y d}~n d}~0 0 t �d| � | S )z�Prepare the first message to the server. Args: kwargs: ignore_auth_data (bool): if True, the provided auth data is ignored. zauth_response for sspiNr# Trm ro rp zKPackage "pywin32" (Python for Win32 (pywin32) extensions) is not installed.z targetspn: %sz_auth_info is None: %sZ Negotiate)� targetspnZ auth_infoZscflagsZdatarep�Context step err: %s�Context step out_buf: %sr r z pkg_info: %srr rs )r r% rO rk re rt ru �sspicon�sspir ZISC_REQ_MUTUAL_AUTHZISC_REQ_DELEGATErv rZ Z ClientAuthrz ZSECURITY_NETWORK_DREPr� � authorize� authenticated�Buffer�pkg_info� Exceptionr ) r r! r" ri rj r^ rq Z _auth_infor� �data�out_bufr} r r r r& � sP & � � & z)MySQLSSPIKerberosAuthPlugin.auth_responser c C sf t �d|� | j�|�\}}t �d|� t �d|� |d j}t �d|� t �d| jj� || jjfS )r r~ r� r� r zContext step resp: %sr )r r% r� r� r� r� )r r r^ r� r� r r r r % s z)MySQLSSPIKerberosAuthPlugin.auth_continue)N)r1 r2 r3 r4 r8 r r� r� r� r* r r6 rk r r& r7 r r r r r r � s �� Q�) r4 rE rM re �abcr �pathlibr �typingr r r r Zauthenticationr �errorsr r r �networkr r> � ImportErrorr r� r� � r ZAUTHENTICATION_PLUGIN_CLASSr r r r r r r �<module> sF �� �g
| ver. 1.6 |
Github
|
.
| PHP 8.2.30 | ??????????? ?????????: 0 |
proxy
|
phpinfo
|
???????????