o
    j&                     @   s   d dl Z d dlmZ d dlmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZmZmZmZ d d
lmZ d dlmZ d dlmZmZ d dlmZ d dlmZm Z  G dd dZ!dS )    N)logger)ISC_REQ)KerberosCredential)
get_gssapiKRB5_MECH_INDEP_TOKEN)r   )KerberosSPN)GSSAPIFlags)AP_REPEncAPRepPartTicketEncryptedData)MESSAGE_TYPE)construct_apreq_from_ticket)Key_enctype_table)AIOKerberosClient)KerberosErrorKerberosErrorCodec                   @   s   e Zd ZdefddZdd Zdd Zdd	 Zd dede	fddZ
dede	fddZdede	fddZdd ZdefddZd!dedede	dedef
ddZdS )"KerberosClientNative
credentialc                 C   sT   || _ | j  | _d | _d | _d | _d| _d| _d| _t	j
t	jB t	jB t	jB | _d S )Nr   F)r   to_ccredccredkcsession_keygssapi
iterations
seq_numberfrom_ccacher   GSS_C_CONF_FLAGGSS_C_INTEG_FLAGGSS_C_REPLAY_FLAGGSS_C_SEQUENCE_FLAGflags)selfr    r$   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/kerberos/client/native.py__init__   s    zKerberosClientNative.__init__c                 C   s   | j S )z
		Returns the initial sequence number. It is 0 by default, but can be adjusted during authentication, 
		by passing the 'seq_number' parameter in the 'authenticate' function
		)r   r#   r$   r$   r%   get_seq_number'   s   z#KerberosClientNative.get_seq_numberc                 C      t j| jv S )z3
		Checks if integrity protection was negotiated
		)r   r   r"   r'   r$   r$   r%   signing_needed.      z#KerberosClientNative.signing_neededc                 C   r)   )z3
		Checks if confidentiality flag was negotiated
		)r   r   r"   r'   r$   r$   r%   encryption_needed4   r+   z&KerberosClientNative.encryption_neededinitdata
message_noc                    s   | j j|||dS )z
		Signs a message. 
		)	direction)r   
GSS_GetMIC)r#   r.   r/   r0   r$   r$   r%   sign:   s   zKerberosClientNative.signc                    s*   | j j||g|R i |\}}||fS )z
		Encrypts a message. 
		)r   GSS_Wrap)r#   r.   r/   argskwargseeeer$   r$   r%   encrypt@   s    zKerberosClientNative.encryptc                    s   | j j||g|R i |S )z9
		Decrypts message. Also performs integrity checking.
		)r   
GSS_Unwrap)r#   r.   r/   r4   r5   r$   r$   r%   decryptG   s   zKerberosClientNative.decryptc                 C   s   | j jS N)r   contentsr'   r$   r$   r%   get_session_keyN   s   z$KerberosClientNative.get_session_keyr"   c                 C   s   |d u r| j S tjtjB tjB tjB }tj|v r|tjO }n|tj M }tj|v r/|tjO }n|tj M }tj	|v r@|tjO }n|tj M }tj
|v rQ|tjO }n|tj M }tj|v rb|tjO }n|tj M }tj|v rt|tjO }|S |tj M }|S r:   )r"   r   r   r   r    r!   r   	INTEGRITYCONFIDENTIALITYREPLAY_DETECTSEQUENCE_DETECTUSE_DCE_STYLEGSS_C_DCE_STYLEMUTUAL_AUTHGSS_C_MUTUAL_FLAG)r#   r"   kflagsr$   r$   r%   iscreq_to_gssapiflagsQ   s:   






z*KerberosClientNative.iscreq_to_gssapiflagsNr   authDatar   cb_dataspnc                    s  z|  || _td| j  |du rtdt|}td|  | jdu r3t| j	| j
j| _| jdkrd| _|  jd7  _z)| j	j D ]	}td|  qJ| j|\}}	| _}
|
rc|
td d	| _W n   z| jj| j
jd
I dH }W nh ty } zO|jtjkr| jjj| jj
j| jj
jd}t| j	|}||j| j
j I dH \}}}}| | _| j|I dH \}}	| _n	td|  |W Y d}~nd}~w ty } z|d}~ww | j
jdur| j| j
j | j
j I dH \}}}}| | _| j
j |_| j|I dH \}}	| _Y td|  td|	  td| j  g }t!j"| jv s@t!j#| jv rt!j"| jv rL|$d | jdu rc| jj%||	| j| j| j||d}nt&t'|d ( | j|d |d d d | j| j||d}td|  |d	dfW S | jdu r| jj%||	| j| j| j||d}nt&t'|d ( | j|d |d d d | j| j||d}td|  t)| j| _*|ddfW S || _td|+   zt,-|}t./|j0dd j1}W n ty } zt./|j1}W Y d}~nd}~ww td|  t2t3|d d   }|d d }|4| jd|}t5/|j1}t2t3|d d    }t6j67t6j8j9}i }|j:|d!< |j;dd"|d#< |d$ |d$< td%|  |<| jdt5|( d}t=|j>|d d& | _td'| j  i }d(|d)< t?j@jA|d*< tB| jj>|d+|d< td|  t.|( }t!j#| jv rtC| j| _*nt)| j| _*|  jd7  _|d	dfW S  ty } zdd|fW  Y d}~S d}~ww ),za
		This function is called (multiple times depending on the flags) to perform authentication. 
		z	Flags: %sNzSPN is needed for kerberos!zSPN: %sr      zCCACHE SPN record: %szGot TGS from CCACHE!T)override_etype)dc_ipdomainzFailed to get TGT! %szTGS: %szencpart: %szsession_key: %szmutual-requiredF)r"   r   ap_optsrH   ticketcrealmcnamezname-stringzAPREQ constructed: %szProcessing AP_REP %s   z
AP_REP: %szenc-partetypecipher   subkeykeytypecusec)microsecondctimez
seq-numberzapreppart_data: %skeyvaluezSessionKey: %s   pvnozmsg-type)rS   rT   )DrF   r"   r   debug	Exceptionr   from_spnr   r   r   r   targetr   r   ccachelist_targetstgs_from_ccacher   r   get_TGTetypesr   	errorcoder   KDC_ERR_WRONG_REALMget_kerberos_targetrM   get_referral_ticketget_ip_or_hostname
get_clientget_TGScross_targetcross_realmr   rD   rB   appendconstruct_apreqr   r   dumpr   r   hexr   
from_bytesr	   loadr.   nativer   intr9   r
   datetimenowtimezoneutcrY   replacer7   r   enctyper   
KRB_AP_REPvaluer   
gssapi_smb)r#   rG   r"   r   rH   rI   r5   ra   tgsencparterrtgte	newtargetnewkcref_tgsref_encpartref_keynew_factoryrN   apreqtempapreprT   cipher_textenc_partry   apreppart_dataapreppart_data_encap_reptokenr$   r$   r%   authenticates   s  



$
(



	

z!KerberosClientNative.authenticate)r-   )Nr   NN)__name__
__module____qualname__r   r&   r(   r*   r,   bytesrw   r2   r7   r9   r<   r   rF   strr   r$   r$   r$   r%   r      s    $"r   )"rx   asyauth.protocols.kerberosr   asyauth.common.winapi.constantsr   #asyauth.common.credentials.kerberosr   !asyauth.protocols.kerberos.gssapir   r   $asyauth.protocols.kerberos.gssapismbr   minikerberos.common.spnr   minikerberos.gssapi.gssapir   "minikerberos.protocol.asn1_structsr	   r
   r   r   minikerberos.protocol.constantsr   !minikerberos.protocol.ticketutilsr    minikerberos.protocol.encryptionr   r   minikerberos.aioclientr   minikerberos.protocol.errorsr   r   r   r$   r$   r$   r%   <module>   s   