
    7g_                     x   d Z ddlZddlmZ ddlmZmZmZmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZ  edd	          \  ZZZZZ ed
d          \  ZZd  edd	          D             \  ZZZZZd  ed
d          D             \  ZZ G d d          Z  G d de           Z! G d d          Z" G d d          Z#dS )a  
This module provides GSS-API / SSPI Key Exchange as defined in :rfc:`4462`.

.. note:: Credential delegation is not supported in server mode.

.. note::
    `RFC 4462 Section 2.2
    <https://tools.ietf.org/html/rfc4462.html#section-2.2>`_ says we are not
    required to implement GSS-API error messages. Thus, in many methods within
    this module, if an error occurs an exception will be thrown and the
    connection will be terminated.

.. seealso:: :doc:`/api/ssh_gss`

.. versionadded:: 1.15
    N)sha1)DEBUGmax_byte	zero_bytebyte_chr	byte_maskbyte_ord)util)Message)SSHException   #   (   *   c                 ,    g | ]}t          |          S  r   .0cs     J/var/www/html/syslog/venv/lib/python3.11/site-packages/paramiko/kex_gss.py
<listcomp>r   F   s    (((QXa[[(((    c                 ,    g | ]}t          |          S r   r   r   s     r   r   r   G   s+     / / /HQKK/ / /r   c                       e Zd ZdZdZdZ ed          edz  z   Ze	dz  Z
dZd Zd	 Zd
 Zd Zd Zd Zd Zd Zd ZdS )KexGSSGroup1z
    GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange as defined in `RFC
    4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    lE   8{3If?E yZ3V58noPe?a-tBLy3W[<p6m5P&aF!33*w& ARM;L}.c|&A@h\&&#-Dvd             z(gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==c                 n    || _         | j         j        | _        d | _        d| _        d| _        d| _        d S )Nr   )	transportkexgss_ctxtkexgssgss_hostxefselfr"   s     r   __init__zKexGSSGroup1.__init__Y   s5    "n0r   c                    |                                   | j        j        rFt          | j        | j        | j                  | _        | j                            t                     dS t          | j        | j        | j                  | _
        | j        j        | _        t                      }|                    t                     |                    | j                            | j                             |                    | j
                   | j                            |           | j                            t(          t*          t,          t.                     dS )zU
        Start the GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange.
        Ntarget)_generate_xr"   server_modepowGr&   Pr(   _expect_packetMSG_KEXGSS_INITr'   r%   r   add_bytec_MSG_KEXGSS_INIT
add_stringr$   ssh_init_sec_context	add_mpint_send_messageMSG_KEXGSS_HOSTKEYMSG_KEXGSS_CONTINUEMSG_KEXGSS_COMPLETEMSG_KEXGSS_ERRORr*   ms     r   	start_kexzKexGSSGroup1.start_kexa   s    	>% 	00DFN))/:::FTVTVTV,,/II	

$%%%	T[55T]5KKLLL	DF$$Q'''%%		
 	
 	
 	
 	
r   c                    | j         j        r |t          k    r|                     |          S | j         j        s |t          k    r|                     |          S | j         j        r |t          k    r|                     |          S | j         j        s |t          k    r| 	                    |          S |t          k    r|                     |          S d}t          |                    |                    )
        Parse the next packet.

        :param ptype: The (string) type of the incoming packet
        :param `.Message` m: The packet content
        z.GSS KexGroup1 asked to handle packet type {:d})r"   r0   r5   _parse_kexgss_initr<   _parse_kexgss_hostkeyr=   _parse_kexgss_continuer>   _parse_kexgss_completer?   _parse_kexgss_errorr   formatr*   ptyperA   msgs       r   
parse_nextzKexGSSGroup1.parse_next{   s     >% 		/5O+C+C**1---+ 	/:L1L1L--a000^' 	/U6I-I-I..q111+ 	/:M1M1M..q111&&&++A...>3::e,,---r   c                     	 t          j        d          }t          |d         d          |dd         z   }|dd         }|| j        | j        fvrnQt          j        |          | _        dS )ap  
        generate an "x" (1 < x < q), where q is (p-1)/2.
        p is a 128-byte (1024-bit) number, where the first 64 bits are 1.
        therefore q can be approximated as a 2^1023.  we drop the subset of
        potential x where the first 63 bits are 1, because some of those will
        be larger than q (but this is a tiny tiny subset of potential x).
              r   r   Nr    )osurandomr   b7fffffffffffffffb0000000000000000r
   inflate_longr&   )r*   x_bytesfirsts      r   r/   zKexGSSGroup1._generate_x   sw    	jooG
D11GABBK?GBQBKET3T5KLLL	 "7++r   c                     |                                 }|| j        _        |                                 }| j                            ||           | j                            t
          t                     dS )z
        Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
        N
get_stringr"   host_key_verify_keyr4   r=   r>   r*   rA   r\   sigs       r   rF   z"KexGSSGroup1._parse_kexgss_hostkey   `     <<>>"*llnn""8S111%%&9;NOOOOOr   c                    | j         j        s|                                }t                      }|                    t
                     |                    | j                            | j	        |                     | j         
                    |           | j                             t          t          t                     dS dS )z
        Parse the SSH2_MSG_KEXGSS_CONTINUE message.

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE
            message
        r.   
recv_tokenNr"   r0   r[   r   r6   c_MSG_KEXGSS_CONTINUEr8   r$   r9   r%   send_messager4   r=   r>   r?   r*   rA   	srv_tokens      r   rG   z#KexGSSGroup1._parse_kexgss_continue   s     ~) 	I		AJJ,---LL00=Y 1    
 N''***N))#%8:J     Dr   c                    | j         j        t                      | j         _        |                                | _        | j        dk     s| j        | j        dz
  k    rt          d          |                                }|                                }d}|r|                                }t          | j        | j
        | j                  }t                      }|                    | j         j        | j         j        | j         j        | j         j                   |                    | j         j                                                   |                    | j                   |                    | j                   |                    |           t+          t-          |                                                    }| j                             ||           |=| j                            | j        |           | j                            ||           n| j                            ||           d| j         _        | j                                          dS )z
        Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

        :param `.Message` m: The content of the
            SSH2_MSG_KEXGSS_COMPLETE message
        NrP   Server kex "f" is out of rangerb   T)r"   r\   NullHostKey	get_mpintr(   r3   r   r[   get_booleanr1   r&   r   addlocal_versionremote_versionlocal_kex_initremote_kex_initr8   __str__r:   r'   r   strdigest_set_K_Hr$   r9   r%   ssh_check_micgss_kex_used_activate_outboundr*   rA   	mic_tokenboolrh   KhmHs           r   rH   z#KexGSSGroup1._parse_kexgss_complete   s    >"*&1mmDN#FQJJDFTVaZ//?@@@LLNN	}}	 	'I'' YY
N(N)N)N*		
 	
 	
 	dn-5577888
TV
TV
QRMM  ""1%%% K,,} -    K%%i3333K%%i333&*#))+++++r   c                    |                                 }|                                | _        | j        dk     s| j        | j        dz
  k    rt	          d          t          | j        | j        | j                  }t                      | j        _	        | j        j	        
                                }t                      }|                    | j        j        | j        j        | j        j        | j        j                   |                    |           |                    | j                   |                    | j                   |                    |           t)          |                                                                          }| j                            ||           | j                            | j        |          }t                      }| j        j        r| j                            | j        j        d          }|                    t>                     |                    | j                   |                    |           |+|                     d           |                    |           n|                     d           | j        !                    |           d| j        _"        | j        #                                 dS |                    tH                     |                    |           | j        !                    |           | j        %                    tL          tN          tP                     dS )z
        Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
        rP   Client kex "e" is out of rangeTgss_kexNF))r[   rl   r'   r3   r   r1   r&   rk   r"   r\   rs   r   rn   rp   ro   rr   rq   r8   r:   r(   r   asbytesru   rv   r$   ssh_accept_sec_contextr%   _gss_srv_ctxt_statusssh_get_mic
session_idr6   c_MSG_KEXGSS_COMPLETEadd_booleanr;   rx   ry   re   r4   r=   r>   r?   	r*   rA   client_tokenr}   keyr~   r   rh   r{   s	            r   rE   zKexGSSGroup1._parse_kexgss_init   s    ||~~FQJJDFTVaZ//?@@@''"---n%--// YY
N)N(N*N)		
 	
 	
 	c
TV
TV
Q%%''1%%%K66M<
 
	 II;+ 	//)4 0  I JJ,---KKLL###$d###Y''''e$$$N((+++*.DN'N--/////JJ,---LL###N((+++N))#%8:J    r   c                     |                                 }|                                 }|                                }|                                 t          d                    |||                    )a  
        Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
        The server may send a GSS-API error message. if it does, we display
        the error by throwing an exception (client mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_ERROR message
        :raise SSHException: Contains GSS-API major and minor status as well as
                             the error message and the language tag of the
                             message
        CGSS-API Error:
Major Status: {}
Minor Status: {}
Error Message: {}
get_intr[   r   rJ   r*   rA   
maj_status
min_statuserr_msgs        r   rI   z KexGSSGroup1._parse_kexgss_error*  g     YY[[
YY[[
,,..	 FJ 
 
 	
r   N)__name__
__module____qualname____doc__r3   r2   r   r   rT   r   rU   NAMEr+   rB   rN   r/   rF   rG   rH   rE   rI   r   r   r   r   r   L   s          	KA	A A5!A5D  
 
 
4. . .,, , , P P P  .+, +, +,Z6 6 6p
 
 
 
 
r   r   c                       e Zd ZdZdZdZdZdS )KexGSSGroup14z
    GSS-API / SSPI Authenticated Diffie-Hellman Group14 Key Exchange as defined
    in `RFC 4462 Section 2
    <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    l   &UG9
tcb0]Q\-:$90.`U_b;YS7x]Ek`:xds!,w<G8qbdR_hddY6KpRT{UjK#Gt|L4S8 FYpw,(.> =HG2Cdc_.K?&j_c}z[\V_1M.D^/1v5I	jV&|/mVlR<6#{n4(EY91T:g8	H	Apcb4BBj~H r   z)gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==N)r   r   r   r   r3   r2   r   r   r   r   r   r   D  s*          	KA	A6DDDr   r   c                   d    e Zd ZdZdZdZdZdZd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd ZdS )	KexGSSGexz
    GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange as defined in
    `RFC 4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    z%gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==       i   c                     || _         | j         j        | _        d | _        d | _        d | _        d | _        d | _        d | _        d | _	        d| _
        d S )NF)r"   r#   r$   r%   pqgr&   r'   r(   	old_styler)   s     r   r+   zKexGSSGex.__init__[  sQ    "n0r   c                    | j         j        r!| j                             t                     dS | j         j        | _        t                      }|                    t                     |                    | j	                   |                    | j
                   |                    | j                   | j                             |           | j                             t                     dS )zV
        Start the GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange
        N)r"   r0   r4   MSG_KEXGSS_GROUPREQr%   r   r6   c_MSG_KEXGSS_GROUPREQadd_intmin_bitspreferred_bitsmax_bitsr;   MSG_KEXGSS_GROUPr@   s     r   rB   zKexGSSGex.start_kexg  s     >% 	N))*=>>>F /II	

()))			$-   			$%&&&			$-   $$Q'''%%&677777r   c                 
   |t           k    r|                     |          S |t          k    r|                     |          S |t          k    r|                     |          S |t          k    r|                     |          S |t          k    r| 	                    |          S |t          k    r|                     |          S |t          k    r|                     |          S d}t          |                    |                    )rD   z'KexGex asked to handle packet type {:d})r   _parse_kexgss_groupreqr   _parse_kexgss_groupr5   _parse_kexgss_gex_initr<   rF   r=   rG   r>   rH   r?   rI   r   rJ   rK   s       r   rN   zKexGSSGex.parse_nextz  s    '''..q111&&&++A...o%%..q111(((--a000)))..q111)))..q111&&&++A...73::e,,---r   c                 ~   | j         dz
  dz  }t          j        |d          }t          |d                   }t	          |          }d}|dz  s|dz  }|dz  }|dz  	 t          j        |          }t          |d         |          |dd          z   }t          j        |d          }|dk    r||k     rnX|| _	        d S )NrP   r   r      rQ   )
r   r
   deflate_longr	   lenrR   rS   r   rV   r&   )r*   r   qnormqhbyte
byte_countqmaskrW   r&   s           r   r/   zKexGSSGex._generate_x  s    VaZA!!Q''%(##ZZ
D= 	qLFaKE D= 		j,,G
E22WQRR[@G!'1--AAAEE	 r   c                 @   |                                 }|                                 }|                                 }|| j        k    r| j        }|| j        k     r| j        }||k    r|}||k     r|}|| _        || _        || _        | j                                        }|t          d          | j                            t          d	                    |||                     |
                    |||          \  | _        | _        t                      }|                    t                     |                    | j                   |                    | j                   | j                            |           | j                            t&                     dS )z
        Parse the SSH2_MSG_KEXGSS_GROUPREQ message (server mode).

        :param `.Message` m: The content of the
            SSH2_MSG_KEXGSS_GROUPREQ message
        Nz-Can't do server-side gex with no modulus packzPicking p ({} <= {} <= {} bits))r   r   r   r   r"   _get_modulus_packr   _logr   rJ   get_modulusr   r   r   r6   c_MSG_KEXGSS_GROUPr:   r;   r4   r5   )r*   rA   minbitspreferredbitsmaxbitspacks         r   r   z KexGSSGex._parse_kexgss_groupreq  s    ))++		))++4=(( MM4=(( MM ]""#G]""#G+~//11<NOOO-44 	
 	
 	
 ))'='JJII	

%&&&	DF	DF$$Q'''%%o66666r   c                 P   |                                 | _        |                                 | _        t          j        | j                  }|dk     s|dk    r"t          d                    |                    | j                            t          d                    |                     | 
                                 t          | j        | j        | j                  | _        t                      }|                    t                      |                    | j                            | j                             |                    | j                   | j                            |           | j                            t0          t2          t4          t6                     dS )z
        Parse the SSH2_MSG_KEXGSS_GROUP message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_GROUP message
        r   r   z<Server-generated gex p (don't ask) is out of range ({} bits)zGot server p ({} bits)r-   N)rl   r   r   r
   
bit_lengthr   rJ   r"   r   r   r/   r1   r&   r'   r   r6   r7   r8   r$   r9   r%   r:   r;   r4   r<   r=   r>   r?   )r*   rA   bitlens      r   r   zKexGSSGex._parse_kexgss_group  s`    ((TMMv}}"F6NN   	+226::	
 	
 	
 	TVTVTV,,II	

$%%%	T[55T]5KKLLL	DF$$Q'''%%		
 	
 	
 	
 	
r   c                    |                                 }|                                | _        | j        dk     s| j        | j        dz
  k    rt	          d          |                                  t          | j        | j        | j                  | _	        t          | j        | j        | j                  }t                      | j        _        | j        j                                        }t                      }|                    | j        j        | j        j        | j        j        | j        j        |           |                    | j                   |                    | j                   |                    | j                   |                    | j                   |                    | j                   |                    | j                   |                    | j	                   |                    |           t3          |                                                                          }| j                            ||           | j                            | j        |          }t                      }| j        j         r| j        !                    | j        j"        d          }|#                    tH                     |                    | j	                   |%                    |           |+|&                    d           |%                    |           n|&                    d           | j        '                    |           d| j        _(        | j        )                                 dS |#                    tT                     |%                    |           | j        '                    |           | j        +                    tX          tZ          t\                     dS )z
        Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
        rP   r   Tr   NF)/r[   rl   r'   r   r   r/   r1   r   r&   r(   rk   r"   r\   rs   r   rn   rp   ro   rr   rq   r   r   r   r   r:   r   r   ru   rv   r$   r   r%   r   r   r   r6   r   r8   r   r;   rx   ry   re   r4   r=   r>   r?   r   s	            r   r   z KexGSSGex._parse_kexgss_gex_init  sE    ||~~FQJJDFTVaZ//?@@@TVTVTV,,''"---n%--// YY
N)N(N*N)	
 	
 	
 	

4=!!!


4&'''


4=!!!
TV
TV
TV
TV
Q%%''1%%%K66M<
 
	 II;+ 	//)4 0  I JJ,---KKLL###$d###Y''''e$$$N((+++*.DN'N--/////JJ,---LL###N((+++N))#%8:J    r   c                     |                                 }|| j        _        |                                 }| j                            ||           | j                            t
          t                     dS )z
        Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
        NrZ   r^   s       r   rF   zKexGSSGex._parse_kexgss_hostkey1  r`   r   c                    | j         j        s|                                }t                      }|                    t
                     |                    | j                            | j	        |                     | j         
                    |           | j                             t          t          t                     dS dS )z
        Parse the SSH2_MSG_KEXGSS_CONTINUE message.

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE message
        rb   Nrd   rg   s      r   rG   z KexGSSGex._parse_kexgss_continue>  s     ~) 	I		AJJ,---LL00=Y 1    
 N''***N))#%8:J     Dr   c                    | j         j        t                      | j         _        |                                | _        |                                }|                                }d}|r|                                }| j        dk     s| j        | j        dz
  k    rt          d          t          | j        | j
        | j                  }t                      }|                    | j         j        | j         j        | j         j        | j         j        | j         j                                                   | j        s|                    | j                   |                    | j                   | j        s|                    | j                   |                    | j                   |                    | j                   |                    | j                   |                    | j                   |                    |           t5          |                                                                          }| j                             ||           |=| j                            | j         |           | j        !                    ||           n| j        !                    ||           d| j         _"        | j         #                                 dS )z
        Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_COMPLETE message
        NrP   rj   rb   T)$r"   r\   rk   rl   r(   r[   rm   r   r   r1   r&   r   rn   ro   rp   rq   rr   rs   r   r   r   r   r   r:   r   r'   r   r   ru   rv   r$   r9   r%   rw   rx   ry   rz   s           r   rH   z KexGSSGex._parse_kexgss_completeT  sh    >"*&1mmDN#LLNN	}}	 	'IFQJJDFTVaZ//?@@@'' YY
N(N)N)N*N#++--	
 	
 	
 ~ 	&JJt}%%%


4&'''~ 	&JJt}%%%
TV
TV
TV
TV
Q%%''1%%% K,,} -    K%%i3333K%%i333&*#))+++++r   c                     |                                 }|                                 }|                                }|                                 t          d                    |||                    )a  
        Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
        The server may send a GSS-API error message. if it does, we display
        the error by throwing an exception (client mode).

        :param `Message` m:  The content of the SSH2_MSG_KEXGSS_ERROR message
        :raise SSHException: Contains GSS-API major and minor status as well as
                             the error message and the language tag of the
                             message
        r   r   r   s        r   rI   zKexGSSGex._parse_kexgss_error  r   r   N)r   r   r   r   r   r   r   r   r+   rB   rN   r/   r   r   r   rF   rG   rH   rI   r   r   r   r   r   P  s         
 3DHHN
 
 
8 8 8&. . .4  $*7 *7 *7X
 
 
B< < <|P P P  ,0, 0, 0,d
 
 
 
 
r   r   c                   $    e Zd ZdZd Zd Zd ZdS )rk   z
    This class represents the Null Host Key for GSS-API Key Exchange as defined
    in `RFC 4462 Section 5
    <https://tools.ietf.org/html/rfc4462.html#section-5>`_
    c                     d| _         d S )N r   r*   s    r   r+   zNullHostKey.__init__  s    r   c                     | j         S Nr   r   s    r   rs   zNullHostKey.__str__  	    xr   c                     | j         S r   r   r   s    r   get_namezNullHostKey.get_name  r   r   N)r   r   r   r   r+   rs   r   r   r   r   rk   rk     sK                 r   rk   )$r   rR   hashlibr   paramiko.commonr   r   r   r   r   r	   paramikor
   paramiko.messager   paramiko.ssh_exceptionr   ranger5   r=   r>   r<   r?   r   r   r7   re   r   c_MSG_KEXGSS_HOSTKEYc_MSG_KEXGSS_ERRORr   r   r   r   r   rk   r   r   r   <module>r      s  . " 
			                            $ $ $ $ $ $ / / / / / / 
E"bMM*/%B-- '& )(%%B--(((/ /r2/ / / +*
u
 u
 u
 u
 u
 u
 u
 u
p	7 	7 	7 	7 	7L 	7 	7 	7M
 M
 M
 M
 M
 M
 M
 M
`
         r   