HEX
Server: Apache
System: Linux beluga.o2switch.net 4.18.0-553.123.2.lve.el8.x86_64 #1 SMP Thu May 7 23:17:13 UTC 2026 x86_64
User: sc3naki1272 (1113)
PHP: 8.3.33
Disabled: NONE
$ pwd: /opt/alt/python27/lib/python2.7/site-packages/paramiko/
Upload Files
File: //opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyo
�
��"Wc@s�dZddlZddlZddlZeZy*ddlmZddlm	Z	m
Z
WnYek
r�eZde
fd��YZde
fd��YZ
d	e
fd
��YZ	nXddlmZddlmZd
ZyddlZWnYeefk
rGy"ddlZddlZdZWqHek
rCeZdZqHXnXed�Zde
fd��YZdefd��YZdefd��YZdS(s�
This module provides GSS-API / SSPI  authentication as defined in :rfc:`4462`.

.. note:: Credential delegation is not supported in server mode.

.. seealso:: :doc:`/api/kex_gss`

.. versionadded:: 1.15
i����N(tObjectIdentifier(tencodertdecoderRcBseZd�ZRS(cGstd��dS(NsModule pyasn1 not importable(tNotImplementedError(tselftargs((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyt__init__0s(t__name__t
__module__R(((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR/sRcBseZd�ZRS(cCstd��dS(NsModule pyasn1 not importable(R(R((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytdecode4s(RRR	(((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR3sRcBseZd�ZRS(cCstd��dS(NsModule pyasn1 not importable(R(R((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytencode8s(RRR
(((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR7s(tMSG_USERAUTH_REQUEST(tSSHExceptiontMITtSSPIcCsQtdkrt||�StdkrAtjdkrAt||�Std��dS(s�
    Provide SSH2 GSS-API / SSPI authentication.

    :param str auth_method: The name of the SSH authentication mechanism
                            (gssapi-with-mic or gss-keyex)
    :param bool gss_deleg_creds: Delegate client credentials or not.
                                 We delegate credentials by default.
    :return: Either an `._SSH_GSSAPI` (Unix) object or an
             `_SSH_SSPI` (Windows) object
    :rtype: Object

    :raise ImportError: If no GSS-API / SSPI module could be imported.

    :see: `RFC 4462 <http://www.ietf.org/rfc/rfc4462.txt>`_
    :note: Check for the available API and return either an `._SSH_GSSAPI`
           (MIT GSSAPI) object or an `._SSH_SSPI` (MS SSPI) object. If you
           get python-gssapi working on Windows, python-gssapi
           will be used and a `._SSH_GSSAPI` object will be returned.
           If there is no supported API available,
           ``None`` will be returned.
    R
Rtnts)Unable to import a GSS-API / SSPI module!N(t_APIt_SSH_GSSAPItostnamet	_SSH_SSPItImportError(tauth_methodtgss_deleg_creds((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytGSSAuthOs


t_SSH_GSSAuthcBsPeZdZd�Zd�Zd�Zdd�Zd�Zd�Zd�Z	RS(	s[
    Contains the shared variables and methods of `._SSH_GSSAPI` and
    `._SSH_SSPI`.
    cCsp||_||_d|_d|_d|_d|_d|_d|_t	|_
d|_t	|_d|_
dS(s�
        :param str auth_method: The name of the SSH authentication mechanism
                                (gssapi-with-mic or gss-keyex)
        :param bool gss_deleg_creds: Delegate client credentials or not
        sssh-connections1.2.840.113554.1.2.2N(t_auth_methodt_gss_deleg_credstNonet	_gss_hostt	_usernamet_session_idt_servicet
_krb5_mecht	_gss_ctxttFalset_gss_ctxt_statust
_gss_srv_ctxtt_gss_srv_ctxt_statustcc_file(RRR((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyRrs											cCs|jd�r||_ndS(s
        This is just a setter to use a non default service.
        I added this method, because RFC 4462 doesn't specify "ssh-connection"
        as the only service value.

        :param str service: The desired SSH service
        :rtype: Void
        sssh-N(tfindR (Rtservice((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytset_service�s	cCs
||_dS(s�
        Setter for C{username}. If GSS-API Key Exchange is performed, the
        username is not set by C{ssh_init_sec_context}.

        :param str username: The name of the user who attempts to login
        :rtype: Void
        N(R(Rtusername((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytset_username�stclientcCs\|jd�}tjt|j��}|jt|��}|dkrP||S|||S(s�
        This method returns a single OID, because we only support the
        Kerberos V5 mechanism.

        :param str mode: Client for client mode and server for server mode
        :return: A byte sequence containing the number of supported
                 OIDs, the length of the OID and the actual OID encoded with
                 DER
        :rtype: Bytes
        :note: In server mode we just return the OID length and the DER encoded
               OID.
        itserver(t_make_uint32RR
RR!tlen(RtmodetOIDstkrb5_OIDtOID_len((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytssh_gss_oids�s
cCs2tj|�\}}|j�|jkr.tStS(s
        Check if the given OID is the Kerberos V5 OID (server mode).

        :param str desired_mech: The desired GSS-API mechanism of the client
        :return: ``True`` if the given OID is supported, otherwise C{False}
        :rtype: Boolean
        (RR	t__str__R!R#tTrue(Rtdesired_mechtmecht__((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytssh_check_mech�scCstjd|�S(s�
        Create a 32 bit unsigned integer (The byte sequence of an integer).

        :param int integer: The integer value to convert
        :return: The byte sequence of an 32 bit integer
        :rtype: Bytes
        s!I(tstructtpack(Rtinteger((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR/�scCs�|jt|��}||7}|tjdt�7}||jt|��7}||j�7}||jt|��7}||j�7}||jt|��7}||j�7}|S(s�
        Create the SSH2 MIC filed for gssapi-with-mic.

        :param str session_id: The SSH session ID
        :param str username: The name of the user who attempts to login
        :param str service: The requested SSH service
        :param str auth_method: The requested SSH authentication mechanism
        :return: The MIC as defined in RFC 4462. The contents of the
                 MIC field are:
                 string    session_identifier,
                 byte      SSH_MSG_USERAUTH_REQUEST,
                 string    user-name,
                 string    service (ssh-connection),
                 string    authentication-method
                           (gssapi-with-mic or gssapi-keyex)
        :rtype: Bytes
        tB(R/R0R<R=RR
(Rt
session_idR+R)Rtmic((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyt_ssh_build_mic�s
(
RRt__doc__RR*R,R5R;R/RB(((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyRms			
		
RcBseeZdZd�Zdddd�Zed�Zdd�Zdd�Z	e
d��Zd�ZRS(	sc
    Implementation of the GSS-API MIT Kerberos Authentication for SSH2.

    :see: `.GSSAuth`
    cCs_tj|||�|jr@tjtjtjtjf|_ntjtjtjf|_dS(s�
        :param str auth_method: The name of the SSH authentication mechanism
                                (gssapi-with-mic or gss-keyex)
        :param bool gss_deleg_creds: Delegate client credentials or not
        N(	RRRtgssapitC_PROT_READY_FLAGtC_INTEG_FLAGt
C_MUTUAL_FLAGtC_DELEG_FLAGt
_gss_flags(RRR((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR�s	cCsk||_||_tjd|jtj�}tj�}|j|_|dkrjtj	j
|j�}nNtj
|�\}}	|j�|jkr�td��ntj	j
|j�}d}
y[|dkrtjd|d|d|j�|_|jj|
�}
n|jj|�}
Wn<tjk
rWtjdjtj�d|j���nX|jj|_|
S(	s�
        Initialize a GSS-API context.

        :param str username: The name of the user who attempts to login
        :param str target: The hostname of the target to connect to
        :param str desired_mech: The negotiated GSS-API mechanism
                                 ("pseudo negotiated" mechanism, because we
                                 support just the krb5 mechanism :-))
        :param str recv_token: The GSS-API token received from the Server
        :raise SSHException: Is raised if the desired mechanism of the client
                             is not supported
        :return: A ``String`` if the GSS-API has returned a token or ``None`` if
                 no token was returned
        :rtype: String or None
        shost@sUnsupported mechanism OID.t	peer_namet	mech_typet	req_flagss{0} Target: {1}iN(RRRDtNametC_NT_HOSTBASED_SERVICEtContextRItflagsRtOIDtmech_from_stringR!RR	R6RtInitContextR"tsteptGSSExceptiontformattsystexc_infotestablishedR$(RttargetR8R+t
recv_tokent	targ_nametctxt	krb5_mechR9R:ttoken((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytssh_init_sec_contexts2		cCsa||_|sH|j|j|j|j|j�}|jj|�}n|jj|j�}|S(s
        Create the MIC token for a SSH2 message.

        :param str session_id: The SSH session ID
        :param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not
        :return: gssapi-with-mic:
                 Returns the MIC token from GSS-API for the message we created
                 with ``_ssh_build_mic``.
                 gssapi-keyex:
                 Returns the MIC token from GSS-API with the SSH session ID as
                 message.
        :rtype: String
        :see: `._ssh_build_mic`
        (RRBRR RR"tget_micR%(RR@tgss_kext	mic_fieldt	mic_token((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytssh_get_mic4s	cCsX||_||_|jdkr3tj�|_n|jj|�}|jj|_|S(s�
        Accept a GSS-API context (server mode).

        :param str hostname: The servers hostname
        :param str username: The name of the user who attempts to login
        :param str recv_token: The GSS-API Token received from the server,
                               if it's not the initial call.
        :return: A ``String`` if the GSS-API has returned a token or ``None``
                if no token was returned
        :rtype: String or None
        N(	RRR%RRDt
AcceptContextRTRYR&(RthostnameR[R+R_((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytssh_accept_sec_contextOs
		cCsu||_||_|jdk	r[|j|j|j|j|j�}|jj||�n|jj|j|�dS(sm
        Verify the MIC token for a SSH2 message.

        :param str mic_token: The MIC token received from the client
        :param str session_id: The SSH session ID
        :param str username: The name of the user who attempts to login
        :return: None if the MIC check was successful
        :raises gssapi.GSSException: if the MIC check failed
        N(	RRRRBR RR%t
verify_micR"(RRdR@R+Rc((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyt
ssh_check_micds
		cCs|jjdk	rtStS(s�
        Checks if credentials are delegated (server mode).

        :return: ``True`` if credentials are delegated, otherwise ``False``
        :rtype: bool
        N(R%tdelegated_credRR7R#(R((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytcredentials_delegated}scCs
t�dS(s�
        Save the Client token in a file. This is used by the SSH server
        to store the client credentials if credentials are delegated
        (server mode).

        :param str client_token: The GSS-API token received form the client
        :raise NotImplementedError: Credential delegation is currently not
                                    supported in server mode
        N(R(Rtclient_token((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pytsave_client_creds�s
N(
RRRCRRR`R#ReRhRjtpropertyRlRn(((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR�s	-RcBsbeZdZd�Zdddd�Zed�Zd�Zdd�Z	e
d��Zd�ZRS(	sf
    Implementation of the Microsoft SSPI Kerberos Authentication for SSH2.

    :see: `.GSSAuth`
    cCsPtj|||�|jr9tjtjBtjB|_ntjtjB|_dS(s�
        :param str auth_method: The name of the SSH authentication mechanism
                                (gssapi-with-mic or gss-keyex)
        :param bool gss_deleg_creds: Delegate client credentials or not
        N(RRRtsspicontISC_REQ_INTEGRITYtISC_REQ_MUTUAL_AUTHtISC_REQ_DELEGATERI(RRR((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR�s	
c
Cs||_||_d}d|j}|d	k	rmtj|�\}}|j�|jkrmtd��qmnyY|d	kr�tj	dd|j
d|�|_n|jj|�\}}	|	dj
}	Wn,tdjtj�d|j���nX|dkrt|_d	}	n|	S(
s�
        Initialize a SSPI context.

        :param str username: The name of the user who attempts to login
        :param str target: The FQDN of the target to connect to
        :param str desired_mech: The negotiated SSPI mechanism
                                 ("pseudo negotiated" mechanism, because we
                                 support just the krb5 mechanism :-))
        :param recv_token: The SSPI token received from the Server
        :raise SSHException: Is raised if the desired mechanism of the client
                             is not supported
        :return: A ``String`` if the SSPI has returned a token or ``None`` if
                 no token was returned
        :rtype: String or None
        ishost/sUnsupported mechanism OID.tKerberostscflagst	targetspns{0}, Target: {1}iN(RRRRR	R6R!Rtsspit
ClientAuthRIR"t	authorizetBuffert	ExceptionRVRWRXR7R$(
RRZR8R+R[terrorR\R9R:R_((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR`�s.		
		cCsa||_|sH|j|j|j|j|j�}|jj|�}n|jj|j�}|S(s
        Create the MIC token for a SSH2 message.

        :param str session_id: The SSH session ID
        :param bool gss_kex: Generate the MIC for Key Exchange with SSPI or not
        :return: gssapi-with-mic:
                 Returns the MIC token from SSPI for the message we created
                 with ``_ssh_build_mic``.
                 gssapi-keyex:
                 Returns the MIC token from SSPI with the SSH session ID as
                 message.
        :rtype: String
        :see: `._ssh_build_mic`
        (RRBRR RR"tsignR%(RR@RbRcRd((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyRe�s	cCs~||_||_d|j}tjdd|�|_|jj|�\}}|dj}|dkrzt|_d}n|S(s�
        Accept a SSPI context (server mode).

        :param str hostname: The servers FQDN
        :param str username: The name of the user who attempts to login
        :param str recv_token: The SSPI Token received from the server,
                               if it's not the initial call.
        :return: A ``String`` if the SSPI has returned a token or ``None`` if
                 no token was returned
        :rtype: String or None
        shost/RttspniN(
RRRwt
ServerAuthR%RyRzR7R&R(RRgR+R[R\R|R_((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyRh�s		

		cCsr||_||_|dk	rX|j|j|j|j|j�}|jj||�n|jj|j|�dS(sd
        Verify the MIC token for a SSH2 message.

        :param str mic_token: The MIC token received from the client
        :param str session_id: The SSH session ID
        :param str username: The name of the user who attempts to login
        :return: None if the MIC check was successful
        :raises sspi.error: if the MIC check failed
        N(	RRRRBR RR%tverifyR"(RRdR@R+Rc((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyRjs
		cCs |jtj@o|jp|jS(s�
        Checks if credentials are delegated (server mode).

        :return: ``True`` if credentials are delegated, otherwise ``False``
        :rtype: Boolean
        (RIRpRsR&(R((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyRl*s	cCs
t�dS(s
        Save the Client token in a file. This is used by the SSH server
        to store the client credentails if credentials are delegated
        (server mode).

        :param str client_token: The SSPI token received form the client
        :raise NotImplementedError: Credential delegation is currently not
                                    supported in server mode
        N(R(RRm((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyRn8s
N(
RRRCRRR`R#ReRhRjRoRlRn(((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyR�s	/	(RCR<RRWR7tGSS_AUTH_AVAILABLEtpyasn1.type.univRtpyasn1.codec.derRRRR#tobjecttparamiko.commonRtparamiko.ssh_exceptionRRRDtOSErrorRpRwRRRRR(((sA/opt/alt/python27/lib/python2.7/site-packages/paramiko/ssh_gss.pyt<module>s:


��
@ Telegram