Ë
|
Wñúh»T ã ó d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
|
Z
|
m Z m Z ddl mZmZ ddlmZ dd lmZ e rdd
|
lmZ ddlZ ddlZddlZd dlm Z ej0 d k( rdndZ G d de « Z G d de « Z G d de « Z y# e$ r dZej0 d k7 r ed « dY ew xY w# e$ r dZdZY kw xY w)z Kerberos Authentication Plugin.é N)Úabstractmethod)ÚPath)Ú TYPE_CHECKINGÚAnyÚOptionalÚTuple)ÚInterfaceErrorÚProgrammingError)Úloggeré )Ú
|
ERR_STATUS)Ú MySQLSocketÚntzwModule gssapi is required for GSSAPI authentication mechanism but was not found. Unable to authenticate with the serveré )ÚMySQLAuthPluginÚMySQLSSPIKerberosAuthPluginÚMySQLKerberosAuthPluginc ó e Zd ZdZedefd« Zedefd« Ze de
|
e de e
|
e ef fd« Z ddd e d
|
ede fd Zy ) ÚMySQLBaseKerberosAuthPluginz8Base class for the MySQL Kerberos authentication plugin.Úreturnc ó y)zPlugin official name.Ú authentication_kerberos_client© ©Úselfs úmH:\Change_password\venv_build\Lib\site-packages\mysql/connector/aio/plugins/authentication_kerberos_client.pyÚnamez MySQLBaseKerberosAuthPlugin.nameM s ð 0ó c ó y)z'Signals whether or not SSL is required.Fr r s r Ú requires_sslz(MySQLBaseKerberosAuthPlugin.requires_sslR s ð r Útgt_auth_challengec ó y)á! Continue with the Kerberos TGT service request.
|
|
With the TGT authentication service given response generate a TGT
|
service request. This method must be invoked sequentially (in a loop)
|
until the security context is completed and an empty response needs to
|
be send to acknowledge the server.
|
|
Args:
|
tgt_auth_challenge: the challenge for the negotiation.
|
|
Returns:
|
tuple (bytearray TGS service request,
|
bool True if context is completed otherwise False).
|
Nr )r r! s r Ú auth_continuez)MySQLBaseKerberosAuthPlugin.auth_continueW s r Úsockr Ú auth_dataÚkwargsc óª K t j d|« | j |fddi|¤}| t d« t j d|t |« « |j |« d{ |j « d{ }t j d|« |t k7 rd}t j d « t j d
|
|d|d z « t j d t |« « t j d « d}d}|sÂ|dk r½t j dd|d z d« t j d|« t j d|d|d z « | j ||d « \ } }| r|j | « d{ |rn;|j « d{ }t j d| « |d z }|s|dk r½|st d| d| « t j d|t |« « |j « d{ }t j d|« t |« S 7 Ø7 Ã7 ´7 7 /w)aS Handles server's `auth switch request` response.
|
|
Args:
|
sock: Pointer to the socket connection.
|
auth_data: Plugin provided data (extracted from a packet
|
representing an `auth switch request` response).
|
kwargs: Custom configuration to be passed to the auth plugin
|
when invoked. The parameters defined here will override the ones
|
defined in the auth plugin itself.
|
|
Returns:
|
packet: Last server's response after back-and-forth
|
communication.
|
z# auth_data: %sÚignore_auth_dataFNzGot a NULL auth responsez# request: %s size: %sz # server response packet: %sé z%# Continue with GSSAPI authenticationz# Response header: %sr z# Response size: %sz # Negotiate a service requestr z%s Attempt %s %sz--------------------z<< Server response: %sz# Response code: %sz>> Response to server: %sz'Unable to fulfill server request after z! attempts. Last server response: z(Last response from server: %s length: %dz << Ok packet from server: %s)
|
r ÚdebugÚ auth_responser ÚlenÚwriteÚreadr r$ Úbytes)
|
r r% r& r' ÚresponseÚpacketÚ
|
rcode_sizeÚcompleteÚtriesÚtokens
|
r Úauth_switch_responsez0MySQLBaseKerberosAuthPlugin.auth_switch_responsej s# è ø ô" Ð&¨ Ô2Ø%4×%Ñ% iÑRÀ%ÐRÈ6ÑRØ Ð Ü Ð!;Ó<Ð <ä Ð-¨x¼¸X» ÔGØjjÓ"×"Ð"àyy{×"Ü Ð3°VÔ<à ZÓ ØJÜ LLÐ@Ô AÜ LLÐ0°&Ð9I¸:ȹ>Ð2JÔ KÜ LLÐ.´°F³ Ô <Ü LLÐ8Ô 9Ø HØEá 5¨1¢9Ü Ð /°¸5À1¹9ÀhÔOÜ Ð 5°vÔ>Ü Ð 2°FÐ;K¸ZÈ!¹^Ð4LÔMØ"&×"4Ñ"4°V¸J¸KÐ5HÓ"IxÙØ ** UÓ+×+Ð+ÙØØ #yy{×*ä Ð 8¸%Ô@Ø
|
ñ 5¨1£9ñ Ü$Ø=¸e¸Wð E7Ø7=°hð@óð ô
|
LLØ:ØÜF ô ð 99;×&FÜ LLÐ7¸Ô @äV}Ð ðY #ùà"ùð$ ,øð +øð$ 'úsb A-IÁ/IÁ0IÂI
|
ÂDIÆI ÆIÆ3IÆ4&IÇAIÈ!IÈ"&IÉ
|
IÉ IÉIÉIN)Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__ÚpropertyÚstrr Úboolr r r r0 r r$ r r7 r r r r r J s ÙBà ð0cò 0ó ð0ð ðdò ó ðð ð Ø"*¨5¡/ð à x Ð$Ñ %ò ó ð ð$C Ø!ðC Ø.3ðC Ø?BðC à ôC r r c ó0 e Zd ZU dZdZeej ed< e de
|
fd« Z e de fd« Z de
|
dej j j fdZe d edee
|
e
|
f fd
|
« Z dd ee d edee fd Zdee deee ef fdZdedefdZy)r z3Implement the MySQL Kerberos authentication plugin.NÚcontextr c ó2 t j d¬« } t | j « }|j d« dk7 r|j dd« \ }}|S # t j j j $ r t j « cY S w xY w)z(Get user from credentials without realm.Úinitiate©Úusageú@éÿÿÿÿr ) ÚgssapiÚ Credentialsr= r ÚfindÚsplitÚrawÚmiscÚGSSErrorÚgetpassÚgetuser)ÚcredsÚuserÚ_s r Úget_user_from_credentialsz1MySQLKerberosAuthPlugin.get_user_from_credentials¶ sw ð %Ü×&Ñ&¨ZÔ8EÜuzz?DØyy~ Ò#Ø ** S¨!Ó,aØKøÜzz×'Ñ'ò %Ü??Ó$Ò $ð %ús AA Á;BÂBc ó< t j j dt j dk( rdt j « nt d« j d« « } | s t d« t j d| « dd | j d
|
« i}|S ) zäGet a credentials store dictionary.
|
|
Returns:
|
dict: Credentials store dictionary with the krb5 ccache name.
|
|
Raises:
|
InterfaceError: If 'KRB5CCNAME' environment variable is empty.
|
Ú
|
KRB5CCNAMEÚposixz /tmp/krb5cc_z%TEMP%Úkrb5ccz5The 'KRB5CCNAME' environment variable is set to emptyz Using krb5 ccache name: FILE:%ss ccachezFILE:úutf-8) ÚosÚenvironÚgetr Úgetuidr Újoinpathr r r+ Úencode)Ú
|
krb5ccnameÚstores r Ú get_storez!MySQLKerberosAuthPlugin.get_store s ô ZZ^^Ø ô 77gÒ%ð ryy{mÑ,ä(^×,Ñ,¨XÓ6ó
|
|
ñ Ü ØGóð ô Ð6¸
|
ÔCØe J <Ð 0× 7Ñ 7¸Ó @ÐAØ r Úupnc ó0 t j d« t j |t j j
|
« }| j j d« } t j j ||d¬« }|j }t j j | j « |t j j dd¬« |S # t j j j $ r}t# d| « |d}~ww xY w) zÆAcquire and store credentials through provided password.
|
|
Args:
|
upn (str): User Principal Name.
|
|
Returns:
|
gssapi.raw.creds.Creds: GSSAPI credentials.
|
z8Attempt to acquire credentials through provided passwordrX rB rC T)rP ÚmechÚ overwriteÚ set_defaultz7Unable to acquire credentials with the given password: N)r r+ rG ÚNameÚNameTyperQ Ú _passwordr^ rK Úacquire_cred_with_passwordrP Ústore_cred_intora ÚMechTypeÚkerberosrL rM r
|
)r rb rQ ÚpasswordÚacquire_cred_resultrP Úerrs r Ú_acquire_cred_with_passwordz3MySQLKerberosAuthPlugin._acquire_cred_with_passwordÜ së ô ÐOÔPÜ{{3¤§¡× 4Ñ 4Ó5Ø>>×(Ñ(¨Ó1ð Ü"(§*¡*×"GÑ"GØh jð #Hó #Ð ð (×-Ñ-EÜ JJ× &Ñ &ØÓ ØÜ__×-Ñ-Ø Ø ð 'ô ð øô zz×'Ñ'ò Ü"ØIÈ#ÈÐOóàð ûð ús Á A8C Ã'DÄDÄDr2 c óF t j d| dd « d }| dd } t j d| d| d| « d }| |d } t j d| dd « d }t j d| d| dd « d }|j « |j « fS ©aY Parse authentication data.
|
|
Get the SPN and REALM from the authentication data packet.
|
|
Format:
|
SPN string length two bytes <B1> <B2> +
|
SPN string +
|
UPN realm string length two bytes <B1> <B2> +
|
UPN realm string
|
|
Returns:
|
tuple: With 'spn' and 'realm'.
|
z<HNr r ú<Ús©ÚstructÚunpackÚdecode©r2 Úspn_lenÚspnÚ realm_lenÚrealms r Ú_parse_auth_dataz(MySQLKerberosAuthPlugin._parse_auth_dataû ó° ô -- f¨R¨a jÓ1°!Ñ4Øämma y¨N¨F°8°GÐ,<Ó=¸aÑ@ØÐ!äMM $¨¨r°¨
|
Ó3°AÑ6 Ü ) ¨AÐ .°°q°r°
|
Ó;¸AÑ>àzz|U\\^Ð+Ð+r r& r' c ó® d}d}|r'|j dd« s | j |« \ }}| | j
|
j « dz S | j r| j d| nd}t j d|« t j d|« t j d ¬
|
« }t |j « }t j d « t j d |« |j d« d k7 r|j dd« \ } }
|
n|} d}
|
| j r| j d| n|}| j rA| j | k7 r2t j d« | j
|
| j! |« }|
|
r"|
|
|k7 r | j
|
| j! |« }t j. j0 t j. j2 t j. j4 f} t j6 |t j8 j: ¬« } | j= t j> j@ « } t jB | |tE | « d ¬« | _# | jF jI « }t j d|« |S # t j $ r}t d| « |d}~ww xY w# t j" j$ j& $ r:}|r | j
|
| j! |« }nt) d| « |Y d}~
d}~wt j" j* j, $ r:}|r | j
|
| j! |« }nt) d| « |Y d}~äd}~ww xY w# t j" j* j, $ r}t) d| « |d}~ww xY w)z(Prepare the first message to the server.Nr) Tú Invalid authentication data: ó rE úService Principal: %sú Realm: %srB rC zCached credentials foundzCached credentials UPN: %srF r zBThe user from cached credentials doesn't match with the given userzCredentials has expired: z-Unable to retrieve cached credentials error: )Ú name_type)r rP ÚflagsrD ú%Unable to initiate security context: úInitial client token: %s)%r[ r rw ÚerrorÚInterruptedErrorri r^ Ú _usernamer r+ rG rH r= r rI rJ rq rK Ú
|
exceptionsÚExpiredCredentialsErrorr rL rM ÚRequirementFlagÚmutual_authenticationÚextended_errorÚdelegate_to_peerrg rh Úkerberos_principalÚ canonicalizerl rm ÚSecurityContextÚsumr@ Ústep)r r& r' r| r~ rp rb rP Ú creds_upnÚ
|
creds_userÚ creds_realmr r ÚcnameÚinitial_client_tokens r r, z%MySQLKerberosAuthPlugin.auth_response sR ð Øá VZZÐ(:¸DÔ Að WØ !× 2Ñ 2°9Ó =
|
Uð ;Ø>>×(Ñ(Ó*¨WÑ4Ð 4à-1¯^ª^ Ð % Ñ)Àä Ð,¨cÔ2Ü [ %Ô(ð& ä ×+Ñ+°*Ô=EÜEJJIä LLÐ3Ô 4Ü LLÐ5°yÔ Að ~~cÓ" bÒ(Ø*3¯/©/¸#¸qÓ*AÑ'
|
Kà &
|
Ø " à15· ² T^^Ð$ A e WÑ-ÀYCð ~~ $§.¡.°JÒ">Ü ð!ôð >>Ð-Ø × <Ñ <¸SÓ AEÙ{¨eÒ 3¸¿¹Ð8RØ ×8Ñ8¸Ó=ô × "Ñ "× 8Ñ 8Ü × "Ñ "× 1Ñ 1Ü × "Ñ "× 3Ñ 3ð
|
ô
|
{{3¬&¯/©/×*LÑ*LÔMØ×!Ñ!¤&§/¡/×":Ñ":Ó;Ü ×-Ñ-Øe¬3¨u«:¸Zô
|
ð YØ48·L±L×4EÑ4EÓ4GÐ ô Ð/Ð1EÔFØ#Ð#øôI <<ò WÜ&Ð)FÀsÀeÐ'LÓMÐSVÐVûð WûôL zz×$Ñ$×<Ñ<ò QÙt~~Ð1Ø ×8Ñ8¸Ó=ä$Ð'@ÀÀÐ%FÓGÈSÐPõ ûô zz×'Ñ'ò Ùt~~Ð1Ø ×8Ñ8¸Ó=ä$ØCÀCÀ5ÐIóàðõ ûð ûô* zz×'Ñ'ò YÜ Ð#HÈÈÐ!NÓOÐUXÐ Xûð YúsT J, ÂDK É:N Ê,KÊ?KËKË'NË=/L2Ì2*NÍ /NÎNÎ'OÏ OÏOr! c ó t j d|« | j j |« }t j d|« t j d| j j « || j j fS )r# útgt_auth challenge: %szContext step response: %súContext completed?: %s)r r+ r@ r r4 )r r! Úresps r r$ z%MySQLKerberosAuthPlugin.auth_continuee sf ô" Ð-Ð/AÔBà $§ ¡ × 1Ñ 1Ð2DÓ Eä Ð0°$Ô7Ü Ð-¨t¯|©|×/DÑ/DÔEàT\\×*Ñ*Ð*Ð*r Úmessagec óÜ | j j s t d« t j d|« t j d| j j
|
« | j j |« }t j d|« t j d|« t d « }t j d
|
|« | j j |d ¬ « }t j d |d t |d « « |j S # t j j j $ r*}t j d|« t d| « |d}~ww xY w)a_ Accept handshake and generate closing handshake message for server.
|
|
This method verifies the server authenticity from the given message
|
and included signature and generates the closing handshake for the
|
server.
|
|
When this method is invoked the security context is already established
|
and the client and server can send GSSAPI formated secure messages.
|
|
To finish the authentication handshake the server sends a message
|
with the security layer availability and the maximum buffer size.
|
|
Since the connector only uses the GSSAPI authentication mechanism to
|
authenticate the user with the server, the server will verify clients
|
message signature and terminate the GSSAPI authentication and send two
|
messages; an authentication acceptance b' ' and a
|
OK packet (that must be received after sent the returned message from
|
this method).
|
|
Args:
|
message: a wrapped gssapi message from the server.
|
|
Returns:
|
bytearray (closing handshake message to be send to the server).
|
z!Security context is not completedzServer message: %szGSSAPI flags in use: %sz Unwraped: %sz#Unable to unwrap server message: %sz!Unable to unwrap server message: Nz Unwrapped server message: %ss zMessage response: %sF)Úencryptz(Wrapped message response: %s, length: %dr )r@ r4 r
|
r r+ Ú actual_flagsÚunwraprG rK r Ú BadMICErrorr Ú bytearrayÚwrapr- r¡ )r r¡ Úunwrapedrp r1 Úwrapeds r Úauth_accept_close_handshakez3MySQLKerberosAuthPlugin.auth_accept_close_handshake s) ð4 ||×$Ò$Ü"Ð#FÓGÐ GÜ Ð)¨7Ô3Ü Ð.°· ± ×0IÑ0IÔJð UØ||×*Ñ*¨7Ó3HÜ LL ¨Ô 2ô
|
Ð3°XÔ>ô
|
Ð /Ó0ä Ð+¨XÔ6Ø ×"Ñ" 8°UÐ"Ó;Ü Ø 6Ø 1IÜ q Nô
|
ð ~~Ð øô' zz×$Ñ$×0Ñ0ò UÜ LLÐ>ÀÔ DÜ Ð#DÀSÀEÐ!JÓKÐQTÐ Tûð Uús Á#1D Ä'E+Å%E&Å&E+©N)r8 r9 r: r; r@ r rG r Ú__annotations__Ú staticmethodr= rS Údictra rK rP ÚCredsrq r0 r r r r, r> r$ r« r r r r r ± s
Ù=à04GXf×,Ñ,Ñ -Ó4àð % sò %ó ð %ð ðtò ó ðð2 ¨sð °v·z±z×7GÑ7G×7MÑ7Mó ð> ð, ð ,¨5°°c°©?ò ,ó ð,ð4 ,0ñN$Ø! % ðN$Ø;>ðN$à % óN$ð`+Ø"*¨5¡/ð+à x Ð$Ñ %ó+ð44 °5ð 4 ¸Uô 4 r c ó e Zd ZU dZdZeed< dZeed< ede de
|
e e f fd« Z d de e d ede e fd
|
Zd e e de
|
e e ef fd Zy)r zDImplement the MySQL Kerberos authentication plugin with Windows SSPINr@ Ú
|
clientauthr2 r c óF t j d| dd « d }| dd } t j d| d| d| « d }| |d } t j d| dd « d }t j d| d| dd « d }|j « |j « fS rs rv rz s r r z,MySQLSSPIKerberosAuthPlugin._parse_auth_data¼ r r r& r' c ó¤ t j d« d}d}|r'|j dd« s | j |« \ }}t j d|« t j d|« t t t d« t j t j f}| j r&| j r| j || j f}nd}|}t j d |« t j d
|
|du « t j d ||t |« t j ¬ « | _ d} | j" j% | « \ }}
|
t j d |« t j d|
|
« t j d| j" j& « |
|
d j( } t j d| j" j* « t j d| « | S # t j
|
$ r}t d| « |d}~ww xY w# t, $ r}t/ d| « |d}~ww xY w)z©Prepare the first message to the server.
|
|
Args:
|
kwargs:
|
ignore_auth_data (bool): if True, the provided auth data is ignored.
|
zauth_response for sspiNr) Tr r r
zKPackage "pywin32" (Python for Win32 (pywin32) extensions) is not installed.z targetspn: %sz_auth_info is None: %sÚ Negotiate)Ú targetspnÚ auth_infoÚscflagsÚdatarepúContext step err: %súContext step out_buf: %sr r z pkg_info: %sr r )r r+ r[ r rw r r ÚsspiconÚsspir
|
ÚISC_REQ_MUTUAL_AUTHÚISC_REQ_DELEGATEr ri Ú
|
ClientAuthr ÚSECURITY_NETWORK_DREPr² Ú authorizeÚ authenticatedÚBufferÚpkg_infoÚ Exceptionr ) r r& r' r| r~ rp r Ú
|
_auth_infor¶ ÚdataÚout_bufr s r r, z)MySQLSSPIKerberosAuthPlugin.auth_responseÖ s ô Ð-Ô.ØØá VZZÐ(:¸DÔ Að WØ !× 2Ñ 2°9Ó =
|
Uô Ð,¨cÔ2Ü [ %Ô(ä ?dlÜ"ð%óð ô
|
×,Ñ,¬g×.FÑ.FÐGà >>dnnØ ..¨%°· ± Ð@Jà Jà Ü _ iÔ0Ü Ð-¨z¸TÐ/AÔBô* //Ø Ø Ø ÜJÜ×1Ñ1ô
|
ð YØDØ ??×4Ñ4°TÓ:LCÜ LLÐ/°Ô 5Ü LLÐ3°WÔ =Ü LLÐ1°4·?±?×3PÑ3PÔ QØ#*¨1¡:×#4Ñ#4Ð Ü LL ¨¯ © ×)AÑ)AÔ Bô Ð/Ð1EÔFØ#Ð#øô} <<ò WÜ&Ð)FÀsÀeÐ'LÓMÐSVÐVûð Wûôt ò YÜ Ð#HÈÈÐ!NÓOÐUXÐ Xûð Yús0 ¯H ÅB/H2 ÈH/ÈH*È*H/È2 IÈ;I
|
É
|
Ir! c ó t j d|« | j j |« \ }}t j d|« t j d|« |d j }t j d|« t j d| j j
|
« || j j
|
fS )r# r rº r» r zContext step resp: %sr )r r+ r² r rÄ rà )r r! rp rÉ r s r r$ z)MySQLSSPIKerberosAuthPlugin.auth_continue& s ô" Ð-Ð/AÔBà×0Ñ0Ð1CÓD Wä Ð+¨SÔ1Ü Ð/°Ô9Øqz× Ñ Ü Ð,¨dÔ3Ü Ð-¨t¯©×/LÑ/LÔMàT__×2Ñ2Ð2Ð2r r¬ )r8 r9 r: r; r@ r r r² r® r0 r r= r r r, r> r$ r r r r r ¶ s
ÙNàGSÓØJÓàð, ð ,¨5°°c°©?ò ,ó ð,ð4 ,0ñN$Ø! % ðN$Ø;>ðN$à % óN$ð`3Ø"*¨5¡/ð3à x Ð$Ñ %ô3r )!r; rN rY rw Úabcr Úpathlibr Útypingr r r r Úmysql.connector.errorsr r
|
Úmysql.connector.loggerr Úauthenticationr Únetworkr rG Ú ImportErrorr r½ r¼ Ú r ÚAUTHENTICATION_PLUGIN_CLASSr r r r r r ú<module>rÕ sä ðñ> &ã Û Û å Ý ß 6Ó 6ç CÝ )å 'áÝ%ð ÛðÛÛõ
|
ð &(§W¡W°¢_Ñ!Ð:Sð ô
|
c /ô c ôNB Ð 9ô B ôJK3Ð"=õ K3øðG ò Ø FØ ww$Ù ð ó
|
ð ð ñ ðûð ò Ø DØGðús$ ÁB Á B1 Â B.Â-B.Â1 B=Â<B=
|
