
    mgC                        U d Z ddlmZmZmZmZmZ ddlmZmZm	Z	m
Z
mZ ddlmZ ddlmZmZ ddlmZ ddlmZmZmZ dd	lmZmZmZmZmZ dd
lmZ ddlmZm Z  erddl!Z!ddl"m#Z#m$Z$ ddl"m%Z% eee&e'f      Z(ee&e&e&e(f   Z)e
e'e)f   Z*ee&   Z+ee&e&f   Z,dZ-dZ.dZ/dZ0dZ1dZ2dZ3dZ4dZ5dZ6g Z7ee8   e9d<   i Z:ee8e	d   f   e9d<   i Z;ee8e	d   f   e9d<    G d de      Z< G d de<      Z= G d de=      Z> G d d e=      Z? G d! d"e=      Z@ G d# d$e=      ZA G d% d&e=      ZB G d' d(e=      ZC G d) d*e=      ZD G d+ de<      ZE G d, d-eE      ZF G d. d/eE      ZG G d0 d1eE      ZH G d2 d3eE      ZI G d4 d5eE      ZJ G d6 d7eE      ZK G d8 d9eE      ZLd:e8d;e	e=   d<e	eE   d=dfd>ZMd=ee8   fd?ZNd@dAdBe8d=ee=   fdCZOd@dDd=ee8   fdEZPd@dDdFe&dBe8dGed=eeE   f
dHZQdIe>eFfdJe?eGfdKe@eHfdLeAeIfdMeBeJfdNeCeKfdOeDeLffZReRD ]  ZS eMeS  	 y)PzSSH authentication handlers    )TYPE_CHECKING	AwaitableDictListOptional)SequenceTupleTypeUnioncast   )DEFAULT_LANG)GSSBaseGSSError)	SSHLogger)ProtocolErrorPasswordChangeRequiredget_symbol_names)BooleanStringUInt32	SSHPacketSSHPacketHandler)
SigningKey)saslprepSASLPrepErrorN)SSHConnectionSSHClientConnection)SSHServerConnection<   =   ?   @   A   B   _auth_methods
ClientAuth_client_auth_handlers
ServerAuth_server_auth_handlersc            	       x    e Zd ZdZddded   fdZddd	ed
ededdfdZ	e
defd       Zded   ddfdZddZy)AuthzParent class for authenticationconnr   coroNc                 `    || _         |j                  | _        |j                  |      | _        y N)_connlogger_loggercreate_task_coro)selfr-   r.   s      -lib/python3.12/site-packages/asyncssh/auth.py__init__zAuth.__init__M   s&    
{{595E5Ed5K
    Ttrivialpkttypeargsr;   returnc                F     | j                   j                  |g|| |d y)zSend an auth packet)handlerr;   N)r1   send_userauth_packet)r6   r<   r;   r=   s       r7   send_packetzAuth.send_packetR   s+     	(

'' 	9$ 	907	9r9   c                     | j                   S )z4A logger associated with this authentication handler)r3   r6   s    r7   r2   zAuth.loggerY   s     ||r9   c                 d    | j                          | j                  j                  |      | _        y)z Create an asynchronous auth taskN)cancelr1   r4   r5   )r6   r.   s     r7   r4   zAuth.create_task_   s#     	ZZ++D1
r9   c                 `    | j                   r"| j                   j                          d| _         yy)z%Cancel any authentication in progressN)r5   rF   rD   s    r7   rF   zAuth.cancele   s'     ::JJDJ r9   r>   N)__name__
__module____qualname____doc__r   r8   intbytesboolrB   propertyr   r2   r4   rF    r9   r7   r,   r,   J   s~    )L_ LIdO L %)93 9u 9!9-19 	  
2	$ 2D 2r9   r,   c            	       v     e Zd ZU dZded<   dddef fdZdd	Zdd
ZddZ	ddddede
e   deddfdZ xZS )r'   z&Parent class for client authenticationr   r1   r-   methodc                 P    || _         t        | 	  || j                                y r0   )_methodsuperr8   _startr6   r-   rS   	__class__s      r7   r8   zClientAuth.__init__r   s    t{{}-r9   r>   Nc                    K   t         w)z2Abstract method for starting client authenticationNotImplementedErrorrD   s    r7   rW   zClientAuth._startw         "!   	c                      y)zCallback when auth succeedsNrQ   rD   s    r7   auth_succeededzClientAuth.auth_succeeded}       r9   c                      y)zCallback when auth failsNrQ   rD   s    r7   auth_failedzClientAuth.auth_failed   ra   r9   Tkeyr;   r=   re   r;   c                v   K    | j                   j                  | j                  g|||d d{    y7 w)z"Send a user authentication requestrd   N)r1   send_userauth_requestrU   )r6   re   r;   r=   s       r7   send_requestzClientAuth.send_request   sB     
 /djj..t|| @d @7>@ 	@ 	@s   /979rH   )rI   rJ   rK   rL   __annotations__rN   r8   rW   r`   rc   r   r   rO   rh   __classcell__rY   s   @r7   r'   r'   m   se    0  .2 .E .
"*' 8<+/@ @ ( 4@$(@48@r9   c                       e Zd ZdZddZy)_ClientNullAuthz'Client side implementation of null authNc                 @   K   | j                          d{    y7 w)z Start client null authenticationN)rh   rD   s    r7   rW   z_ClientNullAuth._start   s      !!!s   rH   rI   rJ   rK   rL   rW   rQ   r9   r7   rm   rm      s
    1"r9   rm   c                       e Zd ZdZddZy)_ClientGSSKexAuthz3Client side implementation of GSS key exchange authNc                   K   | j                   j                         rO| j                  j                  d       | j	                  | j                   j                         d       d{    y| j                   j                          y7  w)z,Start client GSS key exchange authenticationTrying GSS key exchange authFrd   N)r1   gss_kex_auth_requestedr2   debug1rh   get_gss_contexttry_next_authrD   s    r7   rW   z_ClientGSSKexAuth._start   sq      ::,,.KK=>##

(B(B(D,1 $ 3 3 3 JJ$$&3s   A$B	&B'!B	rH   ro   rQ   r9   r7   rq   rq      s
    =	'r9   rq   c                        e Zd ZdZ e e       d      Zdddef fdZdd	Z	dd
Z
dedededdfdZdedededdfdZdedededdfdZdedededdfdZeeeeeeeeiZ xZS )_ClientGSSMICAuthz*Client side implementation of GSS MIC authMSG_USERAUTH_GSSAPI_r-   r   rS   c                 B    t         |   ||       d | _        d| _        y NF)rV   r8   _gss
_got_errorrX   s      r7   r8   z_ClientGSSMICAuth.__init__   s     v&'+	r9   r>   Nc                   K   | j                   j                         r| j                  j                  d       | j                   j	                         | _        | j
                  j                          dj                  d | j
                  j                  D              }| j                  t        t        | j
                  j                              |       d{    y| j                   j                          y7  w)z#Start client GSS MIC authenticationTrying GSS MIC authr9   c              3   2   K   | ]  }t        |        y wr0   r   ).0mechs     r7   	<genexpr>z+_ClientGSSMICAuth._start.<locals>.<genexpr>   s     GtfTl   N)r1   gss_mic_auth_requestedr2   ru   rv   r}   resetjoinmechsrh   r   lenrw   )r6   r   s     r7   rW   z_ClientGSSMICAuth._start   s      ::,,.KK45

224DIIIOOHHGtyyGHE##F3tyy+?$@%HHHJJ$$& Is   CC;C9!C;c                 6   | j                   J | j                   j                  r`| j                  j                  | j                        }| j                  t        t        | j                   j                  |            d       y| j                  t               y)z$Finish client GSS MIC authenticationNFr:   )
r}   provides_integrityr1   get_userauth_request_datarU   rB   MSG_USERAUTH_GSSAPI_MICr   sign%MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE)r6   datas     r7   _finishz_ClientGSSMICAuth._finish   sx     yy$$$99''::77ED4#DIINN4$89%*  , BCr9   _pkttype_pktidpacketc                 :   |j                         }|j                          | j                  J || j                  j                  vrt	        d      	 | j                  j                         }|J | j                  t        t        |             | j                  j                  r| j                          yy# t        $ rY}|j                  r)| j                  t        t        |j                               | j                  j                          Y d}~yd}~ww xY w)z&Process a GSS response from the serverNzMechanism mismatch)
get_string	check_endr}   r   r   steprB   MSG_USERAUTH_GSSAPI_TOKENr   completer   r   tokenMSG_USERAUTH_GSSAPI_ERRTOKr1   rw   )r6   r   r   r   r   r   excs          r7   _process_responsez#_ClientGSSMICAuth._process_response   s       "yy$$$tyy& 455	'IINN$E$$$6uFyy!! " 	'yy  !;VCII=NOJJ$$&&		's   A#B8 8	DADDc                    |j                         }|j                          | j                  J 	 | j                  j                  |      }|r| j	                  t
        t        |             | j                  j                  r| j                          yy# t        $ rY}|j                  r)| j	                  t        t        |j                               | j                  j                          Y d}~yd}~ww xY w)z#Process a GSS token from the serverN)r   r   r}   r   rB   r   r   r   r   r   r   r   r1   rw   r6   r   r   r   r   r   s         r7   _process_tokenz _ClientGSSMICAuth._process_token   s     "(!2!2!4yy$$$	'IINN5)E  !:F5MJyy!! " 	'yy  !;VCII=NOJJ$$&&		's   A"B 	C6AC11C6c                     |j                         }|j                         }|j                         }|j                         }|j                          | j                  j	                  d|       d| _        y)z#Process a GSS error from the serverGSS error from server: %sTN)
get_uint32r   r   r2   ru   r~   )r6   r   r   r   _msgs         r7   _process_errorz _ClientGSSMICAuth._process_error   sd     !6<r9   c                 0   |j                         }|j                          | j                  J 	 | j                  j                  |       y# t        $ r@}| j
                  s*| j                  j                  dt        |             Y d}~yY d}~yd}~ww xY w)z)Process a GSS error token from the serverNr   )	r   r   r}   r   r   r~   r2   ru   strr   s         r7   _process_error_tokenz&_ClientGSSMICAuth._process_error_token  s~     !!#yy$$$	JIINN5! 	J??""#>CII #	Js   A 	B1BBrH   )rI   rJ   rK   rL   r   globals_handler_namesrN   r8   rW   r   rM   r   r   r   r   r   MSG_USERAUTH_GSSAPI_RESPONSEr   MSG_USERAUTH_GSSAPI_ERRORr   _packet_handlersrj   rk   s   @r7   ry   ry      s    4%gi1GHN 2  E  'D'# 's '"+'04'4's 'C '('-1'.s C (-1JS J# J%.J37J  	%&7!n!n"&:	r9   ry   c                       e Zd ZdZddZy)_ClientHostBasedAuthz-Client side implementation of host based authNc                 B  K   | j                   j                          d{   \  }}}|| j                   j                          y| j                  j	                  d|||j
                         	 | j                  t        |j
                        t        |j                        t        |      t        |      |       d{    y7 7 # t        $ rI}| j                  j	                  dt        |             | j                   j                          Y d}~yd}~ww xY ww)z&Start client host based authenticationNz=Trying host based auth of user %s on host %s with %s host key)re   zHost based auth failed: %s)r1   host_based_auth_requestedrw   r2   ru   	algorithmrh   r   public_data
ValueErrorr   )r6   keypairclient_hostclient_usernamer   s        r7   rW   z_ClientHostBasedAuth._start"  s      **6688 	.o ?JJ$$& ./>",,	.	'##F7+<+<$=$*7+>+>$?$*;$7$*?$; $ J J J 9J  	'KK;SXFJJ$$&&	'sM   DCAD/AC
  CC
 DC
 
	D?DDDDrH   ro   rQ   r9   r7   r   r     s
    7'r9   r   c                   \    e Zd ZdZ e e       d      ZddZddZde	de	d	e
ddfd
ZeeiZy)_ClientPublicKeyAuthz-Client side implementation of public key authMSG_USERAUTH_PK_r>   Nc                   K   | j                   j                          d{   | _        | j                  | j                   j                          y| j                  j                  d| j                  j                         | j                  t        d      t        | j                  j                        t        | j                  j                               d{    y7 7 w)z&Start client public key authenticationN"Trying public key auth with %s keyF)r1   public_key_auth_requested_keypairrw   r2   ru   r   rh   r   r   r   rD   s    r7   rW   z_ClientPublicKeyAuth._start?  s      #jjBBDD== JJ$$&?==22	4  &t}}'>'> ? &t}}'@'@ AC 	C 	C E	Cs"   C$C B9C$C"C$"C$c                 b  K   | j                   J | j                  j                  d| j                   j                         | j	                  t        d      t        | j                   j                        t        | j                   j                        | j                   d       d{    y7 w)zSend signed public key requestNzSigning request with %s keyTFrd   )r   r2   ru   r   rh   r   r   r   rD   s    r7   _send_signed_requestz)_ClientPublicKeyAuth._send_signed_requestO  s      }}(((8==22	4  &t}}'>'> ? &t}}'@'@ A$(MM5   B 	B 	Bs   B%B/'B-(B/r   r   r   c                 8   |j                         }|j                         }|j                          | j                  J || j                  j                  k7  s|| j                  j                  k7  rt        d      | j                  | j                                y)z Process a public key ok responseNzKey mismatch)r   r   r   r   r   r   r4   r   )r6   r   r   r   r   key_datas         r7   _process_public_key_okz+_ClientPublicKeyAuth._process_public_key_ok\  s     %%'	$$&}}(((000DMM555//2245r9   rH   )rI   rJ   rK   rL   r   r   r   rW   r   rM   r   r   MSG_USERAUTH_PK_OKr   rQ   r9   r7   r   r   :  sS    7%gi1CDNC B6s 6C 6'06596" 	2r9   r   c            
       p    e Zd ZdZ e e       d      ZddZdededed	e	ddf
d
Z
dedededdfdZeeiZy)_ClientKbdIntAuthz7Client side implementation of keyboard-interactive authMSG_USERAUTH_INFO_r>   Nc                    K   | j                   j                          d{   }|| j                   j                          y| j                  j	                  d       | j                  t        d      t        |             d{    y7 i7 w)z0Start client keyboard interactive authenticationN Trying keyboard-interactive auth )r1   kbdint_auth_requestedrw   r2   ru   rh   r   )r6   
submethodss     r7   rW   z_ClientKbdIntAuth._startv  st       ::;;==
JJ$$&=>r
F:,>??? > 	@s"   BB
A#BBBBnameinstructionlangpromptsc                   K   | j                   j                  ||||       d{   }|| j                   j                          y| j                  t        t        t        |            dj                  d |D              |        y7 dw)z7Receive and respond to a keyboard interactive challengeNr9   c              3   2   K   | ]  }t        |        y wr0   r   )r   rs     r7   r   z7_ClientKbdIntAuth._receive_challenge.<locals>.<genexpr>  s     !?Y&)Yr   r:   )r1   kbdint_challenge_receivedrw   rB   MSG_USERAUTH_INFO_RESPONSEr   r   r   )r6   r   r   r   r   	responsess         r7   _receive_challengez$_ClientKbdIntAuth._receive_challenge  s     
 **66t[7;WF F 	 JJ$$&3VC	N5K!?Y!??%. 	 	0Fs   "BB	A%Br   r   r   c                 D   |j                         }|j                         }|j                         }	 |j                  d      }|j                  d      }|j                  d      }	|j	                         }
g }t        |
      D ]G  }|j                         }|j                         }	 |j                  d      }|j                  ||f       I | j                  | j                  |||	|             y# t        $ r t        d      dw xY w# t        $ r t        d      dw xY w)z5Process a keyboard interactive authentication requestutf-8asciiz)Invalid keyboard interactive info requestN)
r   decodeUnicodeDecodeErrorr   r   rangeget_booleanappendr4   r   )r6   r   r   r   
name_bytesinstruction_bytes
lang_bytesr   r   r   num_promptsr   r   prompt_bytesechoprompts                   r7   _process_info_requestz'_ClientKbdIntAuth._process_info_request  s>    &&(
"--/&&(
	:$$W-D+227;K$$W-D
 ''){#A!,,.L%%'D>%,,W5
 NNFD>* $ 	00{15w@ 	A% " 	: !/ 059:	: & ># %3 49=>>s   3C0 &D	0D	DrH   )rI   rJ   rK   rL   r   r   r   rW   r   KbdIntPromptsr   rM   r   r   MSG_USERAUTH_INFO_REQUESTr   rQ   r9   r7   r   r   q  s}    A%gi1EFN@0S 0s 0# 0*70<@0 Ac A3 A&/A48AD 	"#8r9   r   c                        e Zd ZdZ e e       d      Zdddef fdZdd	Z	d
e
de
ddfdZddZddZdedededdfdZeeiZ xZS )_ClientPasswordAuthz+Client side implementation of password authMSG_USERAUTH_PASSWD_r-   r   rS   c                 4    t         |   ||       d| _        y r|   )rV   r8   _password_changerX   s      r7   r8   z_ClientPasswordAuth.__init__  s    v& %r9   r>   Nc                 $  K   | j                   j                          d{   }|| j                   j                          y| j                  j	                  d       | j                  t        d      t        |      d       d{    y7 k7 w)z$Start client password authenticationNTrying password authFr:   )r1   password_auth_requestedrw   r2   ru   rh   r   r   )r6   passwords     r7   rW   z_ClientPasswordAuth._start  s      ;;==JJ$$&12x0@(-   / 	/ 	/ >	/s"   BBA%BBBBr   r   c           	        K   | j                   j                  ||       d{   }|t        k(  r| j                   j                          y| j                  j                  d       t        t        |      \  }}d| _        | j                  t        d      t        |j                  d            t        |j                  d            d       d{    y7 7 w)zStart password changeNTrying to chsnge passwordTr   Fr:   )r1   password_change_requestedNotImplementedrw   r2   ru   r   PasswordChangeResponser   rh   r   r   encode)r6   r   r   resultold_passwordnew_passwords         r7   _change_passwordz$_ClientPasswordAuth._change_password  s      zz;;FDII^#JJ$$&67%)*@&%I"l $ &|':':7'C D &|':':7'C D(-   / 	/ 	/ J	/s"    CCB.CCCCc                 `    | j                   r"d| _         | j                  j                          y y r|   )r   r1   password_changedrD   s    r7   r`   z"_ClientPasswordAuth.auth_succeeded  s(      $)D!JJ'') !r9   c                 `    | j                   r"d| _         | j                  j                          y y r|   )r   r1   password_change_failedrD   s    r7   rc   z_ClientPasswordAuth.auth_failed  s(      $)D!JJ--/ !r9   r   r   r   c                    |j                         }|j                         }	 |j                  d      }|j                  d      }| j	                          | j                  | j                  ||             y# t        $ r t        d      dw xY w)z!Process a password change requestr   r   zInvalid password change requestN)r   r   r   r   rc   r4   r   )r6   r   r   r   r   r   r   r   s           r7   _process_password_changez,_ClientPasswordAuth._process_password_change  s     ((*&&(
	M!((1F$$W-D 	..vt<=	 " 	M ABL	Ms   "A6 6BrH   )rI   rJ   rK   rL   r   r   r   rN   r8   rW   r   r   r`   rc   rM   r   r  MSG_USERAUTH_PASSWD_CHANGEREQr   rj   rk   s   @r7   r   r     s    5%gi1GHN&2 &E &
//S / / /**
0
> >c >)2>7;>" 	&'?r9   r   c                        e Zd ZU dZded<   dddededef fdZe	ddd	e
fd
       Zded	dfdZdde
d	dfdZddZ xZS )r)   z&Parent class for server authenticationr   r1   r-   usernamerS   r   c                 `    || _         || _        t        |   || j	                  |             y r0   )	_usernamerU   rV   r8   rW   r6   r-   r	  rS   r   rY   s        r7   r8   zServerAuth.__init__
  s)    !t{{623r9   r>   c                     t         )z6Return whether this authentication method is supportedr[   clsr-   s     r7   	supportedzServerAuth.supported  s
     "!r9   Nc                    K   t         w)z2Abstract method for starting server authenticationr[   r6   r   s     r7   rW   zServerAuth._start  r]   r^   partial_successc                 :    | j                   j                  |       y)z+Send a user authentication failure responseN)r1   send_userauth_failure)r6   r  s     r7   send_failurezServerAuth.send_failure  s     	

((9r9   c                 8    | j                   j                          y)z+Send a user authentication success responseN)r1   send_userauth_successrD   s    r7   send_successzServerAuth.send_success"  s     	

((*r9   )FrH   )rI   rJ   rK   rL   ri   r   rN   r   r8   classmethodrO   r  rW   r  r  rj   rk   s   @r7   r)   r)     s~    0  42 4c 44(14 "2 "t " "
"9 " ":D :T :
+r9   c                   :    e Zd ZdZedddefd       ZdeddfdZy)	_ServerNullAuthz'Server side implementation of null authr-   r   r>   c                      y)z>Return that null authentication is never a supported auth modeFrQ   r  s     r7   r  z_ServerNullAuth.supported+  s     r9   r   Nc                    K   yw)z4Supported always returns false, so we never get hereNrQ   r  s     r7   rW   z_ServerNullAuth._start1  s     s   	rI   rJ   rK   rL   r  rO   r  r   rW   rQ   r9   r7   r  r  (  s<    12 t  
C9 C Cr9   r  c                   ^     e Zd ZdZdddededef fdZeddde	fd	       Z
dedd
fdZ xZS )_ServerGSSKexAuthz3Server side implementation of GSS key exchange authr-   r   r	  rS   r   c                 T    t         |   ||||       |j                         | _        y r0   rV   r8   rv   r}   r  s        r7   r8   z_ServerGSSKexAuth.__init__8  &    x8((*	r9   r>   c                 "    |j                         S )z;Return whether GSS key exchange authentication is supported)gss_kex_auth_supportedr  s     r7   r  z_ServerGSSKexAuth.supported>       **,,r9   Nc                 $  K   |j                         }|j                          | j                  j                  d       | j                  j                  | j                        }| j                  j                  r| j                  j                  ||      rh| j                  j                  | j                  | j                  j                  | j                  j                         d{   r| j                          y| j                          y7 &w)z,Start server GSS key exchange authenticationrs   N)r   r   r2   ru   r1   r   rU   r}   r   verifyvalidate_gss_principalr  userhostr  r  )r6   r   micr   s       r7   rW   z_ServerGSSKexAuth._startD  s      !9:zz33DLLAII499#3#3D##>zz889=9=I I I Is   C%D'D('D)rI   rJ   rK   rL   r   rN   r   r8   r  rO   r  rW   rj   rk   s   @r7   r!  r!  5  s`    =+2 +c ++(1+ -2 -t - -
 9    r9   r!  c            
            e Zd ZdZ e e       d      Zdddedede	dd	f
 fd
Z
edddefd       Zde	dd	fdZddZdedede	dd	fdZdedede	dd	fdZdedede	dd	fdZdedede	dd	fdZeeeeeeeeiZ xZS )_ServerGSSMICAuthz*Server side implementation of GSS MIC authrz   r-   r   r	  rS   r   r>   Nc                 T    t         |   ||||       |j                         | _        y r0   r#  r  s        r7   r8   z_ServerGSSMICAuth.__init__\  r$  r9   c                 "    |j                         S )z2Return whether GSS MIC authentication is supported)gss_mic_auth_supportedr  s     r7   r  z_ServerGSSMICAuth.supportedb  r'  r9   c                   K   t               }|j                         }t        |      D ]!  }|j                  |j	                                # |j                          d}| j                  j                  D ]
  }||v s|} n |s| j                          y| j                  j                  d       | j                  j                          | j                  t        t        |             yw)z#Start server GSS MIC authenticationNr   )setr   r   addr   r   r}   r   r  r2   ru   r   rB   r   r   )r6   r   r   nr   matchr   s          r7   rW   z_ServerGSSMICAuth._starth  s      qAIIf'')* IIOODu} $
 01		5ve}Es   A9C)<A-C)c                    K   | j                   j                  | j                  | j                  j                  | j                  j
                         d{   r| j                          y| j                          y7 &w)z$Finish server GSS MIC authenticationN)r1   r*  r  r}   r+  r,  r  r  rD   s    r7   r   z_ServerGSSMICAuth._finish  sc      **33DNN48IINN48IINND D D Ds   AA>A<'A>r   r   c                 2   |j                         }|j                          	 | j                  j                  |      }|r | j	                  t
        t        |             yy# t        $ r}| j	                  t        t        |j                        t        |j                        t        t        |            t        t                     |j                  r)| j	                  t        t        |j                               | j!                          Y d}~yd}~ww xY w)z#Process a GSS token from the clientN)r   r   r}   r   rB   r   r   r   r   r   maj_codemin_coder   r   r   r   r  r   s         r7   r   z _ServerGSSMICAuth._process_token  s     "(!2!2!4	 IINN5)E  !:F5MJ  	 6s||8L#CLL16#c(3C#L13 yy  !;VCII=NO	 s   <A   	D)B#DDc                     |j                          | j                  j                  r6| j                  j                  s | j	                  | j                                y| j                          y)z7Process a GSS exchange complete message from the clientN)r   r}   r   r   r4   r   r  )r6   r   r   r   s       r7   _process_exchange_completez,_ServerGSSMICAuth._process_exchange_complete  sI     	99dii&B&BT\\^,r9   c                     |j                         }|j                          	 | j                  j                  |       y# t        $ r/}| j
                  j                  dt        |             Y d}~yd}~ww xY w)z)Process a GSS error token from the clientzGSS error from client: %sN)r   r   r}   r   r   r2   ru   r   r   s         r7   r   z&_ServerGSSMICAuth._process_error_token  sb     !!#	FIINN5! 	FKK:CHEE	Fs   > 	A6%A11A6c                 ~   |j                         }|j                          | j                  j                  | j                        }| j
                  j                  rR| j
                  j                  r<| j
                  j                  ||      r | j                  | j                                y| j                          y)z!Process a GSS MIC from the clientN)r   r   r1   r   rU   r}   r   r   r)  r4   r   r  )r6   r   r   r   r-  r   s         r7   _process_micz_ServerGSSMICAuth._process_mic  s     !zz33DLLAII499#?#?		  s+T\\^,r9   rH   )rI   rJ   rK   rL   r   r   r   r   rN   r   r8   r  rO   r  rW   r   rM   r   r=  r   r@  r   r   r   r   r   rj   rk   s   @r7   r/  r/  W  s0   4%gi1GHN+2 +c ++(1+6:+ -2 -t - -
F9 F F4  s  C  ( -1 ,	 3 	  	 +4	 9=	 
FS 
F# 
F%.
F37
F S  #  & +/   	"~-/I"/C|	r9   r/  c                   :    e Zd ZdZedddefd       ZdeddfdZy)	_ServerHostBasedAuthz-Server side implementation of host based authr-   r   r>   c                 "    |j                         S )z5Return whether host based authentication is supported)host_based_auth_supportedr  s     r7   r  z_ServerHostBasedAuth.supported       --//r9   r   Nc                 h  K   |j                         }|j                         }|j                         }|j                         }|j                         }|j                         }|j                          	 |j                  d      }t	        |j                  d            }	| j                  j                  d|	||       | j                  j                  | j                  |||	||       d{   r| j                          y| j                          y# t
        t        f$ r t        d      dw xY w7 Ew)z&Start server host based authenticationr   zInvalid host-based auth requestNz@Verifying host based auth of user %s on host %s with %s host key)r   get_consumed_payloadr   r   r   r   r   r   r2   ru   r1   validate_host_based_authr  r  r  )
r6   r   r   r   client_host_bytesclient_username_bytesr   	signaturer   r   s
             r7   rW   z_ServerHostBasedAuth._start  s1     %%'	$$&"--/ & 1 1 3))+%%'		M+227;K&'<'C'CG'LMO 	 9:I&		3 **55dnn6>6E699F F F  #M2 	M ABL	MFs+   A1D24+D AD2*D0+&D2D--D2r  rQ   r9   r7   rB  rB    s9    702 0t 0 0
 9    r9   rB  c                   :    e Zd ZdZedddefd       ZdeddfdZy)	_ServerPublicKeyAuthz-Server side implementation of public key authr-   r   r>   c                 "    |j                         S )z5Return whether public key authentication is supported)public_key_auth_supportedr  s     r7   r  z_ServerPublicKeyAuth.supported  rE  r9   r   Nc                 N  K   |j                         }|j                         }|j                         }|r!|j                         }|j                         }nd}d}|j                          |r| j                  j                  d|       n| j                  j                  d|       | j                  j                  | j                  |||       d{   r=|r| j                          y| j                  t        t        |      t        |             y| j                          y7 Rw)z&Start server public key authenticationr9   zVerifying request with %s keyr   N)r   r   rG  r   r2   ru   r1   validate_public_keyr  r  rB   r   r   r  )r6   r   sig_presentr   r   r   rK  s          r7   rW   z_ServerPublicKeyAuth._start  s     ((*%%'	$$&--/C))+ICIKK>	JKKCYO**0014iA A A!!#  !3VI5F!'!13 As   CD%D#AD%r  rQ   r9   r7   rM  rM    s9    702 0t 0 0
 9    r9   rM  c                       e Zd ZdZ e e       d      Zedddefd       Z	de
ddfd	Zd
eddfdZdeddfdZdedede
ddfdZeeiZy)_ServerKbdIntAuthz7Server side implementation of keyboard-interactive authr   r-   r   r>   c                 "    |j                         S )z?Return whether keyboard interactive authentication is supported)kbdint_auth_supportedr  s     r7   r  z_ServerKbdIntAuth.supported&  s     ))++r9   r   Nc                   K   |j                         }|j                         }|j                          	 |j                  d      }|j                  d      }| j
                  j                  d       | j                  j                  | j                  ||       d{   }| j                  |       y# t        $ r t	        d      dw xY w7 /w)z0Start server keyboard interactive authenticationr   r   z)Invalid keyboard interactive auth requestNr   )r   r   r   r   r   r2   ru   r1   get_kbdint_challenger  _send_challenge)r6   r   r   submethods_bytesr   r   	challenges          r7   rW   z_ServerKbdIntAuth._start,  s      &&(
!,,.	:$$W-D)009J
 	=>**99$..:>
L L	Y' " 	: !/ 059:	:Ls)   1C"B2 ACCC2CCr[  c           	      ,   t        |t        t        f      r[|\  }}}}t        |      }d |D        } | j                  t
        t        |      t        |      t        |      t        |      g|  y|r| j                          y| j                          y)z2Send a keyboard interactive authentication requestc              3   P   K   | ]  \  }}t        |      t        |      z      y wr0   )r   r   )r   r   r   s      r7   r   z4_ServerKbdIntAuth._send_challenge.<locals>.<genexpr>G  s)      :18 $F^gdm;18s   $&N)

isinstancetuplelistr   rB   r   r   r   r  r  )r6   r[  r   r   r   r   r   prompts_bytess           r7   rY  z!_ServerKbdIntAuth._send_challenge@  s     i%//8,D+tWg,K:18:M D6t#K0&,#K0B3@B r9   r   c                    K   | j                   j                  | j                  |       d{   }| j                  |       y7 w)z7Validate a keyboard interactive authentication responseN)r1   validate_kbdint_responser  rY  )r6   r   next_challenges      r7   _validate_responsez$_ServerKbdIntAuth._validate_responseR  s<      **55dnniPP 	^, Qs   *AAAr   r   c                 @   |j                         }g }t        |      D ]5  }|j                         }	 |j                  d      }|j                  |       7 |j                          | j                  | j                  |             y# t        $ r t        d      dw xY w)z6Process a keyboard interactive authentication responser   z*Invalid keyboard interactive info responseN)
r   r   r   r   r   r   r   r   r4   re  )	r6   r   r   r   num_responsesr   r   response_bytesresponses	            r7   _process_info_responsez(_ServerKbdIntAuth._process_info_responseY  s     ))+	}%A#..0N?)009
 X& & 	00;< & ?# %4 5:>??s   BB)rI   rJ   rK   rL   r   r   r   r  rO   r  r   rW   KbdIntChallengerY  KbdIntResponsere  rM   rj  r   r   rQ   r9   r7   rT  rT  !  s    A%gi1EFN,2 ,t , ,
(9 ( ((   T  $-. -T -=s =C ='0=59=, 	#$:r9   rT  c                   :    e Zd ZdZedddefd       ZdeddfdZy)	_ServerPasswordAuthz+Server side implementation of password authr-   r   r>   c                 "    |j                         S )z3Return whether password authentication is supported)password_auth_supportedr  s     r7   r  z_ServerPasswordAuth.supportedv  s     ++--r9   r   Nc                 ^  K   |j                         }|j                         }|r|j                         nd}|j                          	 t        |j	                  d            }t        |j	                  d            }	 |rK| j                  j                  d       | j                  j                  | j                  ||       d{   }nI| j                  j                  d       | j                  j                  | j                  |       d{   }|r| j                          y| j                          y# t
        t        f$ r t        d      dw xY w7 7 I# t         $ rG}| j#                  t$        t'        |j(                        t'        |j*                               Y d}~yd}~ww xY ww)z$Start server password authenticationr9   r   zInvalid password auth requestNr   r   )r   r   r   r   r   r   r   r   r2   ru   r1   change_passwordr  validate_passwordr  r  r   rB   r  r   r   r   )	r6   r   password_changepassword_bytesnew_password_bytesr   r   r   r   s	            r7   rW   z_ServerPasswordAuth._start|  s     !,,.**,4CV..0	K 5 5g >?H#$6$=$=g$FGL	C""#>?#zz99$..:B:F H H ""#9: **66t~~xPP  !!#!!#' #M2 	K ?@dJ	KH Q & 	C:#CJJ/1AC C	Cst   AF-4D7 =AE EA	E EE %F-&E 6F-7EF-E E 	F*#=F% F-%F**F-r  rQ   r9   r7   rn  rn  s  s<    5.2 .t . .
!C9 !C !Cr9   rn  algclient_handlerserver_handlerr>   c                 R    t         j                  |        |t        | <   |t        | <   y)z!Register an authentication methodN)r&   r   r(   r*   )rw  rx  ry  s      r7   register_auth_methodr{    s(     !/#!/#r9   c                  >    t         D  cg c]	  } | dk7  r|  c} S c c} w )z.Return a list of supported client auth methods   none)r(   )rS   s    r7   !get_supported_client_auth_methodsr~    s1     "7 "!6v  !6 " " "s   r-   r   rS   c                 2    |t         v rt        |   | |      S y)z/Look up the client authentication method to useN)r&   r(   )r-   rS   s     r7   lookup_client_authr    s!     $V,T6::r9   r   c                 t    g }t         D ],  }t        |   j                  |       s|j                  |       . |S )z.Return a list of supported server auth methods)r&   r*   r  r   )r-   auth_methodsrS   s      r7   !get_supported_server_auth_methodsr    s<     L (2248'   r9   r	  r   c                     t         j                  |      }|r|j                  |       r || |||      S | j                  d       y)z/Look up the server authentication method to useFN)r*   getr  r  )r-   r	  rS   r   r@   s        r7   lookup_server_authr    sF    
 $''/G7$$T*tXvv66""5)r9   r}  s   gssapi-keyexs   gssapi-with-mics	   hostbaseds	   publickeys   keyboard-interactives   password)TrL   typingr   r   r   r   r   r   r	   r
   r   r   	constantsr   gssr   r   loggingr   miscr   r   r   r   r   r   r   r   r   
public_keyr   r   r   asyncio
connectionr   r   r   r   rO   r   KbdIntNewChallengerk  rl  r   r   r   r   r   r   r   r   r   r   r  r&   rN   ri   r(   r*   r,   r'   rm   rq   ry   r   r   r   r   r)   r  r!  r/  rB  rM  rT  rn  r{  r~  r  r  r  _auth_method_list_argsrQ   r9   r7   <module>r     s  * " A A 5 5 # "  I I H H " -  ?/ sDy)*3S-78 001#sCx  )+ (* (* %(* (* (*  )+  )+ (*  )+ tE{ 9; tE4#556 ;9; tE4#556 ;   F@ @>"j "'
 'x
 xv': '64: 4nE
 EPI* IX +  +F
Cj 
C 
  Dv
 vr% : % P& : & RO
 Od*C* *CZ0e 0T*5E 0Z(0-10"8E? "2 $)1*)=
,A 

2 c $.7 oOD/4EF/4EF24HI24HI/4EF14GH  E%  r9   