mgdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z ddlmZddlmZddlmZddlmZmZmZmZmZmZddlmZmZmZmZmZmZm Z dd lm!Z!m"Z"m#Z#dd l$m%Z%m&Z&d d l'm(Z(m)Z)d d l*m+Z+m,Z,m-Z-m.Z.d dl*m/Z/m0Z0d dl*m1Z1m2Z2d dl*m3Z3m4Z4d dl5m6Z6m7Z7d dl8m9Z9m:Z:m;Z;d dl8mZ>d dl8m?Z?m@Z@d dlAmBZBd dlCmDZDmEZEmFZFd dlCmGZGmHZHd dlCmIZImJZJd dlKmLZLmMZMmNZNmOZOd dlPmQZQmRZRd dlPmSZSd dlPmTZTd dlPmUZUmVZVmWZWmXZXd dlPmYZYmZZZm[Z[d dlPm\Z\m]Z]d d lPm^Z^d d!lPm_Z_m`Z`d d"lPmaZambZbmcZcmdZdd d#lPmeZemfZfd d$lPmgZgmhZhd d%lPmiZimjZjd d&lPmkZkmlZld d'lPmmZmd d(lPmnZnmoZod d)lPmpZpd d*lqmrZrmsZsd d+lqmtZtd d,lqmuZumvZvd d-lwmxZxd d.lymzZzm{Z{m|Z|m}Z}d d/l~mZmZmZd d0l~mZmZd d1lmZmZd d2lmZmZd d3lmZmZd d4lmZmZd d5lmZmZd d6lmZmZd d7lmZmZd d8lmZd d9lmZmZd d:lmZmZd d;lmZmZmZmZmZd dlmZmZmZd d?lmZmZmZd d@lmZmZmZd dAlmZmZd dBlmZmZd dClmZmZd dDlmZmZmZd dElmZmZmZd dFlmZmZmZmZmZmZd dGlmZmZmZd dHlmZd dIlmZd dJlmZmZmZd dKlmZmZd dLlmZmZd dMlmZmZmZd dNlmZmZmZmZd dOlmZmZmZmZd dPlmZmZd dQlmZmZd dRlmZmZd dSlmZmZd dTlmZmZd dUlmZd dVlmZd dWlmZmZd dXlmZmZd dYlmZd dZlmZmZd d[lmZmZd d\lmZd d]lmZmZmZd d^lmZmZmZd d_lmZmZd d`lmZmZd dalmZmZmZd dblmZd dclm Z m Z m Z d ddlm Z m Z d delmZmZd dflmZmZd dglmZd dhlmZmZd dilmZmZd djlmZmZd dklmZmZd dllmZd dmlm Z d dnlm!Z!m"Z"d dolm#Z#m$Z$er d dpl%m&Z&egeBfZ'egefZ(e"e'e(fZ)e!dqdrsZ*e!dtdusZ+eeeeeeeeeegedfZ,Gdvdwe%Z-Gdxdye-e%Z.Gdzd{e-e%Z/eedrgedfZ0eedree1gdfZ2eegee:effZ3eegdfZ4ee"e5ee5fZ6ee7Z8ee"de5ee5e6fZ9e"eefZ:e"eefZ;ee"ee5e5fee5fZee?efZ@ee5eAfZBe"e7efZCee"e5ee5fZDe"e7e5fZEee5e?ge fZFege fZGe"de5e.fZHe"de5e/fZIeeZJee5e?gee7fZKd|ZLd}ZMd~ZNdZOdZPd~ZQdZRdZSdZTdZUdZVdZWdZXdZYd~ZZdejdee5dege*fde*fdZ\deAdeedeeLdedfdZ]ddtdeeLdejde?deejdege*fde5de*fdZ^ddtdeeLdejde?de?deejde7de7dege*fde5ddfdZ_deede`fdZade5de5dee`dee`de7dee`f dZb dde5de6de6dee`dee`dee`dee`fdZcde6de6dee`dee`fdZddeMde6de6de6de6de6de7deee`ee`ee`ee`ee`ffdZeGddZfGddreejJZgGddegZhGddegZiGddueZjGddejZkGddejZle ddejdeeLdeekdeAdehf dZme ddejdeeLdeeldeAdeif dZneddddddddddee?deeHdee?de?deedeejdeeLdeekdeAdehfd„Zoe ddddddddddee?deeHdee?de?deedeejdeeLdeeldeAdeifdÄZpedddejdddddddddƜ dee?deeIdee?de?de?deejde7de7dǐe0dȐe2deeLdeeldeAdeffdɄZredddejdddddddddƜ dee?deeIdee?de?de?deejde7de7dǐe0dȐe2deeLdeekdeAdeffdʄZs ddːe'dee?deAdeeheBffd̄Zte dd͐e(dee?deAdeffd΄Zu dddddddddddddϜ dee?deeHdeeDdee?de?deedeejdeedҐe6dӐe6deeLdeekdeefdԄZv dddddddddddddϜ dee?dee5deeHdeeDdee?de?deedeejdeedҐe6dӐe6deeLdeekdee5fdքZwy)zSSH connection handlersN) OrderedDict)partial)Path) TracebackType) TYPE_CHECKINGAnyAnyStr AwaitableCallableDict)ListMappingOptionalSequenceSetTupleType)TypeVarUnioncast)ProtocolSelf)SSHAgentClientSSHAgentListener)Auth ClientAuthKbdIntChallenge KbdIntPrompts)KbdIntResponsePasswordChangeResponse)!get_supported_client_auth_methodslookup_client_auth)!get_supported_server_auth_methodslookup_server_auth)SSHAuthorizedKeysread_authorized_keys) SSHChannelSSHClientChannelSSHServerChannel) SSHTCPChannelSSHUNIXChannelSSHTunTapChannel) SSHX11ChannelSSHAgentChannel) SSHClient) Compressor Decompressorget_compression_algs)get_default_compression_algsget_compression_params)get_compressorget_decompressor) ConfigPaths SSHConfigSSHClientConfigSSHServerConfig) DEFAULT_LANG DEFAULT_PORT)DISC_BY_APPLICATION)EXTENDED_DATA_STDERR)MSG_DISCONNECT MSG_IGNOREMSG_UNIMPLEMENTED MSG_DEBUG)MSG_SERVICE_REQUESTMSG_SERVICE_ACCEPT MSG_EXT_INFO)MSG_CHANNEL_OPENMSG_CHANNEL_OPEN_CONFIRMATION)MSG_CHANNEL_OPEN_FAILURE)MSG_CHANNEL_FIRSTMSG_CHANNEL_LAST) MSG_KEXINIT MSG_NEWKEYS MSG_KEX_FIRST MSG_KEX_LAST)MSG_USERAUTH_REQUESTMSG_USERAUTH_FAILURE)MSG_USERAUTH_SUCCESSMSG_USERAUTH_BANNER)MSG_USERAUTH_FIRSTMSG_USERAUTH_LAST)MSG_GLOBAL_REQUESTMSG_REQUEST_SUCCESS)MSG_REQUEST_FAILURE) OPEN_ADMINISTRATIVELY_PROHIBITEDOPEN_CONNECT_FAILED)OPEN_UNKNOWN_CHANNEL_TYPE) Encryptionget_encryption_algs)get_default_encryption_algs)get_encryption_paramsget_encryption) SSHForwarder)GSSBase GSSClient GSSServerGSSError)Kex get_kex_algsget_default_kex_algs)expand_kex_algsget_kex) KeySignPathSSHKeySignKeyPair) find_keysignget_keysign_keys) KnownHostsArgmatch_known_hosts) ListenKey SSHListener)SSHTCPClientListenerSSHUNIXClientListener)TCPListenerFactoryUNIXListenerFactory)create_tcp_forward_listenercreate_unix_forward_listener)create_socks_listener) SSHLoggerlogger) get_mac_algsget_default_mac_algs) BytesOrStrBytesOrStrDictDefTupleFilePathHostPort) IPNetwork MaybeAwait OptExcInfoOptionsSockAddr)ChannelListenErrorChannelOpenErrorCompressionError)DisconnectErrorConnectionLostHostKeyNotVerifiable)KeyExchangeFailedIllegalUserNameMACError)PasswordChangeRequiredPermissionDenied ProtocolError)ProtocolNotSupportedServiceNotAvailable) TermModesArg TermSizeArg)async_context_managerconstruct_disc_error)get_symbol_names ip_addressmap_handler_name)parse_byte_countparse_time_interval split_args)BooleanByteNameListStringUInt32PacketDecodeError) SSHPacketSSHPacketHandlerSSHPacketLogger)WildcardPattern)load_pkcs11_keys)PIPE ProcessSource ProcessTarget)SSHServerProcessFactorySSHCompletedProcess)SSHClientProcessSSHServerProcess)CERT_TYPE_HOSTCERT_TYPE_USERKeyImportError) CertListArgIdentityListArg KeyListArg SigningKey)KeyPairListArgX509CertPurposesSSHKey SSHKeyPair)SSHCertificateSSHOpenSSHCertificate)SSHX509CertificateSSHX509CertificateChain)decode_ssh_public_keydecode_ssh_certificate)get_public_key_algsget_default_public_key_algs)get_certificate_algsget_default_certificate_algs)get_x509_certificate_algs)!get_default_x509_certificate_algs) load_keypairsload_default_keypairs)load_public_keysload_default_host_public_keys)load_certificates)load_identitiesload_default_identities)saslprep SASLPrepError) SSHServer)DataTypeSSHClientSessionSSHServerSession) SSHTCPSessionSSHUNIXSessionSSHTunTapSession)SSHClientSessionFactorySSHTCPSessionFactory)SSHUNIXSessionFactorySSHTunTapSessionFactory)MIN_SFTP_VERSION SFTPClient SFTPServer)start_sftp_client) SSHReader SSHWriterSFTPServerFactory)SSHSocketSessionFactorySSHServerSessionFactory)SSHClientStreamSessionSSHServerStreamSession)SSHTCPStreamSessionSSHUNIXStreamSession)SSHTunTapStreamSession)SSHSubprocessTransportSSHSubprocessProtocol)SubprocessFactorySSHSubprocessWritePipe)SSH_TUN_MODE_POINTTOPOINTSSH_TUN_MODE_ETHERNET)SSH_TUN_UNIT_ANY create_tuntap) __version__)SSHX11ClientForwarder)SSHX11ClientListenerSSHX11ServerListener)create_x11_client_listenercreate_x11_server_listener)X509NamePattern_Conn SSHConnection)bound_OptionsSSHConnectionOptionsceZdZdZddZy)_TunnelProtocolz0Base protocol for connections to tunnel SSH overNcyzClose this tunnelNselfs 3lib/python3.12/site-packages/asyncssh/connection.pyclosez_TunnelProtocol.closereturnN)__name__ __module__ __qualname____doc__rrr rrrs : r rc DeZdZdZdeedededee ee effdZ y)_TunnelConnectorProtocolz>Protocol to open a connection to tunnel an SSH connection oversession_factory remote_host remote_portr c Kyw)z$Create an outbound tunnel connectionNr)rrrrs rcreate_connectionz*_TunnelConnectorProtocol.create_connectionN) r r rrrbytesstrintrr+rrrr rrrsEH3#7#>33+.3mE*M%,@@A3r rc(eZdZdZdedededefdZy)_TunnelListenerProtocolz:Protocol to open a listener to tunnel SSH connections overr listen_host listen_portr c Kyw)z!Create an inbound tunnel listenerNr)rrrrs r create_serverz%_TunnelListenerProtocol.create_serverrrN) r r rrrurrrrr!rr rrrs*D03E0),0;>0CN0r rs ssh-userauthsssh-connectionii i@ixi iiloopcommand conn_factoryr cKGfddtj}|j|g|d{\}}ttt||j S7/w)z%Open a tunnel running a proxy commandceZdZdZdfd ZddededefdZdefdZ d e jddfd Z d e d eddfd Zd e deeddfdZd eddfdZddZddZxZS)(_open_proxy.._ProxyCommandTunnelzSSH proxy command tunnelr Nct|d|_d|_|_t j |_yN)super__init__ _transport_stdin_connasyncioEvent _close_event)r __class__r's rr.z1_open_proxy.._ProxyCommandTunnel.__init__s3 G  EIDO<@DK%DJ ' D r namedefaultcV|jJ|jj||S)z4Return extra information associated with this tunnel)r/get_extra_inforr6r7s rr9z7_open_proxy.._ProxyCommandTunnel.get_extra_info's+??. ..??11$@ @r c|jS)z1Return the connection associated with this tunnel)r1rs rget_connz1_open_proxy.._ProxyCommandTunnel.get_conn-s:: r  transportcttj||_ttj|jj d|_|jjttj|y)z Handle startup of the subprocessrN) rr2SubprocessTransportr/WriteTransportget_pipe_transportr0r1connection_made BaseTransport)rr=s rrBz8_open_proxy.._ProxyCommandTunnel.connection_made2s^#7#>#> JDOw55#AA!DFDK JJ & &tG,A,A4'H Ir fddatac:|jj|y)z%Handle data received from this tunnelN)r1 data_received)rrDrEs rpipe_data_receivedz;_open_proxy.._ProxyCommandTunnel.pipe_data_received:s JJ $ $T *r excc:|jj|y)z!Handle when this tunnel is closedN)r1connection_lost)rrDrIs rpipe_connection_lostz=_open_proxy.._ProxyCommandTunnel.pipe_connection_lostAs JJ & &s +r cV|jJ|jj|y)zWrite data to this tunnelN)r0writerrEs rrNz._open_proxy.._ProxyCommandTunnel.writeIs&;;* ** KK  d #r c$|jy)zForcibly close this tunnelN)rrs rabortz._open_proxy.._ProxyCommandTunnel.abortOs  JJLr c|jr|jj|jjyr)r/rr4setrs rrz._open_proxy.._ProxyCommandTunnel.closeTs-%%'    ! ! #r r r,)r r rrr.rrr9rr<r2rCrBrrrHr ExceptionrLrNrQr __classcell__)r5r's@r_ProxyCommandTunnelr*s& 0 As AS AC A  e   JW-B-B Jt J + +E +d + ,3 ,&.y&9 ,>B , $e $ $    $r rVN)r2SubprocessProtocolsubprocess_execrrr<)r%r&r'rV_tunnels ` r _open_proxyr[s_ >$g88>$B+d**+>IIIIAv t/8AAC DDJs2A'A%0A'tunnels passphraseconfigSSHClientConnectionc FKt|trd}|jdD]s}d|vr|jdd\}}nd|}}d|vr!|jdd\}}t |}nd}|} t ||||||d{}|j | u|Sy7w)z(Parse and open connection to tunnel overN,@rr:)usernamer]rZr^) isinstancersplitrsplitrconnect set_tunnel) r\r]r^connrZrdhostport_strport last_conns r _open_tunnelrobs'3.2mmC(Ff}!'sA!6$!#V$d{!%S!!4h8}I th,6t(.00D OOI &!)$ 0sBB!BB!optionsflagssockmsgcK|j}|j}|j} |j} |j} |j } d} |j |_t| |j|d{} |rFtjd||j||d{\}}tt|}nG|rv|jjd|||f|  |jttt |||d{\}}tt|}|j#|n| rjt+| dt}|jd|||f| jttt |||d{\}}tt|}nc| rt-|| |d{}nKtjd|||f|j|||| || d{\}}tt|} |jd{d } || r)|j5|j)d{SS777C#t$$r+|j'|j)d{7wxYw777#t.j0$r|jj3wxYw77#| r*|j5|j)d{7wwxYww) z,Make outbound TCP or SSH tunneled connectionTN%s already-connected socket)rr %s %s via %sr{%s %s via SSH tunnel%s %s)familyrq local_addrF)rkrmrZryrz proxy_command create_futurewaiterror]r{inforrrrrrirTr wait_closedgetattrr[r2CancelledErrorcancelrQ)rpr^r%rqrrr'rsrkrmrZryrzr{ free_conn new_tunnelrYsessionrjtunnel_session tunnel_loggers r_connectrs <,>GGJ+  KK5s ;#55l5NNJAww'D     " ">3t f M ,*4*F*F-e4lC$+ % !>E>2 + #FHf=M   5sT4L I&,&>&>)%0,?d'! A~~.D $T=,GGD KKtTl 3#55dD  6 44JAww'D %nn   JJL""$ $ $ kHO%    " ,,... ! H4  ! !   %  JJL""$ $ $ sA:L<I=L.J0I1;J-+III A5JJ*JJ8J9J:JK!K "K)%LKLJI,J J  JJJJ/K  L KL&K?7K:8K??Lbacklog reuse_address reuse_port SSHAcceptorc Kdtdtdtffd } |j} |j} |j } |j }t| |j|d{}|r6tjd| |j||||d{}n|rh|jjd| | | f|  |j| | | d{}|j|ttj|}n| r\t'| d t}|jd | | | f| j| | | d{}ttj|}n:tjd | | | f|j| | ||||| d{}t)||S7K77#t $r+|j#|j%d{7wxYw77Qw) z)Make inbound TCP or SSH tunneled listener _orig_host _orig_portr c.ttS)zIgnore original host and port)rr)rrr's rtunnel_factoryz_listen..tunnel_factorysM<>22r Nru)rrrrrrvr{rwrx)ryrqrrr)rrrrkrmrZryror]r{r~r!rirr2AbstractServerrTrrrr)rpr^r%rqrrrrrr'rsrrkrmrZryrserver tunnel_serverrs ` r_listenrs333C3M3 <,>GGJ  137/3/A/A tW'J0B0@*@ ~sT4L&I A",":":d#,,M  $ $Z 0'00-@F &9 13t E$22>4NN g,,m< GS4,/)) $V5=!*## vw ''KH *@,     ((* * *  O #szA#G4&F1'5G4F4(G4F9F7F9!A*G4 G0 AG4 G2!G44G47F99,G-%G(&G--G42G4versionc|dk(rdtjdz}|St|tr|jd}nt|tsJt |dkDr t d|D]}|dks|dkDst d|S) zValidate requested SSH versionrs AsyncSSH_asciizVersion string is too long ~z&Version string must be printable ASCII)rencodererrlen ValueError)rbs r_validate_versionrs"}!3!3G!<< N gs #nnW-Ggu- -- w<# 9: :A4x1t8 !IJJ Nr alg_typealgs possible_algs default_algs strict_matchc |dddvr |dd}|dd}nd}g}|jdD]c}t|}|D cgc]$} |j| jdr| &} } | s|rt d|d|d |j | e|d k(r||zS|d k(r||zS|d k(r|D cgc] } | |vs|  c} S|Scc} wcc} w) z$Expand the set of allowed algorithmsNrz^+-rar"z" matches no valid z algorithms^+-)rfrmatchesdecoderextend) rrrrrprefixmatchedpatpatternalgrs r _expand_algsrs  BQx5bqABxGzz#!#&"/<-3oocjj&9:-<<!8-. . w}%% 3g%% 3+B|s'/A|BB!<Cs)B>+ C5C config_algs none_valuec`|dk(r|}d}nd}|dvr|S|rt|trt|||||}n|Dcgc]}|jd}}g} |D]<}||vr t |j dd|d|| vs,| j |>| S|r|gSt d|zcc}w) z"Select a set of allowed algorithmsrFT)rr7rz is not a valid z algorithmzNo %s algorithms selected)rerrrrrappend) rrrrrrr expanded_algsrresults r _select_algsrBs  rz    dC (4)5|EM=AADSSZZ0DMA  C-' "%**W"5x"ABB&  c" ! |4x?@@!BsB+c`ttztz}td||||S)z+Select a set of allowed host key algorithmszhost key)rrrr)rrrrs r_select_host_key_algsrgs:/03G3II(*+M  D+%| 55r  kex_algs_arg enc_algs_arg mac_algs_arg cmp_algs_arg sig_algs_arg allow_x509c td|tt|jddt t }td|tt|jddt t}td|tt|jddtt} td|tt|jttd } |r tng} | tz} |r tng} | tz} td |tt|jd d| | } ||| | | fS) zValidate requested algorithms key exchange KexAlgorithmsr encryptionCiphersMACMACs compressionnone signatureCASignatureAlgorithms)rr_AlgsArggetrgrhr]r^r|r}r3r4rrrr)r^rrrrrrkex_algsenc_algsmac_algscmp_algsallowed_sig_algsdefault_sig_algssig_algss r_validate_algsrrsFNL 6::or+JK(N,@,BDHL, 6::i+DE/179;HE< 6::fb+AB(N,@,BDHM< 6+F+F+HI028:GEH 7A02b'*=*??>H8:b'*E*GGK !',CR!HJ,.>@H Xx8 ;;r ceZdZdZdej ddfdZdefdZde e e d e e d e e de fd Zd edefd ZdeefdZdefdZddZddZdeddfdZy)raJSSH acceptor This class in a wrapper around an :class:`asyncio.Server` listener which provides the ability to update the the set of SSH client or server connection options associated with that listener. This is accomplished by calling the :meth:`update` method, which takes the same keyword arguments as the :class:`SSHClientConnectionOptions` and :class:`SSHServerConnectionOptions` classes. In addition, this class supports all of the methods supported by :class:`asyncio.Server` to control accepting of new connections. rrprc ||_||_yr,)_server_options)rrrps rr.zSSHAcceptor.__init__s  r r cK|Swr,rrs r __aenter__zSSHAcceptor.__aenter__s   _exc_type _exc_value _tracebackc`K|j|jd{y7w)NF)rrrrrrs r __aexit__zSSHAcceptor.__aexit__s+     !s $.,.r6c.t|j|Sr,)rr)rr6s r __getattr__zSSHAcceptor.__getattr__st||T**r ct|jdr|jjS|jDcgc]}|j c}Scc}w)aReturn socket addresses being listened on This method returns the socket addresses being listened on. It returns tuples of the form returned by :meth:`socket.getsockname`. If the listener was created using a hostname, the host's resolved IPs will be returned. If the requested listening port was `0`, the selected listening ports will be returned. :returns: A list of socket addresses being listened on get_addresses)hasattrrrsockets getsockname)rrrs rrzSSHAcceptor.get_addressessJ 4<< 1<<--/ /37<<@<4D$$&<@ @@sAct|jdr|jjStd|j D}t |dk(r|j SdS)aReturn the port number being listened on This method returns the port number being listened on. If it is listening on multiple sockets with different port numbers, this function will return `0`. In that case, :meth:`get_addresses` can be used to retrieve the full list of listening addresses and ports. :returns: The port number being listened on, if there's only one get_portc3&K|] }|d yw)rNr).0addrs r z'SSHAcceptor.get_port..sA,@DQ,@rr)rrrrSrrpop)rportss rrzSSHAcceptor.get_portsY 4<< ,<<((* *AD,>,>,@AAE"%e*/599; 8q 8r Nc8|jjy)zStop listening for new connections This method can be called to stop listening for new SSH connections. Existing connections will remain open. N)rrrs rrzSSHAcceptor.closes r cTK|jjd{y7w)zWait for this listener to close This method is a coroutine which waits for this listener to be closed. N)rrrs rrzSSHAcceptor.wait_closedsll&&(((s (&(kwargsc :|jj|y)aUpdate options on an SSH listener Acceptors started by :func:`listen` support options defined in :class:`SSHServerConnectionOptions`. Acceptors started by :func:`listen_reverse` support options defined in :class:`SSHClientConnectionOptions`. Changes apply only to SSH client/server connections accepted after the change is made. Previously accepted connections will continue to use the options set when they were accepted. N)rupdaterrs rrzSSHAcceptor.updates V$r r )r r rrr2rr.rrrr BaseExceptionrboolrrrrr rrrrrrobjectrrr rrrs  w55 0 $$}2E)F$,]$;$,]$;@D+++AtE{A&9#9&)%v%$%r c> eZdZdZeedZdZede fdZ de jddd e d ed eed ef d ZdefdZdeeedeedeedefdZedefdZdeeddfdZddZddZddZ ddZ!ddZ"ddZ#ddZ$deeddfdZ%deed d!ddfd"Z& dd#e'ddeedd!fd$Z(defd%Z)defd&Z*d'Z+dee,e-e.ffd(Z/de0fd)Z1d*ee2ddfd+Z3d,e4d-ed.ed/ee ddf d0Z5d-ed.ed/e d1e6de7f d2Z8d-ed1e9de7fd3Z:d-ed.ed/e d4e0de7f d5Z;d6e jxddfd7Z=ddeeddfd8Z> dd9ee?d:eeddfd;Z@dd<ZAdd=e0d>eBddfd?ZCdd@ZDddAZEddBZFdCeGeHde fdDZIdEe ddfdFZJdeKfdGZLddHZMdIedJeNe0dKeNe0de0fdLZOdePe0fdMZQd=e0ddfdNZRddOZSdefdPZTdefdQZUdefdRZVddSdTe dUe0dVeeWddfdWZXddXZYdYe dZed[eddfd\ZZdd]Z[dd^Z\d_e0d`e0ddfdaZ]dbe0ddfdcZ^dde0dUe_e0defde0fdfZ`dde0dUe0de0fdgZaddhdidTe dUe0dVeeWdjeddf dkZbddhdldde0dUe0dmeecdjeddf dnZddoeddfdpZeddqZfdre dEe dse dte due0ddf dvZgdre dYe dZed[eddf dwZhdxdydze0dUe0d{eddfd|Zidze0dUe0de_e ejffd}Zkd~e,ee0fddfdZlddZmddZnde de dejddfdZode de dejddfdZpde de dejddfdZqde de dejddfdZrde de dejddfdZsde de dejddfdZtde de dejddfdZude de dejddfdZvde de dejddfdZwde de dejddfdZxdedde0dejddfdZyde de dejddfdZzde de dejddfdZ{de de dejddfdZ|de de dejddfdZ}dTe de dejddfdZ~de de dejddfdZde de dejddfdZde de dejddfdZdejddfdZieeoeepeeqeereeseeteeueeveeweexeezee{ee|ee}ee~ee~eeeeeeiZddZddZddZefdYe dZed[eddfdZddededefdZdeddfdZ dde,deefdee ddfdZedxfded[ededdfdZddeefdeedede de def dZddeefdeedede de def dZeefde de defdZeefde de defdZeefde de defdZ dddeeddeeHdede dede deedede de de_eeHeeHffdZddeeddeeHdedeedede de de_eeHeeHffdZdede defdZdedefdZe ddede dede deedef dĄZedededefdƄZde dee defdɄZdeddfd˄ZdCeGeHddfd̄Zy)rz Parent class for SSH connectionsMSG_rr cXtj}txjdz c_|S)z9Return the next available connection number (for logging)r)r next_conn)rs r_get_next_connzSSHConnection._get_next_conn s&"++ 1$r r%rpracceptor error_handlerwaitrcr ||_||_|j|_||_||_||_||_|r |jnd|_ d|_ d|_ d|_ d|_ d|_d|_|j |_d|_i|_d|_d|_d|_d|_|j0|_d|_d|_d|_d|_d|_d|_d|_ d|_!d|_"d|_#d|_$g|_%|jL|_'d|_(d|_)d|_*d|_+d|_,d|_-d|_.d|_/d|_0d|_1d|_2tg|_4g|_5tg|_6tg|_7|jp|_9|jt|_;tg|_<g|_=g|_>|j~|_@|j|_B|j|_D|j|_F|j|_H|j|_J|j|_L|j|_N|j|_P|j|_Rd|_Sd|_Td|_Ud|_Vd|_Wd|_Xd|_Yd|_Zd|_[d|_\d|_]|j|__|j|_ad|_bd|_cd|_d|j|_f|j|_hd|_id|_jd|_kd|_ld|_md|_nd|_od|_pd|_qt|_sd|_ttg|_ud|_vd|_wd|_xd|_yd|_zd|_{dg|_|d |_}d|_~i|_d|_g|_g|_i|_d|_t j |_d|_tjd |jz |_||jr@|jj|j|j|_d|_yd|_d|_y) Nrrr FgrTzconn=%d)context)_looprprotocol_factory_protocol_factory _acceptor_error_handlerr_waitr}_waiterr/ _local_addr _local_port _peer_host _peer_addr _peer_port tcp_keepalive_tcp_keepalive_owner_extra_inpbuf_packet_pktlen _banner_linesr_version_client_version_server_version_client_kexinit_server_kexinit _session_id _send_seq_send_encryption_send_enchdrlen_send_blocksize _compressor_compress_after_auth_deferred_packets _recv_version _recv_handler _recv_seq_recv_encryption_recv_blocksize _recv_macsize _decompressor_decompress_after_auth_next_recv_encryption_next_recv_blocksize_next_recv_macsize_next_decompressor_next_decompress_after_authrS_trusted_host_keys_trusted_host_key_algs_trusted_ca_keys_revoked_host_keysx509_trusted_certs_x509_trusted_certsx509_trusted_cert_paths_x509_trusted_cert_paths_x509_revoked_certs_x509_trusted_subjects_x509_revoked_subjects x509_purposes_x509_purposesr _kex_algsencryption_algs _enc_algsr _mac_algscompression_algs _cmp_algssignature_algs _sig_algshost_based_auth_host_based_authpublic_key_auth_public_key_auth kbdint_auth _kbdint_auth password_auth_password_auth_kex _kexinit_sent _kex_complete_ignore_first_kex _strict_kex_gss_gss_kex _gss_auth _gss_kex_auth _gss_mic_auth_preferred_auth rekey_bytes _rekey_bytes rekey_seconds_rekey_seconds_rekey_bytes_sent _rekey_time_keepalive_countkeepalive_count_max_keepalive_count_maxkeepalive_interval_keepalive_interval_keepalive_timer_tunnel _enc_alg_cs _enc_alg_sc _mac_alg_cs _mac_alg_sc _cmp_alg_cs _cmp_alg_sc_can_send_ext_infor_extensions_to_send_can_recv_ext_info_server_sig_algs _next_service_agent_auth_auth_in_progress_auth_complete _auth_final _auth_methods_auth_was_trivial _username _channels_next_recv_chan_global_request_queue_global_request_waiters_local_listeners _x11_listenerr2r3r4_server_host_key_algsr{ get_childr_logger login_timeout call_later_login_timer_callback _login_timer_disable_trivial_auth)rr%rprrrrs rr.zSSHConnection.__init__s{  !(!9!9!+  )-w~~4 7;%33=A )+     """"6:  15$)!DF!//6: 59&+#;?"$%!"#:>+0(9<35#7:u/2u#*#=#= (/(G(G%#//%33!" !$+$?$?!#*#=#= ?C26 "'@K  "',/E.204 %) !&# %Y!%02 ;=";= $?A;? $MMO@D"'' (,(;(;(=1>?   $ 5 5%%t'A'A!CD  &+"!%D %*"r cK|Sw)z:Allow SSHConnection to be used as an async context managerrrs rrzSSHConnection.__aenter__s  rrrrcK|jjs|j|jd{y7w)z?Wait for connection close when used as an async context managerNF)r  is_closedrrrs rrzSSHConnection.__aexit__s; zz##% JJL    !s>AAAc|jS)z(A logger associated with this connection)rrs rr{zSSHConnection.loggers||r rINc(|jt|jjD]}|j |t|j jD]}|j |jr-|jtdtd|jr-|jr!|jjd|_ |jr |j||d|_d|_ |jrf|j rZ|j j#s@|r|j j%|n|j j'dd|_|j(r"|j(j+|d|_|j-|j.j1d|_|j4r"|j4j d|_yy)zClean up this connectionrr N)_cancel_keepalive_timerlistrvaluesprocess_connection_closerrr_process_global_responserXrrzrrrrr cancelled set_exception set_resultrrK_cancel_login_timerr4rSrrm)rrIchanlisteners r_cleanupzSSHConnection._cleanups $$&..01D  ) )# .2T2299;? @  % % '   T99; sy  : KKM%%   #  ! !#((CJJ A   c " " :   [  9 :s BBAA77BBcorocztj|}|jt|j||S)zrrArBrC) rrrkrrmtrusted_host_keystrusted_ca_keysrevoked_host_keystrusted_x509_certsrevoked_x509_certstrusted_x509_subjectsrevoked_x509_subjectskeys r_match_known_hostsz SSHConnection._match_known_hosts}s"+tT4@ 9?,=  2 !#8&&222$C  # # ' ' ,}}D$?$??++2233E3EF % !$O 4"%&7"8  # # /'+D,D,D'ED $  $ $ + +,> ?'*+='>D $*?D '*?D ' 0r certch|j|j|jvr td|js td|j|jvr3|jj ||||js td|j t||jS)z$Validate an OpenSSH host certificatezHost CA key is revokedConnection closedzHost CA key is not trusted) r; signing_keyr<rrvalidate_host_ca_keyvalidaterr)rrkrrmrs r"_validate_openssh_host_certificatez0SSHConnection._validate_openssh_host_certificates  ,4#:#:: !9::;; !455t'<'<<;;33D$484D4DF !=>> MM.$ /xxr c|jr)tfd|jDr td|jr)tfd|jDs td|jrd}|jJj |j|j |j|j|jS)z"Validate an X.509 host certificatec3TK|]}|jj!ywr,rsubjectrrrs rrzFSSHConnection._validate_x509_host_certificate_chain..s'@#>OODLL1#>%(zX.509 subject name is revokedc3TK|]}|jj!ywr,rrs rrzFSSHConnection._validate_x509_host_certificate_chain..s'D'BG  5'Brz!X.509 subject name is not trustedr)host_principal) rCanyrrBr>validate_chainr@rArEr)rrkrs `r%_validate_x509_host_certificate_chainz3SSHConnection._validate_x509_host_certificate_chains  ' '@#'#>#>@@<= =  ' 'D'+'B'BDD@A A  & &D''333 D44 99 44 //+/  1 xxr key_datac  t|}|jr |j|tt|S|j |||tt |S#t$rYnwxYw t|}|jg||jvr td|js td||jvr)|jj||||s td|S#t$r YtdwxYw)z&Validate and return a trusted host keyzHost key is revokedrzHost key is not trustedzUnable to decode host key)r is_x509_chainrrrrrrrr9r<rrvalidate_host_public_key)rrkrrmrrrs r_validate_host_keyz SSHConnection._validate_host_keys  I)(3D!!AA$6=??>>$d+@$&GII    '1C&&2$111$%:;;{{$%899d555{{;;D$<@#G$%>??J   455# s# A A'&A'+ C++ DDr=cdttj||_ttj|j d}|rh|j tjtj|j|j tjtjdtt|j d}|r|dd\|_ |_tt|j d}|r|dd\|_|_|j#|_ |j'|j$j)||j+y#t,$r;|j.j1|j2t5j6YywxYw)z Handle a newly opened connectionsocketrsocknameNpeername)rr2 Transportr/rr9 setsockopt SOL_SOCKET SO_KEEPALIVEr IPPROTO_TCP TCP_NODELAYrrrrrr r_connection_maderB _send_versionrTr rrsysexc_info)rr=rrrrs rrBzSSHConnection.connection_madesFw00)<FMM9#;#;H#EF  OOF--v/B/B // 1 OOF..0B0BA F)":"::"FG 19"1 .D d.)":"::"FG /7| ,DOT_,,.  F  ! ! # KK ' ' -     F JJ !4!4clln E Fs/;E++AF/.F/cX||jr td}|j|y)z"Handle the closing of a connectionNzConnection lost)r/rrrs rrKzSSHConnection.connection_losts( ;4?? !23C #r rrc|stj}|s |j}|jd||j t t |dy)z-Handle a fatal error in connection processingzUncaught exception)rrN)rrr{rrrrT)rrrs rrzSSHConnection.internal_errorsK||~H;;L08D $y(1+67r cy)z9Handle session start when opening tunneled SSH connectionNrrs rsession_startedzSSHConnection.session_started&rr rEdatatypec|xj|z c_|j |jr1|jr |jr|jryyyy#t$rL}|j |j |j |j|j|Yd}~yd}~wt$r|jYywxYw)z&Handle incoming data on the connectionN) rrr-rrrrrrrTr)rrErrIs rrGzSSHConnection.data_received*s   ##% ",,4#5#5#7,,4#5#5#7,#7, #  ! !#((CJJ A   c " " "    ! "s9A%% C.AB55CCc&|jdy)z0Handle an incoming end of file on the connectionN)rKrs r eof_receivedzSSHConnection.eof_received>s T"r cy)z9Handle a request from the transport to pause writing dataNrrs r pause_writingzSSHConnection.pause_writingCrr cy)z:Handle a request from the transport to resume writing dataNrrs rresume_writingzSSHConnection.resume_writingHrr rc2|jsttd|j|jvr0|jdzdz|_|j|jvr0|j}|jdzdz|_||j|<|S)z/Add a new channel, returning its channel numberzSSH connection closedr)r/rrZrr)rr recv_chans r add_channelzSSHConnection.add_channelMs"#6#:< <""dnn4$($8$81$< #JD ""dnn4(( $ 4 4q 8JF$(y!r rc|j|=y)z4Remove the channel with the specified channel numberN)r)rrs rremove_channelzSSHConnection.remove_channel]s NN9 %r c6|jJ|jS)z6Return the GSS context associated with this connection)r[rs rget_gss_contextzSSHConnection.get_gss_contextbsyy$$$yyr c&|j|_y)z&Enable GSS key exchange authenticationN)r]r^rs renable_gss_kex_authz!SSHConnection.enable_gss_kex_authhs"^^r r local_algs remote_algsc |jr||}}n||}}|D] }||vs|cStd|ddj|jdddj|jd)zChoose a common algorithm from the client & server lists This method returns the earliest algorithm on the client's list which is supported by the server. z No matching z algorithm found, sent ,rz and received )rrrr)rrrr client_algs server_algsrs r _choose_algzSSHConnection._choose_algms{ >> '1;K'2JKCk!  tyy,33G< YY{ # * *7 3 56 6r c2|jrddgSddgS)z Return the extra kex algs to add ext-info-ckex-strict-c-v00@openssh.com ext-info-skex-strict-s-v00@openssh.com)rrs r_get_extra_kex_algsz!SSHConnection._get_extra_kex_algss& >> !#BC C!#BC Cr ct|jr |jj|yy#t$rYywxYw)zSend data to the SSH connectionN)r/rNBrokenPipeErrorrOs r_sendzSSHConnection._sends; ?? %%d+ #  s + 77cDd|jz}|jjd||jr)||_|j |j dn(||_|j |j d|j|dzy)zStart the SSH handshakeSSH-2.0-zSending version %srclient_versionserver_versions N) rr{rrr set_extra_inforr!r()rrs rrzSSHConnection._send_versions - /9 >> #*D   w~~g/F  G#*D   w~~g/F  G 7W$%r c<|jjddt}|dkr7t|jtk\r|j t dy|jd|}|j dr|dd}|j|dzd|_|jd s!|jr|jd rt|tkDr|j t d |jr)||_ |j|jd  n(||_|j|jd |jj!d||j#d|_|j&|_y|jrU|jdsD|xj*dz c_|j*t,kDr|j t dyy|j t/dy)z(Receive and parse the remote SSH version rzBanner line too longFN rr*s SSH-1.99-zVersion too longrr+r-zReceived version %sTsSSH-zToo many banner lineszUnsupported SSH version)rfind_MAX_BANNER_LINE_LENrrrendswith startswithr_MAX_VERSION_LINE_LENrr r/rr!r{r _send_kexinitrW _recv_pkthdrr-r_MAX_BANNER_LINESr)ridxrs rr,zSSHConnection._recv_versionsllq*>? 74<< $88!!-0F"GH,,t$   E "crlG||CEF+   { +!g&8&8&F7|33!!-0B"CD~~'.$##7>>'3J#K'.$##7>>'3J#K KK  4g >    !%D !%!2!2D ^^ g&8&8&A   ! # !!$55!!-0G"HI    23LM Nr ct|j|jkry|jd|j|_|j|jd|_|jr:|jj |j |jd\|_}n|jdd}tj|d|_ |j|_ y)z&Receive and parse an SSH packet headerFNbigT) rrr0rr/decrypt_headerr.r from_bytesr _recv_packetr-)rpktlens rr:zSSHConnection._recv_pkthdrs t|| t33 3||$9T%9%9: ||D$8$8$9:  %%44T^^59\\1F !DL&\\"1%F~~fe4 !..r cd|jz|jz|jz }t|j|kry|j }|jd||jz }|j||jz |}|j r6|j j||j|d|}|std|jdd|z}|j|d|_d|_|d|d }|jr@|js |js(|jj|}| td|}t|}|j!} |} d } d } t"| cxkr t$kr7nn4|j&r#|j(r d } d|_n|j&} nd } d } n|j*r*|j st,| cxkr t.kr nnd } d| z} nt0| cxkr t2kr!nn|j4r |j4} npd} d} nk| t$kDr|j sd} d} nQ| t2kDr|jsd} d} n7t6| cxkr t8kr$nn! |j;} |j<| } | jC| ||| | so | jE| ||}|sY|j*r|j sd| z} n;|jJjMd| |jOtPtS|| r tG| | t2kDrd|_*|jVra|jX|_-|j dk(r|j s tGd| t\k(r|j*rd|_y|dzdz|_y#t>$r d} d| z} Y#wxYw#t@$rd} d} Y7wxYw#t@$r}tGtI|dd}~wwxYw)z5Receive the remainder of an SSH packet and process itr>FNzMAC verification failedr rrzDecompression failedrzignored first kexzkex not in progresszKey exchange not in progresszstrict kex violationzAStrict key exchange violation: unexpected packet type %d receivedzauth not in progresszAuthentication not in progressz#invalid request before kex completez0Invalid request before key exchange was completez$invalid request before auth completez2Invalid request before authentication was completezinvalid channel numberz"Invalid channel number %d receivedzincomplete channel requestz#Incomplete channel request receivedzUnknown packet type %d receivedTr%Sequence rollover before kex complete)/rr1r0rrr.r/decrypt_packetrrr2r|r3 decompressrrget_byterNrOrVrYrZrArCrTrUrzrJrK get_uint32rKeyErrorrlog_received_packetprocess_packetrrr{r send_packetrBrr}r/r:r-rM)rremseqrestmac packet_data orig_payloadpayloadpacketpkttypehandler skip_reason exc_reasonr processedrIs rrBzSSHConnection._recv_packets$,,!3!33d6J6JJ t|| s "nn||3S!3!334ll3t111#6  //>>T\\4C1K899,,qr*T1K||CD)  "1k!n_5   4#6#6'+'B'B((33LAG&'=>>"G7#//#$(  G 3| 3yy))"5K-2D*"iiG3 ;   d&;&;g220K>@GHJ 7 ?.? ?zz**4 = | #D,A,A?KKJ ( (1D1D@KMJ ' =-= = 8"--/ 8"nnY7G ##GS&+F 8#227CH ##D,A,A"FHO"PJKK&&'H'.0$$%6s D  + + & &#D  ??!%!2!2D ~~+D4I4I#$KLL+%$*:*:!"#&'Z!7O 8":K",.7"8J8 % C: B  C % 8#CH-47 8s<-N4>N$ON10N14 OO O+O&&O+)rWrVargsrWc|jri|jr]|j|jk\s-|jr8t j |jk\r|jd|_ |tthvs |tkDr |jr6|tk(r|js |jr|tkDr*|js|j j#||fy|j$r-|t&t(fvr|j+t&t-dt/|dj1|z}|j2r@|js |j4s(|j2j7|}| t9d|}|j:t=|z |j>z}|dkr||j>z }t/||ztAjB|z}t=|}tE|} |jF} |j$r!|j$jI| | |\}} n| |z}d} |jK|| z|jFdk(r|j$sd|_#tMd|tNk(r|jPrd|_#n | d zdz|_#|jr|xj|z c_|s|}|jS|| |y) zSend an SSH packetTNr zCompression failedr>rrrEr)*r|rXrerbrdtime monotonicrfr9rWrDrErOrSr{rUr+rr&rArFrMrrrr)r*compressrr'rr(osurandomrr%encrypt_packetr(rrMrZlog_sent_packet) rrVrWr[rSrTpadlenrUrChdrrOrQs rrMzSSHConnection.send_packet^s~   D$6$6''4+<+<<%%.."d&6&66    !%D -/ABB $d.@.@//,,0C0C,,T5H5H  " " ) )7D/ :   WZ4N%N   Z 5G}sxx~5   !4!4%)%>%>&&// =G&';<<"G''#g,67$:N:NN A: d** *Ff'"**V*<<VVnnn  //>>sCPKFC6\FC 6C< >>Z '0E0EDN GH H k !d&6&6DN!Ag3DN     " "f , "Gl;r cd|j}g|_|D]\}}|j|g|y)z1Send packets deferred due to key exchange or authN)r+rM)rdeferred_packetsrVr[s r_send_deferred_packetsz$SSHConnection._send_deferred_packetss; 11!#-MGT D  W ,t ,.r rrrc|jjd|||jtt |t |t |y)zSend a disconnect packetzSending disconnect: %s (%d)N)r{r~rMr@rr)rrrrs rrzSSHConnection._send_disconnects> 6E  7r cd|_d|_|jr&tj|jz|_|j r%|jJ|jj}ng}t|j|t|j|jz}|jxsdg}|jjd|jj!d||jj!d||jj!d|j"|jj!d |j$|jj!d |j&t)j*d }t-|}t-|}t-|j"}t-|j$}t-|j&}t-g}d j/t1t2|||||||||||t5dt7df} |j9r| |_n| |_|j?t2| d dy)zStart a key exchangeFrNsnullzRequesting key exchange Key exchange algs: %s Host key algs: %sz Encryption algs: %sz MAC algs: %sz Compression algs: %sr r) rXrerdr]r^rfr\r[mechsrirFrrr%r{rdebug2rHrIrKr`rarrrrLrrrr#r"rM) r gss_mechsr host_key_algscookierrrlangsrUs rr9zSSHConnection._send_kexinits#!"   #~~/$2E2EED  ==99( (( II"4>>9#'(B(B#CE++-.22?wi  45 4h? 0-@ 2DNNC +T^^< 3T^^DBH% / DNN+DNN+DNN+ 4 ,fh #Xx8#UE75>6!9NO >> #)D #)D  fQRj1r cTtt|j}|jj d|jj D]<\}}|t |t |zz }|jj d||>|jt|y)zSend extension informationzSending extension info %s: %sN) rrrur{roitemsrrMrF)rrUr6values r_send_ext_infozSSHConnection._send_ext_infosD4456 343399;KD% fTlVE]2 2F KK  z4 7< v.r khc j |js d}||_nd}t|j|j\}}}}}} t|j|j \} } } } }}|dk(r|j|_| dk(r|j|_t |j}t |j}|jjd|jjd|j|jjd|j|jjd|j|jjd|jjd|j|jjd|j |jjd|j|jJ|jj||d |j|}|jj||d |j| }|jj||d |j|}|jj||d |j| }|jj||d|j|}|jj||d|j| }d |_ t|j|||j|| }t|j|||j ||}|jtd|j d<|j#r||_| rdnd|_t)d||_t-|j|_||_||_t)d| |_||_t9|j|_||_|j?|jjAd|jjAd|jjAd|jjAd|j jAd|jjAd|r|jBdk(r|jDr|jDjGs||jDjId d |_!y djK|jL|j d<||_|rdnd|_t)d| |_t-|j|_||_||_t)d||_||_t9|j|_||_|j?|jjAd|j jAd|jjAd|jjAd|jjAd|jjAd|jNr|jQd|_'d|_)|r1|j#r|jUtVn tV|_,|j[y )z1Finish a key exchange and send a new keys messageTFr Client to server:z Encryption alg: %sz MAC alg: %sz Compression alg: %s Server to client:NABCDEFr sglobal-requests-okrrr r) send_ciphersend_macsend_compression recv_cipherrecv_macrecv_compressionkexrserver-sig-algs).r$r_rnrprorqr5rrrsr{rorV compute_keyr`rMrMrurr&r'maxr(r6r)r*r4r5r6r7r7r8r/rrrrrrrMrtrxrXsend_service_request_USERAUTH_SERVICErxrh)rryrz first_kexenc_keysize_cs enc_ivsize_csenc_blocksize_csmac_keysize_csmac_hashsize_csetm_csenc_keysize_sc enc_ivsize_scenc_blocksize_scmac_keysize_scmac_hashsize_scetm_sccmp_after_auth_cscmp_after_auth_sciv_csiv_sc enc_key_cs enc_key_sc mac_key_cs mac_key_sc next_enc_cs next_enc_scs r send_newkeyszSSHConnection.send_newkeyssI D I "$"2"2D4D4D E 0 '7 "$"2"2D4D4D E 0 '7 Q #//D  Q #//D 243C3CD243C3CD 01 3T5E5EF ,d.>.>? 4d6F6FG 01 3T5E5EF ,d.>.>? 4d6F6FGyy$$$ %%aD$2B2B&35 %%aD$2B2B&35YY**1at7G7G+9; YY**1at7G7G+9; YY**1at7G7G+9; YY**1at7G7G+9;  $T%5%5z5%)%5%5z6K $T%5%5z5%)%5%5z6K  %:=  !67 >> $/D !(.1AD #&q*:#;D -d.>.>?D (9D %)4D &(+A/?(@D %&5D #&6t7G7G&HD #/@D ,    ,,33G<))009!%!1!1!8!8!A ,,33G<))009!%!1!1!8!8!A  C::&4<< LL224LL++D1!%DJ $..)  $ $%7 8%0D !(.1AD #&q*:#;D -d.>.>?D (9D %)4D &(+A/?(@D %&5D #&6t7G7G&HD #/@D ,    ,,33G<))009!%!1!1!8!8!A ,,33G<))009!%!1!1!8!8!A  C  " "    !&+D #! ~~))*;<%6" ##%r servicec|jjd|||_|jtt |y)zSend a service requestzRequesting service %sN)r{rorxrMrDr)rrs rrz"SSHConnection.send_service_requestns6 2G<$ ,fWo>r method.cdjttt|jtt t|f|zS)z1Get packet data for a user authentication requestr )rrrPrr_CONNECTION_SERVICErrr[s r_get_userauth_request_packetz*SSHConnection._get_userauth_request_packetvsHxx23VDNN5K 34fVnFHLMN Nr cRt|j|j||zS)z4Get signature data for a user authentication request)rr$rrs rget_userauth_request_dataz'SSHConnection.get_userauth_request_data}s.t''(11&$?@ Ar T)rWtrivialrcZ|xj|zc_|j|g|d|iy)z!Send a user authentication packetrWN)rrM)rrVrWrr[s rsend_userauth_packetz"SSHConnection.send_userauth_packets/ ')9499r )rrrcK|j||}|rt|j|z}t|dd}|r||d{}nNt|ddr0|jj d|j |d{}n|j |}|t|z }|jt|dd|y7}7Bw)z"Send a user authentication request sign_asyncN use_executorFr)r) rrr$rr run_in_executorsignrrP) rrrrr[rUrErsigs rsend_userauth_requestz#SSHConnection.send_userauth_requests 2264@ $**+f4D\40 &t,,ne4 JJ66tSXXtLLhhtn fSk !F !!"6qr *1 " 3-Ls%AC  C >^^D)F""6*)))  (!DN"&D  :: DLLLL**, LL # #D )DJ  $'==?r  send_chan recv_window recv_pktsize result_argsc |jtt|t|t|t|g|y)z Send a channel open confirmationN)rMrHr)rrrrrrs rsend_channel_open_confirmationz,SSHConnection.send_channel_open_confirmations= 6y8I *F;,? - =0; =r c ~|jtt|t|t|t|y)zSend a channel open failureN)rMrIrr)rrrrrs rsend_channel_open_failurez'SSHConnection.send_channel_open_failures0 16)3Dvf~vd| Er F) want_replyrequestrcZ|jtt|t|g|y)zSend a global requestN)rMrVrr)rrrr[s r_send_global_requestz"SSHConnection._send_global_requests- +VG_ , 5/3 5r cK|jsttdfS|jj }|j j ||j|g|ddi|d{S7w)z/Send a global request and wait for the responser rTN)r/rXrr r|rrr)rrr[r}s rrz"SSHConnection._make_global_requestso& #6 6 JJ $ $ &  $$++F3!!!'BDBTB||sA.A70A51A7rc|jjd\}}}|rD|r-|durdntt|}|j t |n|j t |jr|jyy)z>Report back the response to a previously issued global requestrTr N)rrrrrMrWrX_service_next_global_request)rrrYrresponses r_report_global_responsez%SSHConnection._report_global_responsesu 5599!<1j "(D.3d5&6I  !4h?  !45  % %  - - / &r ct|jd\}}}t|r ||y|jdy)z)Process next item on global request queuerFN)rcallabler)rrWrUrYs rrz*SSHConnection._service_next_global_requests8"77: G  FO  ( ( /r ct)&Handle the opening of a new connectionNotImplementedErrorrs rrzSSHConnection._connection_made "!r _pkttype_pktidrUc|j}|j}|j}|j |jd}|jd}|j jd|||tk7s |jrt|||} nd} |j| y#t$r t ddwxYw)zProcess a disconnect messageutf-8rzInvalid disconnect messageNzReceived disconnect: %s (%d)) rI get_string check_endrUnicodeDecodeErrorrr{rr>rrr) rrrrUr reason_bytes lang_bytesrrrIs r_process_disconnectz!SSHConnection._process_disconnects  "((* &&(  H!((1F$$W-D 964H & &$**';D&$'OCC #" H <=4 G Hs "B88Ccbd|jvr!|j}|jyy)zProcess an ignore messagesCiscoN)r!rrrrrrUrYs r_process_ignorezSSHConnection._process_ignore4s1 4// /!!#A     0r cD|j}|jy)z)Process an unimplemented message responseN)rIrrs r_process_unimplementedz$SSHConnection._process_unimplemented>s    r c|j}|j}|j}|j |jd}|jd}|j jd||rdnd|jr|jj|||yy#t$r t ddwxYw)zProcess a debug messagerrzInvalid debug messageNzReceived debug message: %s%s (always display)r) get_booleanrrrrrr{rrdebug_msg_received) rrrrUalways_display msg_bytesrrsrs r_process_debugzSSHConnection._process_debugGs ++-%%' &&(  C""7+C$$W-D 932@.b J ;; KK * *3n E  " C 78d B Cs "B00Cc|j}|j|jr td|js td||j k7r t d|jjd||jtt|d|_|tk(rd|_ d|_|jyy)zProcess a service requestz#Unexpected service request receivedz,Service request received before kex completez%Unexpected service in service requestz Accepting request for service %sNTF)rrrrr/rxrr{rorMrErrr{rvrhrrrrUrs r_process_service_requestz&SSHConnection._process_service_request\s##% >>  EF F$$ NO O d(( (%&MN N =wG +VG_=! ' '%)D "&+D #  ' ' ) (r c|j}|j|jr td|js td||j k7r t d|jjd|d|_|tk(rH|jjd|jd|_ td|jyy) z!Process a service accept responsez"Unexpected service accept receivedz+Service accept received before kex completez$Unexpected service in service acceptzRequest for service %s acceptedNBeginning auth for user %sTr_)rrrrr/rxrr{rorr~rr{r try_next_authrs r_process_service_acceptz%SSHConnection._process_service_acceptws##% >>  DE E$$ MN N d(( (%&LM M > J%)D " & - ; ; = (r c|js tdi}|jjd|j }t |D]D}|j }|j }|||<|jjd||F|j|jr0t|jddjd|_ yy)zProcess extension informationzUnexpected ext_info receivedzReceived extension inforurr rN) rvrr{rorIrangerrrrSrrfrw) rrrrU extensionsnum_extensionsrYr6rws r_process_ext_infozSSHConnection._process_ext_infos&& >? ?)+  45**,~&A$$&D%%'E$Jt  KK  z4 7 '  >> JNN#5s;AA$GH  ! r c |jr td|jd}|j}|j}|j}|j}|j} |j} |j} |j} |j}|j}|j } |j }|j |jr8|j|_ |jsNd|vrd|_ d|vr?d|_ n7|j|_ |jsd|vrd|_ d|vrd|_ |jr&|js|jdk7r td |j rd |_n|j#|j$r|j$j'|j(r%|j$J|j$j*}ng}t-|j.|t1|j2}|j4j7d |j4j9d ||j4j9d||j4j9d|j4j9d||j4j9d| |j4j9d| |j4j9d|j4j9d||j4j9d| |j4j9d| |j;d||}t=|||_| xr|jj>|dk7|_ |jr;tCtD|jG|s|jIds tKd|j;d|jL||_'|j;d|jL||_(|j;d|jR| |_*|j;d|jR| |_+|j;d|jX| |_-|j;d|jX| |_.|j4j7d|j4j9d|jj>|jj_y )zProcess a key exchange requestz Key exchange already in progressrmr!Tr"r#r$rz?Strict key exchange violation: KEXINIT was not the first packetFNzReceived key exchange requestrkrlr|z Encryption algs: %sz MAC algs: %sz Compression algs: %sr}rsgss-z)Unable to find compatible server host keyrrrzBeginning key exchangez Key exchange alg: %s)0rVr get_bytes get_namelistrrIrrget_consumed_payloadr"r$rtrZr#r/r.rWr9r[resetr\rnrirFrrr{rrorrjrrYrrchoose_server_host_keyr7rrHrnrorIrprqrKrrrsstart)rrrrUrY peer_kex_algspeer_host_key_algs enc_algs_cs enc_algs_sc mac_algs_cs mac_algs_sc cmp_algs_cs cmp_algs_scfirst_kex_followsrprkex_algs r_process_kexinitzSSHConnection._process_kexinitst 99 BC C   R ++- #002))+ ))+ ))+ ))+ ))+ ))+    !    !"..0     >> #)#>#>#@D ## M1.2D+2mC'+D$#)#>#>#@D ## M1.2D+2mC'+D$   D$9$9!#!CD D   !&D     99 IIOO  ==99( (( II"4>>9#'(B(B#CE :; 4mD 02DE 01 4kB -{; 5{C 01 4kB -{; 5{C"">8]KD'* "3#J"&))"5"5q9I"I  >> ,d3JJ&(070B0B70K'):;; ++L$..,79++L$..,79 ++E4>>;O++E4>>;O++M4>>,79++M4>>,79 34 3TYY5H5HI r cP|j|jrd|j|_|j|_|j |_|j|_|j|_ d|_d|_ n td|jjdy)z4Process a new keys message, finishing a key exchangeNTzNew keys not negotiatedzCompleted key exchange)rr4r/r5r0r6r1r7r2r8r3rvrr{r)rrrrUs r_process_newkeyszSSHConnection._process_newkeys s   % %$($>$>D !#'#<#?H >>  => >  #$ABB 4>>)   !=xH!)! "   T22:vvN O'#M2 6!#c(+ 5 6s#DD?%D::D?rc.K|jsy|rtt|jd{tt|jj |j }tj|rttt|d{}|s|jy|jsy|jr|jjttt||j |||_ y77xw)z/Finish processing a user authentication requestN)rrr reload_configrrrrrr rrrzrr%)rrrrUrs rrzSSHConnection._finish_userauthQ s{{  *D1??A A A)T[[1<>   DJJ/D##%  " $d + 9 9 ; FG G%7s= Fc|j|jrT|jrGtt|j}|j r|j r td|jjd|j|jdk(rQ|jrE|jjs+|jjddg|_d|_ y|j!|j#d|_d|_d|_d|_|j*r|j*j-|j/|j|j1|j3|j5|j6r|j6j9|j:rI|j;|}t=j>|r|J|jA|d|_d|_!|jd k(rK|jr>|jjs#|jjdd|_ yyyytEd ) z.Process a user authentication success responsezTrivial auth disabledrr#NrFTrrz$Unexpected userauth success response)#rrrzrrrrrr{r~rrrrrr~r$rr{r|rvryrr/rrhrrrrrrrrr)rrrrUrrs r_process_userauth_successz'SSHConnection._process_userauth_success s  >>   DJJ/D%%$*D*D&'>?? KK  94>> Jzz^+  ..0 ''-&-Y"!     ! KKMDJ%*D ""&D &+D #{{ !!#     8  $ $ &  ' ' )  % % '{{ **,~~-&&v.!---$$V,!%&*#zzV#  ..0 ''-! 1)5#  FG Gr c|j}|j}d|jvr#|jdk(r|j|j  |j d}|j d}|jjd|jr+tt|jj||ytd#t $r tddwxYw) z,Process a user authentication banner messagescryptlibrrzInvalid userauth bannerNzReceived authentication bannerzUnexpected userauth banner)rr!get_remaining_payloadrHrrrrr{rrrr0rauth_banner_received)rrrrUrrrsrs r_process_userauth_bannerz&SSHConnection._process_userauth_banner s%%' &&(  $.. .,,.%7 OO  E""7+C$$W-D ;< >>  DKK ( = =c4 H <= =" E 9: D Es #"C&&C<c|j}|j} |jd}dt |zdz}t ttt||d}|s|jjd||jj|||ft|jdk(r|jyy#t$r t ddwxYw)zProcess a global requestrzInvalid global requestN _process__global_requestz#Received unknown global request: %sr)rrrrrrrr_PacketHandlerrr{rrrrr) rrrrU request_bytesrrr6rWs r_process_global_requestz%SSHConnection._process_global_request s))+ '')  D#**73G-g669JJx/tT1JK KK  Dg N ""))7FJ*GH t)) *a /  - - / 0" D 89t C Ds C C"c|jr@|jjd}|js|j||fyyt d)zProcess a global responserzUnexpected global responseN)rrrrr)rrVrrUr}s rrz&SSHConnection._process_global_response sU  ' '1155a8F##%!!7F"34& <= =r c|j}|j}|j}|j}d|jvr|jr|dz} |j d} dt|zdz} tttt|| d} t| r | |\} } | j|||| yttd#t $r t ddwxYw#t$rc} |j j#d || j$|j'|| j(| j$| j*Yd} ~ yd} ~ wwxYw) zProcess a channel open requestdropbearrrzInvalid channel open requestNr/_openzUnknown channel typez#Open failed for channel type %s: %s)rrIr r)rrrrrr _OpenHandlerrr process_openrr[r{rrrrr)rrrrUchantype_bytesr send_window send_pktsizechantyper6rWrrrIs r_process_channel_openz#SSHConnection._process_channel_open sh **,%%' '') ((*  $.. .43C3C A L J%,,W5H A!1(!;;gED8L174t3LMG ' g!!)[".9''@'=??" J >?T I J  A KK  D' 5  * *9chh+.::sxx A A  As,!C!3AC:C:!C7: E&AE!!E&cr|j}|j}|j}|j}d|jvr|jr|dz}|jj |}|r|j ||||y|j jd|td)z,Process a channel open confirmation responser6rz1Received open confirmation for unknown channel %dInvalid channel numberN) rIr!r)rrprocess_open_confirmationr{rr) rrrrUrrr;r<rs r"_process_channel_open_confirmationz0SSHConnection._process_channel_open_confirmation3 s%%' %%' '') ((*  $.. .43C3C A L~~!!),   * *9k+7 A KK   ,-6 8 89 9r c|j}|j}|j}|j}|j |jd}|jd} |j j|} | r| j||| y|jjd|t d#t$r t ddwxYw)z'Process a channel open failure responserrzInvalid channel open failureNz,Received open failure for unknown channel %dr@) rIrrrrrrrprocess_open_failurer{r) rrrrUrrrrrrrs r_process_channel_open_failurez+SSHConnection._process_channel_open_failureK s%%'   "((* &&(  J!((1F$$W-D~~!!),   % %dFD 9 KK   ,-6 8 89 9" J >?T I Js "C C"c||j|jjd|jdy)z-Process an incoming OpenSSH keepalive requestz"Received OpenSSH keepalive requestTN)rr{rorrrUs r4_process_keepalive_at_openssh_dot_com_global_requestzBSSHConnection._process_keepalive_at_openssh_dot_com_global_requestd s1  ?@ $$T*r c\|jjd|jdy)aForcibly close the SSH connection This method closes the SSH connection immediately, without waiting for pending operations to complete and without sending an explicit SSH disconnect message. Buffered data waiting to be sent will be lost and no more data will be received. When the the connection is closed, :meth:`connection_lost() ` on the associated :class:`SSHClient` object will be called with the value `None`. zAborting connectionN)r{r~rrs rrQzSSHConnection.abort s% ./ $r cf|jjd|jtdy)zCleanly close the SSH connection This method calls :meth:`disconnect` with the reason set to indicate that the connection was closed explicitly by the application. zClosing connectionzDisconnected by applicationN)r{r~ disconnectr>rs rrzSSHConnection.close s' -. +-JKr cK|jr"|jjd{|jjd{y7'7w)zWait for this connection to close This method is a coroutine which can be called to block until this connection has finished closing. N)ryrr4rrs rrzSSHConnection.wait_closed sF ;;++))+ + +$$&&& ,&s!*AA!AAAAct|jjD]}|j|j ||||j dy)aJDisconnect the SSH connection This method sends a disconnect message and closes the SSH connection after buffered data waiting to be written has been sent. No more data will be received. When the connection is fully closed, :meth:`connection_lost() ` on the associated :class:`SSHClient` or :class:`SSHServer` object will be called with the value `None`. :param code: The reason for the disconnect, from :ref:`disconnect reason codes ` :param reason: A human readable reason for the disconnect :param lang: The language the reason is in :type code: `int` :type reason: `str` :type lang: `str` N)rrrrrr)rrrrrs rrKzSSHConnection.disconnect sK0..01D JJL2 dFD1 $r r6r7c|jj||jr |jj||S|S)a Get additional information about the connection This method returns extra information about the connection once it is established. Supported values include everything supported by a socket transport plus: | username | client_version | server_version | send_cipher | send_mac | send_compression | recv_cipher | recv_mac | recv_compression See :meth:`get_extra_info() ` in :class:`asyncio.BaseTransport` for more information. Additional information stored on the connection by calling :meth:`set_extra_info` can also be returned here. )rrr/r9r:s rr9zSSHConnection.get_extra_info sI2{{t"&// $==dGL@ @7>@ @r rc <|jjdi|y)ayStore additional information associated with the connection This method allows extra information to be associated with the connection. The information to store should be passed in as keyword parameters and can later be returned by calling :meth:`get_extra_info` with one of the keywords as the name to retrieve. Nr)rrrs rr/zSSHConnection.set_extra_info s  $V$r interval count_maxc|2t|tr t|}|dkr td||_||dkr td||_|j y)aSet keep-alive timer on this connection This method sets the parameters of the keepalive timer on the connection. If *interval* is set to a non-zero value, keep-alive requests will be sent whenever the connection is idle, and if a response is not received after *count_max* attempts, the connection is closed. :param interval: (optional) The time in seconds to wait before sending a keep-alive message if no data has been received. This defaults to 0, which disables sending these messages. :param count_max: (optional) The maximum number of keepalive messages which will be sent without getting a response before closing the connection. This defaults to 3, but only applies when *interval* is non-zero. :type interval: `int`, `float`, or `str` :type count_max: `int` Nr%Keepalive interval cannot be negativez&Keepalive count max cannot be negative)rerrrrkrir)rrPrQs r set_keepalivezSSHConnection.set_keepalive sf0  (C(.x8!| !HII'/D $  1} !IJJ(1D % ##%r rsrc|jjd||rdnd|jtt |t |t |y)aSend a debug message on this connection This method can be called to send a debug message to the other end of the connection. :param msg: The debug message to send :param lang: The language the message is in :param always_display: Whether or not to display the message :type msg: `str` :type lang: `str` :type always_display: `bool` zSending debug message: %s%srrN)r{rrMrCrr)rrsrrs r send_debugzSSHConnection.send_debug# sJ& 8#2@.b J GN$;fTl 4r strictencodingerrorswindow max_pktsizec6t||j||||S)aQCreate an SSH TCP channel for a new direct TCP connection This method can be called by :meth:`connection_requested() ` to create an :class:`SSHTCPChannel` with the desired encoding, Unicode error handling strategy, window, and max packet size for a newly created SSH direct connection. :param encoding: (optional) The Unicode encoding to use for data exchanged on the connection. This defaults to `None`, allowing the application to send and receive raw bytes. :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: :class:`SSHTCPChannel` )r+r rrXrYrZr[s rcreate_tcp_channelz SSHConnection.create_tcp_channel< s#@T4::x#V[: :r c6t||j||||S)ayCreate an SSH UNIX channel for a new direct UNIX domain connection This method can be called by :meth:`unix_connection_requested() ` to create an :class:`SSHUNIXChannel` with the desired encoding, Unicode error handling strategy, window, and max packet size for a newly created SSH direct UNIX domain socket connection. :param encoding: (optional) The Unicode encoding to use for data exchanged on the connection. This defaults to `None`, allowing the application to send and receive raw bytes. :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: :class:`SSHUNIXChannel` )r,r r]s rcreate_unix_channelz!SSHConnection.create_unix_channel_ s#@dDJJ$fk; ;r c6t||jdd||S)aCreate a channel to use for TUN/TAP forwarding This method can be called by :meth:`tun_requested() ` or :meth:`tap_requested() ` to create an :class:`SSHTunTapChannel` with the desired window and max packet size for a newly created TUN/TAP tunnel. :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type window: `int` :type max_pktsize: `int` :returns: :class:`SSHTunTapChannel` NrW)r-r rrZr[s rcreate_tuntap_channelz#SSHConnection.create_tuntap_channel s", djj$ & 5 5r c6t||jdd||S)z2Create an SSH X11 channel to use in X11 forwardingNrW)r.r rbs rcreate_x11_channelz SSHConnection.create_x11_channel s" T4::tX#[2 2r c6t||jdd||S)z6Create an SSH agent channel to use in agent forwardingNrW)r/r rbs rcreate_agent_channelz"SSHConnection.create_agent_channel s" tTZZx%{4 4r rXrYrZr[rrr orig_host orig_portcKtw)z0Create an SSH direct or forwarded TCP connectionr) rrrrrirjrXrYrZr[s rrzSSHConnection.create_connection "!  remote_pathcKtw)z?Create an SSH direct or forwarded UNIX domain socket connectionr)rrrnrXrYrZr[s rcreate_unix_connectionz$SSHConnection.create_unix_connection rlrm dest_host dest_portc,K |jjt||d{\}}|jj d||fttt|S7>#t $r}t tt|dd}~wwxYww)a)Forward a tunneled TCP connection This method is a coroutine which can be returned by a `session_factory` to forward connections tunneled over SSH to the specified destination host and port. :param dest_host: The hostname or address to forward the connections to :param dest_port: The port number to forward the connections to :type dest_host: `str` or `None` :type dest_port: `int` :returns: :class:`asyncio.BaseProtocol` Nz! Forwarding TCP connection to %s) r rrar{r~OSErrorrrZrr)rrqrrrYpeerrIs rforward_connectionz SSHConnection.forward_connection s& L JJ889BIOOGAt KK  @'3 5 Dt455O  L"#6CAt K Ls8B$A)A'%A)B'A)) B2B  BB dest_pathc&K |jjt|d{\}}|jj d|ttt|S7<#t $r}t tt|dd}~wwxYww)aForward a tunneled UNIX domain socket connection This method is a coroutine which can be returned by a `session_factory` to forward connections tunneled over SSH to the specified destination path. :param dest_path: The path to forward the connection to :type dest_path: `str` :returns: :class:`asyncio.BaseProtocol` Nz" Forwarding UNIX connection to %s) r rprar{r~rtrrZrr)rrwrYrurIs rforward_unix_connectionz%SSHConnection.forward_unix_connection s Ljj77 iPP At KK  A9 MDt455 Q L"#6CAt K Ls8B#A&A$#A& B$A&& B/B  BBrraccept_handlerc ,Kdttdtdtdtt tt tfffd }||ffk(rjjd||fn!jjd||ff tj|||d{}|d k(r|j}d k(r||j||f<|S73#t$r"}jjd |d}~wwxYww) aSet up local port forwarding This method is a coroutine which attempts to set up port forwarding from a local listening port to a remote host and port via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the port forwarding. :param listen_host: The hostname or address on the local host to listen on :param listen_port: The port number on the local host to listen on :param dest_host: The hostname or address to forward the connections to :param dest_port: The port number to forward the connections to :param accept_handler: A `callable` or coroutine which takes arguments of the original host and port of the client and decides whether or not to allow connection forwarding, returning `True` to accept the connection and begin forwarding or `False` to reject and close it. :type listen_host: `str` :type listen_port: `int` :type dest_host: `str` :type dest_port: `int` :type accept_handler: `callable` or coroutine :returns: :class:`SSHListener` :raises: :exc:`OSError` if the listener can't be opened rrirjr c2Krp||}tj|rttt|d{}|s1j j d||ffttdj|||d{S7T7w#Forward a local connection over SSHNz>Request for TCP forwarding from %s to %s denied by applicationzConnection forwarding denied) rrrr rr{r~rrYr)rrirjrrzrqrrrs rtunnel_connectionz;SSHConnection.forward_local_port..tunnel_connection s ' 9=&&v.#' $#@@FKK$$&F&/%;&/%;= ++K+IKK001:I1:IGG HAGs";BBABBBBz"Creating local TCP forwarder on %s*Creating local TCP forwarder from %s to %sN'Failed to create local TCP listener: %sr)rrrrrr+rr{r~rwr rtrrr) rrrrqrrrzrrrIs ` ``` rforward_local_portz SSHConnection.forward_local_port s?N H!5e!< H H+. H-. e0DDE H H2  %)Y)? ? KK  A);7 9 KK  I);7'3 5 8tzz9J9D9DFFH ! "++-K >#I:Bk;67!F  KK  H# N  s<B DC&0C$1C&5/D$C&& D/D  DD listen_pathcvKdttdtttttfffd }j j d| tj||d{}|j|<|S7#t$r"}j jd|d}~wwxYww)aSet up local UNIX domain socket forwarding This method is a coroutine which attempts to set up UNIX domain socket forwarding from a local listening path to a remote path via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the UNIX domain socket forwarding. :param listen_path: The path on the local host to listen on :param dest_path: The path on the remote host to forward the connections to :type listen_path: `str` :type dest_path: `str` :returns: :class:`SSHListener` :raises: :exc:`OSError` if the listener can't be opened rr cDKj|d{S7w)r~N)rp)rrwrs rrz;SSHConnection.forward_local_path..tunnel_connectionk s/ 44_5>@@ @@s   +Creating local UNIX forwarder from %s to %sN(Failed to create local UNIX listener: %s) rrrr,rr{r~rxr rtrr)rrrwrrrIs` ` rforward_local_pathz SSHConnection.forward_local_pathS s0 @!6u!= @./1FFG @ F$i 1 9$ :K:EGGH.6k*G  KK  I3 O  s<AB9B 3B 4B 8B9 B B6B11B66B9modeunitc. tt||\}}|jd}|jj d|t k(rdnd|ttt|d|iS#t $r}ttt|dd}~wwxYw)zSet up TUN/TAP forwarding interfacez# Forwarding layer %d traffic to %sr$rN)extra) rrar9r{r~rrtrrZrr)rrrr=rurrIs rforward_tuntapzSSHConnection.forward_tuntap s L+L$EOIt!00=I KK  B"&*C"CQ& ( Dt4#. ":< < L"#6CAt K LsA A,, B5BB listen_keyc<|jj|dy)z*Mark a local forwarding listener as closedN)rr)rrs rclose_forward_listenerz$SSHConnection.close_forward_listener s !!*d3r ct)*Detach a session from a local X11 listenerrrrs rdetach_x11_listenerz!SSHConnection.detach_x11_listener rr r r,NNrr)r r rrrglobals_handler_namesr staticmethodrrr2AbstractEventLoop_AcceptHandler _ErrorHandlerrrrr.rrrrrrpropertyrzr{rTrrrrrrrrrrr rrrrrr0rrrrrrirorrrrrrrrCrBrKrrrrrGr r rr(r rrrbrrrrr r%r(rr,r:rBrrMrhrr9rxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr&r(r-r3rr>rBrErHr@rArBrCrDrErFrLrMrPrQrRrSrVrWrXrGrHrI_packet_handlersrQrrr<rKrr9r/floatrTrV_DEFAULT_WINDOW_DEFAULT_MAX_PKTSIZEr+r^r,r`r-rcr.rer/rgrrrrrrprarvryrSSHAcceptHandlerrrrrrrqrrrr rrrs *%gi8NIC`+W66`+0`+)`+:G`+ }`+/3`+D$ $}2E)F $,]$; $,]$; @D   + HY/+ D+ Z%F)J( " = 1 3 1 1 :hy&9 :- :26 : 8< $!))!4  4 4 * 8E)Y*>$?@ 8 8/!:t @m@3@!$@,4SM@>B@8#&.1',2*#:?E<#6s#6##6S#6%*#6/5#6JF)>)>F4F@8I#6$?C;? 8x '; 8%-i%8 8DH 8H"%"8"t"(# H I  6 2s &&&  , 6C6Xe_6!)%65:6.DT%[D%D& .t.`d(sdsl:>C<3C5%*/49#y.4I 0eD%K.@ 0T 00" C$-260S ).2sC'059FsFCF(F-1F***c*)2*7;*6>>S>(1>6:>:I#IsI"+I04I2iici!*i/3iV55c5!*5/35(#P##Ps#P*3#P8<#PJMMuM'0M59M<(H#(Hs(H*3(H8<(HT6H#6Hs6H*36H8<6Hp>>c>)2>7;>800S0(106:0, > >S >)2 >7; >#Ac#A3#A&/#A48#AJ:3::3<:AE:0:c:3:.7:<@:2+#+(,+(; (>   (@  (?  (9 (8 (8 (A (A (A (@" (?#$ (@%& (@'* (=+, &(J (E/4 " L ' , s C  04 <@3@@@: %s %t %AE15'&eD%,<&='&!)#'&:>'&R0<*/4c44#'44842<@)1)8.B!:8C=!:#&!:#&!:),!:  !:F=A*2*9/C!;HSM!;$'!;$'!;*-!;  !;F3B1E5C5+.5 54!032228E2!034448G4BD ">B"/3 "#7#? " "+. ";> " ".6c] " "-0 "  " mF+]6-BBC "<@"/3 "#8#@ " "+3C= " "-0 " " nV,nV.DDE "6 6-065A6<6s6|62:>X"X14XX'*X%%56XCNXXt,C,,/,4?,,\<3ffd4Z?d*e)d ee4e=e@ffd5ZAd*e)d dfd6ZBd*e)d dfd7ZCd8eDeEd9ee d:ee d;ed eeee2ff d<ZFd8eGeEd dfd=ZH dd>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d?d@eIdAeJee dBeJee dCeJeKdDeJeLdEeJeMee fdFeJee dGeJeNdHeJeOdIeJeMe2e fdJeJee dKeJee dLeJedMeJee dNeJe dOeJe2dPeJe2d eeDePff$dQZQdReRdSeRd eeSeTeTffdTZUeVdeWeWeWeXjdUdUdVdReRdWeeEdXeZdYe[dZe[d[e2d\ed]edSeRd e\eEfd^Z]d>eXjdeWeWeWdfd_e^dAeJee d[e2dWeeEdXeZdYe[dZe[dMee dSeRd ee_e`ffd`ZadaddbdReRdceddeebdSeRd ecf deZd dddfeeefdgd@egeEdhe die2dje dke2dMee dNe dOe2dPe2d ee-eEe.eEffdlZhdReRdSeRd eeTeSffdmZieVddfeeefdgd@ejeEd,e d-e2dMee dNe dOe2dPe2d ekfdnZleVdoemdReRdSeRd ekfdpZnddfeeefdgd@eoeEdqe dMee dNe dOe2dPe2d ee4eEe5eEffdrZpdReRdSeRd eeTeSffdsZqeVddfeeefdgd@ereEd2e dMee dNe dOe2dPe2d ekfdtZseVdoetdReRdSeRd ekfduZu ddvevdwe dxeJe2dSeRd edeff dyZweVddwe dxeJe2dSeRd dfdzZxeVddwe dxeJe2dSeRd d{fd|ZyeVddwe dxeJe2dSeRd ezfd}Z{eV ddwe dxeJe2dSeRd ezfd~Z| deeefdd@e}dee2dOe2dPe2d ee7e8ff dZ~ deeefdd@e}dee2dOe2dPe2d ee7e8ff dZdReRdSeRd eeTeSffdZdReRdSeRd eeTeSffdZeV dd,e d-e2de deed ekf dZeVd2e de de2d ekfdZeVd,e d-e2de de2d ekf dZeVd2e de d ekfdZeVd,e d-e2de d ekfdZeVd2e de de2d ekfdZeVd,e d-e2d ekfdZeV ddee2dee2d e@fdZeV ddee2dee2d e@fdZeVd>d>ddfefdCeJeKdDeJeLdee d efdZxZS)r_aSSH client connection This class represents an SSH client connection. Once authentication is successful on a connection, new client sessions can be opened by calling :meth:`create_session`. Direct TCP connections can be opened by calling :meth:`create_connection`. Remote listeners for forwarded TCP connections can be opened by calling :meth:`create_server`. Direct UNIX domain socket connections can be opened by calling :meth:`create_unix_connection`. Remote listeners for forwarded UNIX domain socket connections can be opened by calling :meth:`create_unix_server`. TCP port forwarding can be set up by calling :meth:`forward_local_port` or :meth:`forward_remote_port`. UNIX domain socket forwarding can be set up by calling :meth:`forward_local_path` or :meth:`forward_remote_path`. Mixed forwarding from a TCP port to a UNIX domain socket or vice-versa can be set up by calling :meth:`forward_local_port_to_path`, :meth:`forward_local_path_to_port`, :meth:`forward_remote_port_to_path`, or :meth:`forward_remote_path_to_port`. SSHClientConnectionOptionsrrrNr%rprrrct||||||d|j|_|j|_|j |_|j|_ d|_ d|_ |j|_ |j|_|j |_g|_|j&rt)|j&ng|_d|_|j.dk7r/|j.Dcgc]}|j1dc}|_nt5|_|j6|_|j:t=|j:|_|j@|_!|jD|_#tI|j>|_%|jL|_'|jP|_)tI|jN|_*|jVdk7r |jVn |j}|rZ tY||jZ|j\|_/|j`|_1|jd|_3|jf|_4d|_6i|_7i|_8ycc}w#tj$rY&wxYw)NFrrr)9r-r.rk_hostrm_portr _known_hostshost_key_alias_host_key_aliasr_server_host_keyserver_host_keys_handler_server_host_keys_handlerrdrpassword _password_client_host_keys client_keysr _client_keys_saved_rsa_keypreferred_authrr`r"disable_trivial_authr agent_pathrryagent_identities_agent_identitiesagent_forward_path_agent_forward_pathr_get_agent_keyspkcs11_provider_pkcs11_provider pkcs11_pin _pkcs11_pin_get_pkcs11_keysgss_hostrc gss_storegss_delegate_credsr[gss_kexr\gss_authr]r_re_kbdint_password_auth_remote_listeners_dynamic_remote_listeners) rr%rprrrrrr5s rr.zSSHClientConnection.__init__ s> w-e  -\\ \\ #//&55@D"26)0)I)I& )) ))79*1)<)dk7r1|j@r |j@}|j&r tC|z}|stCtEz}|jF%|jFs |jHr tK|z}tM|jj>t tNt4|jjPjSd d ||_*|jVjYd |j|jf|jjZrId j]d |jjZD}|jVjYd|y|jVjYd|j^|j`f|jVjYd|j|jfy)rNremote_peernamer~.sshrr r7HostKeyAlgorithmsrzConnected to SSH server at %s c3FK|]}tj|ywr,shlexquoterargs rrz7SSHClientConnection._connection_made..P "%B%@;>U[[%5%@! Proxy command: %s Local address: %s Peer address: %s)1r/rrrrr9rrrclient_host_keysignrrrnfilenoclient_host_pubkeysrclient_host_keypairsrr9r;r expanduseris_filer`accessR_OKrr=rrorserver_host_key_algsr:rrr>r@rrrr^rrr{r~r{rrr)r remote_peerrrdefault_known_hostsrmdefault_host_key_algsr{s rrz$SSHClientConnection._connection_made sX***zz!__ !__ "112CD )-h )D& DJ == , , 66x@BD&**: 114;;= 11+3&4D "]] / /%)$--*L*L%MD "%'D "    $&*D #$(D !$$&*3+8'::D*,$(//1 "5rww?(+,?(@D%(+D%!%|!;4::D  # #D8I8I$J$($8$8$FDJJ$(OOT ;!# == - - :**(,(C(C%$$025JJ&%,.1L1NN "  # # /''4+H+H57:OO&&; MM . . # 4 4 8 8#R!) * ! &#" 8**djj1 3 == & &HH%B%)]]%@%@%BBM KK  2M B KK  2"..0@0@A C KK  1"oot? Ar rIc|jr|jj|jrFt|jj D]}|ji|_i|_||j jdn\t|tr%|j jt|n'|j jdt|zt|1|y)zClean up this client connectionNrzConnection failure: ) ryrrrrrr{r~rerrr-r)rrI tcp_listenerr5s rrzSSHClientConnection._cleanupZ s ;; KK     ! ! $T%;%;%B%B%D E ""$!F&(D "-/D * ; KK  0 1 ^ , KK  SX & KK  3c#h> ? r keypairc|jrA|jD]2}||jvs||jvs!|j|y|jd|jvS)z>Choose signature algorithm to use for key-based authenticationTr3)rwrrMset_sig_algorithm)rrrs r_choose_signature_algz)SSHClientConnection._choose_signature_algq sc  --$..(SD4I4I-I--c2. %%b)T^^;;r rc. |j|jxs |j|j|j|}||_|S#t $r@}|j}|jr|d|jz }t |d|dd}~wwxYw)z)Validate and return the server's host keyz with alias z for host N)rrrrrrrr)rrhost_keyrIrks rvalidate_server_host_keyz,SSHClientConnection.validate_server_host_key| s K..$$2 X7H!) K::D##,t';';&<==&#j'?@d J  KsAA B;BBc|jS)a*Return the server host key used in the key exchange This method returns the server host key used to complete the key exchange with the server. If GSS key exchange is used, `None` is returned. :returns: An :class:`SSHKey` public key or `None` rrs rget_server_host_keyz'SSHClientConnection.get_server_host_key s$$$r c^|jDcgc]}|jdc}Scc}w)zReturn the server host key used in the key exchange This method returns the auth methods available to authenticate to the server. :returns: `list` of `str` r)r~rrrs rget_server_auth_methodsz+SSHClientConnection.get_server_auth_methods s-6:5G5GH5G6 g&5GHHHs*c|jr!|jjd|_|jrF|jjd}t |||_|jry|jrF|j j d|j|jtd|jd|jy)z>Attempt client authentication using the next compatible methodNrzAuth failed for user %szPermission denied for user z on host ) rzrr~rr#r{r~rrrrrs rrz!SSHClientConnection.try_next_auth s :: JJ   DJ  ''++A.F+D&9DJzz    2DNNC *+H.2nn-=Y.2jj\,;< =r c,|jrd|_yy)z>Return whether to allow GSS key exchange authentication or notFT)r^rs rgss_kex_auth_requestedz*SSHClientConnection.gss_kex_auth_requested    !&D r c,|jrd|_yy)z5Return whether to allow GSS MIC authentication or notFTr_rs rgss_mic_auth_requestedz*SSHClientConnection.gss_mic_auth_requested rr cK|jsy |jr(|j}|jdz|_d|_n |jj d}|J|j|r&|jdk(r|jdk7r||_n|jj}|Y|jd}|rD|jjtt|tj d{\}}nd}|jj"r |d dd k7r|d z }|||jj$fS#t $rd}YwxYw7Ww) z6Return a host key, host, and user to authenticate with)Nrr-cert-v01@openssh.comNrssh-rsa-cert-v01@openssh.comssh-rsarrr3.)rOr sig_algorithmrrr IndexErrorrr client_hostr9r  getnameinforrrNI_NUMERICSERVrclient_username)rrrrrYs rhost_based_auth_requestedz-SSHClientConnection.host_based_auth_requested sg$$"")) # 1 14L L &*#0044Q7C ? "?))#.==$CC))Z7*-D''*mm//  **:6H'+zz'='=8,f.C.C(E"E Q!  == , ,RS1AS1H 3 KK!>!>>>;"C&"Es8AEE !B"EEAE EEEEcK|jsy|jr[|jJ |jj|jd{}t ||j ddd|_|jrk|jJ|jjdt|j|jd{}t ||j ddd|_ |j sj|jj}t!j"|rt%t&t(|d{}|syt t+||_|j,r(|j,}|j.dz|_d|_n|j j3d}|j5|r'|j0dk(r|j.dk7r||_|S7#t$rYwxYw767w)z-Return a client key pair to authenticate withNrFrrr)rQrryget_keysrrrrrrr rrrrpublic_key_auth_requestedrrrr rrrrrrr)r agent_keys pkcs11_keysrrs rr z-SSHClientConnection.public_key_auth_requested s$$   ;;* ** #';;#7#78N8N#OO (,Z(8!!"1%$)D  ((4 44 $ : :&(=(=t?O?O!QQK%)$5D  bq !$)D !$$>>@&&v.#' .(A6#JJF%)v)>$?! "")) # 1 14L L &*#''++A.))#.==$CC))Z7*-D' Q!P  QKs[(H(G0G-G00AH H A9HHB(H-G00 G=9H<G==HHclK|js |jsy|j|j}t|r%t t gt tf|}tj|r't tt t|d{}nt t t|}d|_|S|jj}tj|r(t tt t|d{}|St t t|}|S77!w)z&Return a password to authenticate withN) rUrrrrr rrrrr rpassword_auth_requested)rrrs rrz+SSHClientConnection.password_auth_requestedCs""4+E+E >> %&*nnH!F4Xc]): ;XFH""8,!%i &>!II x8!DN[[88:F""6*!%i &>!GG  v6JHs%BD4D0A5D4D2 D42D4promptrcK|jj||}tj|rt t t |d{}t t |S7w)z?Return a password to authenticate with and what to change it toN)rpassword_change_requestedrrrr r!)rrrrs rrz-SSHClientConnection.password_change_requested_sU66vtD   v & *@ A6JJF*F33KA A%A#A%c8|jjy)z#Report a successful password changeN)rpassword_changedrs rrz$SSHClientConnection.password_changedjs $$&r c8|jjy)zReport a failed password changeN)rpassword_change_failedrs rrz*SSHClientConnection.password_change_failedos **,r cXK|jsy|jj}tj|r&t t tt|d{}|tur$|j|js d|_ d}nd}t tt|S7Gw)a&Return the list of supported keyboard-interactive auth methods If keyboard-interactive auth is not supported in the client but a password was provided when the connection was opened, this will allow sending the password via keyboard-interactive auth. NTr) rSrkbdint_auth_requestedrrrr rrNotImplementedrrrs rrz)SSHClientConnection.kbdint_auth_requestedts  224   v & (3- 8&AAF ^ #~~)$2L2L-1*HSM6**BsAB* B(!AB*r6 instructionspromptscK|jr[|sg}|St|dk(rC|ddj}d|vsd|vr!|jd{}||gnd}|Sd}|Sd}|S|jj ||||}t j|r!ttt|d{}|Stt|}|S7{7w)z9Return responses to a keyboard-interactive auth challengerrrpasscodeN) rrlowerrrkbdint_challenge_receivedrrrr r ) rr6rrrrrrrs rr!z-SSHClientConnection.kbdint_challenge_receiveds  % %57*)W" A,,.':+?%)%A%A%CCH-5-AztH $H [[::4;?JF""6*!%i&?!HH 7! DIs%ACCA"C7C8CCrc"ttd)zmProcess an inbound session open request These requests are disallowed on an SSH client. z Session open forbidden on clientrrYrrs r_process_session_openz)SSHClientConnection._process_session_opens?AC Cr c"ttd)z{Process an inbound direct TCP/IP channel open request These requests are disallowed on an SSH client. z&Direct TCP/IP open forbidden on clientr#r$s r_process_direct_tcpip_openz.SSHClientConnection._process_direct_tcpip_opens?GI Ir rUc|j}|j}|j}|j}|j |jd}|jd}t tt|jj||fxs|jj|}|rU|j||\} } |jjd||f|jjd||f| | fStt d#t$r t ddwxYw)z8Process an inbound forwarded TCP/IP channel open requestrz-Invalid forwarded TCP/IP channel open requestNz'Accepted forwarded TCP connection on %s Client address: %sNo such listener)rrIrrrrrrsrrrrprocess_connectionr{r~rrZ) rrUdest_host_bytesrrorig_host_bytesrjrqrirrrs r_process_forwarded_tcpip_openz1SSHClientConnection._process_forwarded_tcpip_opensD!++-%%'  ++-%%'  :'..w7I'..w7I,U3  " " & & 9'= > :  * * . .y 9; $77 9MMD' KK  F'3 5 KK  3i5K L= "#68JK K)" :!/059 : :s "D**ErrcZK|jdt|t|d{|jj d||f|j j ||f}|r;|jj ||k(r |j|=|j ||f=yy7}w)zClose a remote TCP/IP listenerscancel-tcpip-forwardNz Closed remote TCP listener on %s)rrrr{r~rrr)rrrrs rclose_client_tcp_listenerz-SSHClientConnection.close_client_tcp_listeners'' #VK%8&:MO O O ;%{3 5))--{K.HI --11+>(J22;?&&{K'?@  Os)B+B)A>B+c"ttd)zProcess an inbound direct UNIX domain channel open request These requests are disallowed on an SSH client. z2Direct UNIX domain socket open forbidden on clientr#r$s r3_process_direct_streamlocal_at_openssh_dot_com_openzGSSHClientConnection._process_direct_streamlocal_at_openssh_dot_com_opens? 56 6r c"ttd)zmProcess an inbound TUN/TAP open request These requests are disallowed on an SSH client. z#TUN/TAP request forbidden on clientr#r$s r$_process_tun_at_openssh_dot_com_openz8SSHClientConnection._process_tun_at_openssh_dot_com_open s?DF Fr c|j}|j}|j |jd}t t t|jj|}|r3|j\}}|jjd|||fSttd#t$r t ddwxYw)z=Process an inbound forwarded UNIX domain channel open requestrz2Invalid forwarded UNIX domain channel open requestNz%Accepted remote UNIX connection on %sr*)rrrrrrrtrrrr+r{r~rrZ)rrUdest_path_bytesrYrwrrrs r6_process_forwarded_streamlocal_at_openssh_dot_com_openzJSSHClientConnection._process_forwarded_streamlocal_at_openssh_dot_com_opens !++-     :'..w7I -e4..229=? $779MD' KK  Di P= "#68JK K" :!/059 : :s B88CrcK|jdt|d{|jjd|||jvr|j|=yy7=w)z*Close a remote UNIX domain socket listeners&cancel-streamlocal-forward@openssh.comNClosed UNIX listener on %s)rrr{r~r)rrs rclose_client_unix_listenerz.SSHClientConnection.close_client_unix_listener4sk'' 5vk7JL L L 5{C $00 0&&{3 1  LsA!A>A!c|j}|j}|j |jd}|j rw|jjd|jjd||f|j}|j||||j jfSttd#t$r t ddwxYw)z+Process an inbound X11 channel open requestrz*Invalid forwarded X11 channel open requestNzAccepted X11 connectionr)zX11 forwarding disabled)rrIrrrrrr{r~reset_inbound_peer_namesrvrrZ)rrUr-rjrirs r_process_x11_openz%SSHClientConnection._process_x11_open?s!++-%%'  :'..w7I    KK  6 7 KK  3i5K L**,D  ' ' 9 =++>>@@ @"#6#<> >" :!/059 : :s CC,c|j|jrF|jjd|j |j |jfSt td)z2Process an inbound auth agent channel open requestzAccepted SSH agent connectionzAuth agent forwarding disabled)rrr{r~r`ryrrZrGs r+_process_auth_agent_at_openssh_dot_com_openz?SSHClientConnection._process_auth_agent_at_openssh_dot_com_open[so   # # KK  < =,,.001I1IJL L##6#CE Er cD|j|j|y)z+Process a list of accepted server host keysN)r_finish_hostkeysrGs r6_process_hostkeys_00_at_openssh_dot_com_global_requestzJSSHClientConnection._process_hostkeys_00_at_openssh_dot_com_global_requestks ..v67r c fK|js-|jjd|jdy|j-|jj d|jdyg}t |j}g}g}g}|r |j}t|}||jvr|j|nM||jvr#|j||j|n|j|t|f|r|r|jddjd|Dd{\} }| t k(r~tdt|j"z} |D]W\}} |j} |j%| | z| r|j|=|jjd Yn|jjd |j'|jj d t)|d t)|d t)|dt)|d |j||||} t+j,| r| J| d{|jdy#t$rYwxYw7_7)w)z)Finish processing hostkeys global requestz,Ignoring server host key message: no handlerFNz.Server host key not verified: handler disabledshostkeys-prove-00@openssh.comr c3&K|] \}}| ywr,r)rrYkey_strs rrz7SSHClientConnection._finish_hostkeys..s95ZQ5rhostkeys-prove-00@openssh.comz!Server host key validation failedz$Server host key prove request failedzServer host key report: z added, z removed, z retained, z revokedT)rr{rrr9r~rrrr<rremoverrrrrWr$verifyrrrr)rrUaddedremovedretainedrevokedproverrrVrrErrs rrAz$SSHClientConnection._finish_hostkeysqs-- KK  M N  ( ( /   " " * KK  M N  ( ( / t../ !,,.+H5$111NN3'D333OOC(NN3'LL#vh'7!89 $($=$=09599%;;OGV-- ?@ 0 012%*LC ++-Czz&7"2C8 S) **+NO %* ""#IJ 3CJCM?+L>3 4//w08'C   v &% %%LL $$T*G"  ;: sPBJ1BJJ1 -J1 J,D7J1J/J1 J)%J1(J))J1/J1rdisplay auth_pathsingle_connectioncK|stjjd}|s td|js$t |j ||d{|_|jj|||S7&w)z'Attach a channel to a local X11 displayDISPLAYzX11 display not setN)r`environrrrrr attach)rrrNrOrPs rattach_x11_listenerz'SSHClientConnection.attach_x11_listenersujjnnY/G23 3!!'A GY(0"0D !!(($8IJJ"0sABA>'Bcd|jr$|jj|rd|_yyy)rNrdetachrs rrz'SSHClientConnection.detach_x11_listener3   !!((.%)"/ r r) subsystemenvsend_env request_pty term_type term_size term_modesx11_forwarding x11_display x11_auth_pathx11_single_connectionrXrYrZr[rr&rZr[r\r]r^r_r`rarbrcrdrXrYrZr[cK|dk(r|jj}|dk(r|jj}|dk(r|jj}|dk(r|jj}|dk(r|jj }|dk(r|jj }|dk(r|jj}| dk(r|jj} | dk(r|jj} | dk(r|jj} | dk(r|jj} | dk(r|jj} |dk(r|jj}|dk(r|jj}|dk(r|jj}|dk(r|jj }i}|rH|D]C}t#||j%fdt&j(j+DE|rV t-|t.r|j%d|Dn,|j%t1t2t4t4f||dk(rd}n'|dk(rt9|xr|xs| }n |r t9|}t;||j<||||}|j?|||||||| xsi| | | | t9|j@ d{}||fS#t6$r t7ddwxYw7!w) aCreate an SSH client session This method is a coroutine which can be called to create an SSH client session used to execute a command, start a subsystem such as sftp, or if no command or subsystem is specified run an interactive shell. Optional arguments allow terminal and environment information to be provided. By default, this class expects string data in its send and receive functions, which it encodes on the SSH connection in UTF-8 (ISO 10646) format. An optional encoding argument can be passed in to select a different encoding, or `None` can be passed in if the application wishes to send and receive raw bytes. When an encoding is set, an optional errors argument can be passed in to select what Unicode error handling strategy to use. Other optional arguments include the SSH receive window size and max packet size which default to 2 MB and 32 KB, respectively. :param session_factory: A `callable` which returns an :class:`SSHClientSession` object that will be created to handle activity on this session :param command: (optional) The remote command to execute. By default, an interactive shell is started if no command or subsystem is provided. :param subsystem: (optional) The name of a remote subsystem to start up. :param env: (optional) The environment variables to set for this session. Keys and values passed in here will be converted to Unicode strings encoded as UTF-8 (ISO 10646) for transmission. .. note:: Many SSH servers restrict which environment variables a client is allowed to set. The server's configuration may need to be edited before environment variables can be successfully set in the remote environment. :param send_env: (optional) A list of environment variable names to pull from `os.environ` and set for this session. Wildcards patterns using `'*'` and `'?'` are allowed, and all variables with matching names will be sent with whatever value is set in the local environment. If a variable is present in both env and send_env, the value from env will be used. :param request_pty: (optional) Whether or not to request a pseudo-terminal (PTY) for this session. This defaults to `True`, which means to request a PTY whenever the `term_type` is set. Other possible values include `False` to never request a PTY, `'force'` to always request a PTY even without `term_type` being set, or `'auto'` to request a TTY when `term_type` is set but only when starting an interactive shell. :param term_type: (optional) The terminal type to set for this session. :param term_size: (optional) The terminal width and height in characters and optionally the width and height in pixels. :param term_modes: (optional) POSIX terminal modes to set for this session, where keys are taken from :ref:`POSIX terminal modes ` with values defined in section 8 of :rfc:`RFC 4254 <4254#section-8>`. :param x11_forwarding: (optional) Whether or not to request X11 forwarding for this session, defaulting to `False`. If set to `True`, X11 forwarding will be requested and a failure will raise :exc:`ChannelOpenError`. It can also be set to `'ignore_failure'` to attempt X11 forwarding but ignore failures. :param x11_display: (optional) The display that X11 connections should be forwarded to, defaulting to the value in the environment variable `DISPLAY`. :param x11_auth_path: (optional) The path to the Xauthority file to read X11 authentication data from, defaulting to the value in the environment variable `XAUTHORITY` or the file :file:`.Xauthority` in the user's home directory if that's not set. :param x11_single_connection: (optional) Whether or not to limit X11 forwarding to a single connection, defaulting to `False`. :param encoding: (optional) The Unicode encoding to use for data exchanged on this session. :param errors: (optional) The error handling strategy to apply on Unicode encode/decode errors. :param window: (optional) The receive window size for this session. :param max_pktsize: (optional) The maximum packet size for this session. :type session_factory: `callable` :type command: `str` :type subsystem: `str` :type env: `dict` with `str` keys and values :type send_env: `list` of `str` :type request_pty: `bool`, `'force'`, or `'auto'` :type term_type: `str` :type term_size: `tuple` of 2 or 4 `int` values :type term_modes: `dict` with `int` keys and values :type x11_forwarding: `bool` or `'ignore_failure'` :type x11_display: `str` :type x11_auth_path: `str` :type x11_single_connection: `bool` :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: an :class:`SSHClientChannel` and :class:`SSHClientSession` :raises: :exc:`ChannelOpenError` if the session can't be opened rc3NK|]\}}j|r||fywr,)r)rrrwrs rrz5SSHClientConnection.create_session..s-8>P U")//#"6!$U|>Ps"%c3@K|]}|jddyw)=rN)rf)ritems rrz5SSHClientConnection.create_session..s#G34DJJsA$63szInvalid environment valueNforceTauto)!rr&rZr[r\r]r^r_r`rarbrcrdrXrYrZr[rrr`rSrvrerrrrrrr)r creater)rrr&rZr[r\r]r^r_r`rarbrcrdrXrYrZr[new_envrrrrs @rcreate_sessionz"SSHClientConnection.create_sessionsD b=mm++G ? //I "9--##C r>}}--H " --33K ? //I ? //I  11J R !]]99N " --33K B  MM77M B &$(MM$G$G ! r>}}--H R<]]))F R<]]))F " --33K"$ )#.8bjj>N>N>P88  Hc4(NN#G3#GHNN4S(93#?@ ' !K F "yG'2FY-GHK y/K" djj(F & 5 OWi$+[)Y$.$4"n$/$9$()A)A$B DDW}G H !<=4G H8Ds,G?K<AK!BK<K:K<!K77K<r[rcK|jtg|i|d{\}}t||t||t||tfS7/w)aOpen an SSH client session This method is a coroutine wrapper around :meth:`create_session` designed to provide a "high-level" stream interface for creating an SSH client session. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it returns an :class:`SSHWriter` and two :class:`SSHReader` objects representing stdin, stdout, and stderr which can be used to perform I/O on the session. With the exception of `session_factory`, all of the arguments to :meth:`create_session` are supported and have the same meaning. N)rnrrrr?rr[rrrs r open_sessionz SSHClientConnection.open_sessionsi 2d11 "5%)5-355 g '4()GT*B'4)=>@ @ 5sAA0AT)inputstdinstdoutstderrbufsizesend_eofrecv_eofrrrsrtrurvrwrxcK|jtg|i| d{\} } |} |r#| j|| jd} | j | |||||d{| S7N7w)a Create a process on the remote system This method is a coroutine wrapper around :meth:`create_session` which can be used to execute a command, start a subsystem, or start an interactive shell, optionally redirecting stdin, stdout, and stderr to and from files or pipes attached to other local and remote processes. By default, the stdin, stdout, and stderr arguments default to the special value `PIPE` which means that they can be read and written interactively via stream objects which are members of the :class:`SSHClientProcess` object this method returns. If other file-like objects are provided as arguments, input or output will automatically be redirected to them. The special value `DEVNULL` can be used to provide no input or discard all output, and the special value `STDOUT` can be provided as `stderr` to send its output to the same stream as `stdout`. In addition to the arguments below, all arguments to :meth:`create_session` except for `session_factory` are supported and have the same meaning. :param input: (optional) Input data to feed to standard input of the remote process. If specified, this argument takes precedence over stdin. Data should be a `str` if encoding is set, or `bytes` if not. :param stdin: (optional) A filename, file-like object, file descriptor, socket, or :class:`SSHReader` to feed to standard input of the remote process, or `DEVNULL` to provide no input. :param stdout: (optional) A filename, file-like object, file descriptor, socket, or :class:`SSHWriter` to feed standard output of the remote process to, or `DEVNULL` to discard this output. :param stderr: (optional) A filename, file-like object, file descriptor, socket, or :class:`SSHWriter` to feed standard error of the remote process to, `DEVNULL` to discard this output, or `STDOUT` to feed standard error to the same place as stdout. :param bufsize: (optional) Buffer size to use when feeding data from a file to stdin :param send_eof: Whether or not to send EOF to the channel when EOF is received from stdin, defaulting to `True`. If set to `False`, the channel will remain open after EOF is received on stdin, and multiple sources can be redirected to the channel. :param recv_eof: Whether or not to send EOF to stdout and stderr when EOF is received from the channel, defaulting to `True`. If set to `False`, the redirect targets of stdout and stderr will remain open after EOF is received on the channel and can be used for multiple redirects. :type input: `str` or `bytes` :type bufsize: `int` :type send_eof: `bool` :type recv_eof: `bool` :returns: :class:`SSHClientProcess` :raises: :exc:`ChannelOpenError` if the channel can't be opened N)rnrrN write_eofredirect) rrrrsrtrurvrwrxr[rrprocess new_stdins rcreate_processz"SSHClientConnection.create_processsR2d11 /#/'-// g.3   JJu  NN Iy&&&(< < </ .transport_factoryNs**:; ;r rXNr) rrnrrrArNrzr{ get_protocol)rr r&rvrrrsrtrurXrrrYr=r} stdin_pipes ` rcreate_subprocessz%SSHClientConnection.create_subprocess&sP <#9 < 1T001BG;:B;39;; 9.3  4'::1=?J   U #  "I  FFGDDD)00222!; Es"&B)B%A$B)B'B)'B)F)checktimeoutrrczK|j|i|d{}|j||d{S77w)aRun a command on the remote system and collect its output This method is a coroutine wrapper around :meth:`create_process` which can be used to run a process to completion when no interactivity is needed. All of the arguments to :meth:`create_process` can be passed in to provide input or redirect stdin, stdout, and stderr, but this method waits until the process exits and returns an :class:`SSHCompletedProcess` object with the exit status or signal information and the output to stdout and stderr (if not redirected). If the check argument is set to `True`, a non-zero exit status from the remote process will trigger the :exc:`ProcessError` exception to be raised. In addition to the argument below, all arguments to :meth:`create_process` are supported and have the same meaning. If a timeout is specified and it expires before the process exits, the :exc:`TimeoutError` exception will be raised. By default, no timeout is set and this call will wait indefinitely. :param check: (optional) Whether or not to raise :exc:`ProcessError` when a non-zero exit status is returned :param timeout: Amount of time in seconds to wait for process to exit or `None` to wait indefinitely :type check: `bool` :type timeout: `int`, `float`, or `None` :returns: :class:`SSHCompletedProcess` :raises: | :exc:`ChannelOpenError` if the session can't be opened | :exc:`ProcessError` if checking non-zero exit status | :exc:`TimeoutError` if the timeout expires before exit N)r~r)rrrr[rr|s rrunzSSHClientConnection.runfs@T,++T%{3 5 /)Y1GH&&xM _k;%. ;;W};A)A6+A4, A6cK|jtg|i|d{\}}t||t||fS7w)aMOpen an SSH TCP direct connection This method is a coroutine wrapper around :meth:`create_connection` designed to provide a "high-level" stream interface for creating an SSH TCP direct connection. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it returns :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on the connection. With the exception of `session_factory`, all of the arguments to :meth:`create_connection` are supported and have the same meaning here. :returns: an :class:`SSHReader` and :class:`SSHWriter` :raises: :exc:`ChannelOpenError` if the connection can't be opened Nrrrrrps ropen_connectionz#SSHClientConnection.open_connectionsV,5d44 2"&2*022 g $'7D)AAA 2AA Ac K|j}|jjd||f|jdt |t |d{\}} |t k(r|dk(r| j}d} n.t| jdk(r| jd} | jtt||||||||} | r+|jjd|| |j|<| |j||f<| S| j|jjd t!d 7w) aoCreate a remote SSH TCP listener This method is a coroutine which can be called to request that the server listen on the specified remote address and port for incoming TCP connections. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the listener. If the request fails, `None` is returned. :param session_factory: A `callable` or coroutine which takes arguments of the original host and port of the client and decides whether to accept the connection or not, either returning an :class:`SSHTCPSession` object used to handle activity on that connection or raising :exc:`ChannelOpenError` to indicate that the connection should not be accepted :param listen_host: The hostname or address on the remote host to listen on :param listen_port: The port number on the remote host to listen on :param encoding: (optional) The Unicode encoding to use for data exchanged on the connection :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type session_factory: `callable` or coroutine :type listen_host: `str` :type listen_port: `int` :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened z"Creating remote TCP listener on %ss tcpip-forwardNrTr>FzAssigning dynamic port %dz$Failed to create remote TCP listener)r r{r~rrrrWrIrr+rrsr rrrr) rrrrrXrYrZr[rVrUdynamicrs rr!z!SSHClientConnection.create_serversVb"'')  =%{3 5!% 9 9 f[16+3F!HH ) )a$//1  v3356!;%%'    +F3D/4?4 L>F..{;?GD " "; #; <O     KK  E F$%KL LEHsAEEC6Ehandler_factoryc|Kdtdtdtffd }|j|g|i|d{S7w)a=Start a remote SSH TCP listener This method is a coroutine wrapper around :meth:`create_server` designed to provide a "high-level" stream interface for creating remote SSH TCP listeners. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it takes a `handler_factory` which returns a `callable` or coroutine that will be passed :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on each new connection which arrives. Like :meth:`create_server`, `handler_factory` can also raise :exc:`ChannelOpenError` if the connection should not be accepted. With the exception of `handler_factory` replacing `session_factory`, all of the arguments to :meth:`create_server` are supported and have the same meaning here. :param handler_factory: A `callable` or coroutine which takes arguments of the original host and port of the client and decides whether to accept the connection or not, either returning a callback or coroutine used to handle activity on that connection or raising :exc:`ChannelOpenError` to indicate that the connection should not be accepted :type handler_factory: `callable` or coroutine :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened rirjr c(t||S)z#Return a TCP stream session handler)r)rirjrs rrz9SSHClientConnection.start_server..session_factoryxs'y)'LM Mr N)rrrr!rrr[rrs ` r start_serverz SSHClientConnection.start_serverUsYF Ns Ns N} N (T''9)-91799 99s 2<:<rncK|jjd||j||||}|j||d{}||fS7w)a Create an SSH UNIX domain socket direct connection This method is a coroutine which can be called to request that the server open a new outbound UNIX domain socket connection to the specified destination path. If the connection is successfully opened, a new SSH channel will be opened with data being handled by a :class:`SSHUNIXSession` object created by `session_factory`. By default, this class expects data to be sent and received as raw bytes. However, an optional encoding argument can be passed in to select the encoding to use, allowing the application to send and receive string data. When encoding is set, an optional errors argument can be passed in to select what Unicode error handling strategy to use. Other optional arguments include the SSH receive window size and max packet size which default to 2 MB and 32 KB, respectively. :param session_factory: A `callable` which returns an :class:`SSHUNIXSession` object that will be created to handle activity on this session :param remote_path: The remote path to connect to :param encoding: (optional) The Unicode encoding to use for data exchanged on the connection :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type session_factory: `callable` :type remote_path: `str` :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: an :class:`SSHUNIXChannel` and :class:`SSHUNIXSession` :raises: :exc:`ChannelOpenError` if the connection can't be opened z$Opening direct UNIX connection to %sN)r{r~r`rh rrrnrXrYrZr[rrs rrpz*SSHClientConnection.create_unix_connectionsWd ?M''&&+N _kBBW}CAAA AcK|jtg|i|d{\}}t||t||fS7w)auOpen an SSH UNIX domain socket direct connection This method is a coroutine wrapper around :meth:`create_unix_connection` designed to provide a "high-level" stream interface for creating an SSH UNIX domain socket direct connection. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it returns :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on the connection. With the exception of `session_factory`, all of the arguments to :meth:`create_unix_connection` are supported and have the same meaning here. :returns: an :class:`SSHReader` and :class:`SSHWriter` :raises: :exc:`ChannelOpenError` if the connection can't be opened Nrprrrrps ropen_unix_connectionz(SSHClientConnection.open_unix_connectionsY..$--.B?/3?7=? ? g $'7D)AAA  ?rc bK|jjd||jdt|d{\}}|j |t k(r)t t|||||||} | |j|<| S|jjdtd7ow)aCreate a remote SSH UNIX domain socket listener This method is a coroutine which can be called to request that the server listen on the specified remote path for incoming UNIX domain socket connections. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the listener. If the request fails, `None` is returned. :param session_factory: A `callable` or coroutine which decides whether to accept the connection or not, either returning an :class:`SSHUNIXSession` object used to handle activity on that connection or raising :exc:`ChannelOpenError` to indicate that the connection should not be accepted :param listen_path: The path on the remote host to listen on :param encoding: (optional) The Unicode encoding to use for data exchanged on the connection :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type session_factory: `callable` :type listen_path: `str` :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened z#Creating remote UNIX listener on %ssstreamlocal-forward@openssh.comNz%Failed to create remote UNIX listener) r{r~rrrrWrtr rrr) rrrrXrYrZr[rVrUrs rcreate_unix_serverz&SSHClientConnection.create_unix_serversX > L $ 9 9 .{0C!EE  ) ),V4T?5@(5;V5@BH 3;D " "; /O KK  F G$%LM MEs;B/B-A0B/cdKdtffd }|j|g|i|d{S7w)aDStart a remote SSH UNIX domain socket listener This method is a coroutine wrapper around :meth:`create_unix_server` designed to provide a "high-level" stream interface for creating remote SSH UNIX domain socket listeners. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it takes a `handler_factory` which returns a `callable` or coroutine that will be passed :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on each new connection which arrives. Like :meth:`create_unix_server`, `handler_factory` can also raise :exc:`ChannelOpenError` if the connection should not be accepted. With the exception of `handler_factory` replacing `session_factory`, all of the arguments to :meth:`create_unix_server` are supported and have the same meaning here. :param handler_factory: A `callable` or coroutine which decides whether to accept the UNIX domain socket connection or not, either returning a callback or coroutine used to handle activity on that connection or raising :exc:`ChannelOpenError` to indicate that the connection should not be accepted :type handler_factory: `callable` or coroutine :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened r c$tS)z2Return a UNIX domain socket stream session handler)r)rsrrz>SSHClientConnection.start_unix_server..session_factory<s((9: :r N)rrrs ` rstart_unix_serverz%SSHClientConnection.start_unix_serversHJ ;!5 ; -T,,_>.2>6<>> >>s &0.0client_factoryrkrmc>Kt|||fd|i|d{S7w)aCreate a tunneled SSH client connection This method is a coroutine which can be called to open an SSH client connection to the requested host and port tunneled inside this already established connection. It takes all the same arguments as :func:`create_connection` but requests that the upstream SSH server open the connection rather than connecting directly. rZNr)rrrkrmrs rcreate_ssh_connectionz)SSHClientConnection.create_ssh_connectionDs6(d?/3?7=?? @?s c<Kt||fd|i|d{S7w)aMake a tunneled SSH client connection This method is a coroutine which can be called to open an SSH client connection to the requested host and port tunneled inside this already established connection. It takes all the same arguments as :func:`connect` but requests that the upstream SSH server open the connection rather than connecting directly. rZN)rhrrkrmrs r connect_sshzSSHClientConnection.connect_sshVs%T4?????? rc<Kt||fd|i|d{S7w)aMake a tunneled reverse direction SSH connection This method is a coroutine which can be called to open an SSH client connection to the requested host and port tunneled inside this already established connection. It takes all the same arguments as :func:`connect` but requests that the upstream SSH server open the connection rather than connecting directly. rZN)connect_reversers rconnect_reverse_sshz'SSHClientConnection.connect_reverse_sshes2%T4//'-// //rc<Kt||fd|i|d{S7w)aCreate a tunneled SSH listener This method is a coroutine which can be called to open a remote SSH listener on the requested host and port tunneled inside this already established connection. It takes all the same arguments as :func:`listen` but requests that the upstream SSH server open the listener rather than listening directly via TCP/IP. rZNlistenrs r listen_sshzSSHClientConnection.listen_sshus%D$>t>v>>>>rc<Kt||fd|i|d{S7w)aCreate a tunneled reverse direction SSH listener This method is a coroutine which can be called to open a remote SSH listener on the requested host and port tunneled inside this already established connection. It takes all the same arguments as :func:`listen_reverse` but requests that the upstream SSH server open the listener rather than listening directly via TCP/IP. rZN)listen_reversers rlisten_reverse_sshz&SSHClientConnection.listen_reverse_sshs2$D$.t.&,.. ..rrZr[ remote_unitcK|jjd|dn t||j||}|j |t |d{}||fS7w)a)Create an SSH layer 3 tunnel This method is a coroutine which can be called to request that the server open a new outbound layer 3 tunnel to the specified remote TUN device. If the tunnel is successfully opened, a new SSH channel will be opened with data being handled by a :class:`SSHTunTapSession` object created by `session_factory`. Optional arguments include the SSH receive window size and max packet size which default to 2 MB and 32 KB, respectively. :param session_factory: A `callable` which returns an :class:`SSHUNIXSession` object that will be created to handle activity on this session :param remote_unit: The remote TUN device to connect to :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type session_factory: `callable` :type remote_unit: `int` or `None` :type window: `int` :type max_pktsize: `int` :returns: an :class:`SSHTunTapChannel` and :class:`SSHTunTapSession` :raises: :exc:`ChannelOpenError` if the connection can't be opened z(Opening layer 3 tunnel to remote unit %sNr)r{r~rrcopenrrrrrZr[rrs r create_tunzSSHClientConnection.create_tunsnH C"-"53{;K M))&+> /3L"-//W}/AA#A! A#cK|jjd|dn t||j||}|j |t |d{}||fS7w)a)Create an SSH layer 2 tunnel This method is a coroutine which can be called to request that the server open a new outbound layer 2 tunnel to the specified remote TAP device. If the tunnel is successfully opened, a new SSH channel will be opened with data being handled by a :class:`SSHTunTapSession` object created by `session_factory`. Optional arguments include the SSH receive window size and max packet size which default to 2 MB and 32 KB, respectively. :param session_factory: A `callable` which returns an :class:`SSHUNIXSession` object that will be created to handle activity on this session :param remote_unit: The remote TAP device to connect to :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type session_factory: `callable` :type remote_unit: `int` or `None` :type window: `int` :type max_pktsize: `int` :returns: an :class:`SSHTunTapChannel` and :class:`SSHTunTapSession` :raises: :exc:`ChannelOpenError` if the connection can't be opened z(Opening layer 2 tunnel to remote unit %sNr)r{r~rrcrrrs r create_tapzSSHClientConnection.create_tapsnH C"-"53{;K M))&+> /3H"-//W}/rcK|jtg|i|d{\}}t||t||fS7w)a"Open an SSH layer 3 tunnel This method is a coroutine wrapper around :meth:`create_tun` designed to provide a "high-level" stream interface for creating an SSH layer 3 tunnel. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it returns :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on the tunnel. With the exception of `session_factory`, all of the arguments to :meth:`create_tun` are supported and have the same meaning here. :returns: an :class:`SSHReader` and :class:`SSHWriter` :raises: :exc:`ChannelOpenError` if the connection can't be opened N)rrrrrps ropen_tunzSSHClientConnection.open_tunT*.doo.D?/3?7=?? g $'7D)AAA ?rcK|jtg|i|d{\}}t||t||fS7w)a"Open an SSH layer 2 tunnel This method is a coroutine wrapper around :meth:`create_tap` designed to provide a "high-level" stream interface for creating an SSH layer 2 tunnel. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it returns :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on the tunnel. With the exception of `session_factory`, all of the arguments to :meth:`create_tap` are supported and have the same meaning here. :returns: an :class:`SSHReader` and :class:`SSHWriter` :raises: :exc:`ChannelOpenError` if the connection can't be opened N)rrrrrps ropen_tapzSSHClientConnection.open_tap rrrwrzc Kdttdtdtdtt tt tfffd }jjd||f tj|||d{}|d k(r|j}|j||f<|S7,#t$r"}jjd|d}~wwxYww) aFSet up local TCP port forwarding to a remote UNIX domain socket This method is a coroutine which attempts to set up port forwarding from a local TCP listening port to a remote UNIX domain path via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the port forwarding. :param listen_host: The hostname or address on the local host to listen on :param listen_port: The port number on the local host to listen on :param dest_path: The path on the remote host to forward the connections to :param accept_handler: A `callable` or coroutine which takes arguments of the original host and port of the client and decides whether or not to allow connection forwarding, returning `True` to accept the connection and begin forwarding or `False` to reject and close it. :type listen_host: `str` :type listen_port: `int` :type dest_path: `str` :type accept_handler: `callable` or coroutine :returns: :class:`SSHListener` :raises: :exc:`OSError` if the listener can't be opened rrirjr c(Krn||}tj|rttt|d{}|s/j j d||fttdj|d{S7O7wr}) rrrr rr{r~rrYrp)rrirjrrzrwrs rrzISSHClientConnection.forward_local_port_to_path..tunnel_connectionLs ' 9=&&v.#' $#@@FKK$$&F&/%;YH++K+IKK55o6?AA BAAs";BBA B B BBrNrr)rrrrrr,rr{r~rwr rtrrr)rrrrwrzrrrIs` `` rforward_local_port_to_pathz.SSHClientConnection.forward_local_port_to_path)sF B!6u!= B B+. B./1FFG B. E%{3Y @ 8tzz9J9D9DFFH ! "++-K:Bk;67F  KK  H# N  s<A"C!(B3B1B3 (C!1B33 C<CCC!rqrrc~Kdttdtttttfffd }j j d|f tj||d{}|j|<|S7#t$r"}j jd|d}~wwxYww)aSet up local UNIX domain socket forwarding to a remote TCP port This method is a coroutine which attempts to set up UNIX domain socket forwarding from a local listening path to a remote host and port via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the UNIX domain socket forwarding. :param listen_path: The path on the local host to listen on :param dest_host: The hostname or address to forward the connections to :param dest_port: The port number to forward the connections to :type listen_path: `str` :type dest_host: `str` :type dest_port: `int` :returns: :class:`SSHListener` :raises: :exc:`OSError` if the listener can't be opened rr cJKj|ddd{S7w)r~rrNr)rrqrrrs rrzISSHClientConnection.forward_local_path_to_port..tunnel_connections5 //092qBB BB #!#rNr) rrrr+rr{r~rxr rtrr)rrrqrrrrrIs` `` rforward_local_path_to_portz.SSHClientConnection.forward_local_path_to_portvs8 B!5e!< B-. e0DDE B F$y)&< > 9$ :K:EGGH.6k*G  KK  I3 O  s<AB=B7B 8B<B= B B:B55B::B=cKdtdtdttffd }jj d||ffj |||d{S7w)a2Set up remote port forwarding This method is a coroutine which attempts to set up port forwarding from a remote listening port to a local host and port via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the port forwarding. If the request fails, `None` is returned. :param listen_host: The hostname or address on the remote host to listen on :param listen_port: The port number on the remote host to listen on :param dest_host: The hostname or address to forward connections to :param dest_port: The port number to forward connections to :type listen_host: `str` :type listen_port: `int` :type dest_host: `str` :type dest_port: `int` :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened rrr cRtttjSz9Return an SSHTCPSession used to do remote port forwarding)rr rrv)rrrqrrrs rrz@SSHClientConnection.forward_remote_port..session_factorys+ -0// 9EG Gr +Creating remote TCP forwarder from %s to %sN)rrr rr{r~r!)rrrrqrrrs` `` rforward_remote_portz'SSHClientConnection.forward_remote_portsz@ G G(+ G09-0H G F%{3i5K M''(355 55sAA%A#A%cKdtttffd }jj d|j ||d{S7w)a?Set up remote UNIX domain socket forwarding This method is a coroutine which attempts to set up UNIX domain socket forwarding from a remote listening path to a local path via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the port forwarding. If the request fails, `None` is returned. :param listen_path: The path on the remote host to listen on :param dest_path: The path on the local host to forward connections to :type listen_path: `str` :type dest_path: `str` :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened r c^ttttj Sz:Return an SSHUNIXSession used to do remote path forwarding)rr rrry)rwrsrrz@SSHClientConnection.forward_remote_path..session_factorys. ."7844Y?A Ar ,Creating remote UNIX forwarder from %s to %sN)r rrr{r~r)rrrwrs` ` rforward_remote_pathz'SSHClientConnection.forward_remote_pathsV2 A>%+@!A A G$i 1,,_kJJJJsAAAAcKdtdtdttffd }jj d||fj |||d{S7w)aSet up remote TCP port forwarding to a local UNIX domain socket This method is a coroutine which attempts to set up port forwarding from a remote TCP listening port to a local UNIX domain socket path via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the port forwarding. If the request fails, `None` is returned. :param listen_host: The hostname or address on the remote host to listen on :param listen_port: The port number on the remote host to listen on :param dest_path: The path on the local host to forward connections to :type listen_host: `str` :type listen_port: `int` :type dest_path: `str` :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened rrr cPtttjSr)rr rry)rrrwrs rrzHSSHClientConnection.forward_remote_port_to_path..session_factorys) .144Y?A Ar rN)rrr rr{r~r!)rrrrwrs` ` rforward_remote_port_to_pathz/SSHClientConnection.forward_remote_port_to_pathst: A A(+ A09.0I A F%{3Y @''(355 55sAA!AA!cKdtttffd }jj d|fj ||d{S7w)aSet up remote UNIX domain socket forwarding to a local TCP port This method is a coroutine which attempts to set up UNIX domain socket forwarding from a remote listening path to a local TCP host and port via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the port forwarding. If the request fails, `None` is returned. :param listen_path: The path on the remote host to listen on :param dest_host: The hostname or address to forward connections to :param dest_port: The port number to forward connections to :type listen_path: `str` :type dest_host: `str` :type dest_port: `int` :returns: :class:`SSHListener` :raises: :class:`ChannelListenError` if the listener can't be opened r c`ttttj Sr)rr rrrv)rqrrrsrrzHSSHClientConnection.forward_remote_path_to_port..session_factoryAs0 -"67// 9EG Gr rN)r rrr{r~r)rrrqrrrs` `` rforward_remote_path_to_portz/SSHClientConnection.forward_remote_path_to_port$s[: G=+?!@ G G$y)&< >,,_kJJJJsAAAAcKdttdtdtdtdtdtt tt tff fd }jjd||f tj|||d {}|d k(r|j}|j||f<|S7,#t$r"}jjd |d }~wwxYww) aSet up local port forwarding via SOCKS This method is a coroutine which attempts to set up dynamic port forwarding via SOCKS on the specified local host and port. Each SOCKS request contains the destination host and port to connect to and triggers a request to tunnel traffic to the requested host and port via the SSH connection. If the request is successful, the return value is an :class:`SSHListener` object which can be used later to shut down the port forwarding. :param listen_host: The hostname or address on the local host to listen on :param listen_port: The port number on the local host to listen on :type listen_host: `str` :type listen_port: `int` :returns: :class:`SSHListener` :raises: :exc:`OSError` if the listener can't be opened rrqrrrirjr cJKj|||||d{S7w)z)Forward a local SOCKS connection over SSHNr)rrqrrrirjrs r tunnel_socksz7SSHClientConnection.forward_socks..tunnel_sockshs6 //099099FF FFrz$Creating local SOCKS forwarder on %sNz)Failed to create local SOCKS listener: %sr)rrrrrr+rr{r~ryr rtrrr)rrrrrrIs` r forward_socksz!SSHClientConnection.forward_socksLs8 F0DU0K F*- F:= F*- F:= FmE*M%,@@A F ?%{3 5 243?3> MMH ! "++-K:Bk;67M  KK  JC P  s<A+C(/B: B8 B:(C(8B:: C%C  C%%C( local_unitcKdtffd }j||d{\}}tt|S7w)a,Set up layer 3 forwarding This method is a coroutine which attempts to set up layer 3 packet forwarding between local and remote TUN devices. If the request is successful, the return value is an :class:`SSHForwarder` object which can be used later to shut down the forwarding. :param local_unit: The unit number of the local TUN device to use :param remote_unit: The unit number of the remote TUN device to use :type local_unit: `int` or `None` :type remote_unit: `int` or `None` :returns: :class:`SSHForwarder` :raises: | :exc:`OSError` if the local TUN device can't be opened | :exc:`ChannelOpenError` if the SSH channel can't be opened r cLttjtS)z8Return an SSHTunTapSession used to do layer 3 forwarding)rrrrrrsrrz8SSHClientConnection.forward_tun..session_factorys)(++,E,689 9r N)rrrrarrrrrYrus`` r forward_tunzSSHClientConnection.forward_tuns@0 9!1 9EE4L$''F#A?AcKdtffd }j||d{\}}tt|S7w)a,Set up layer 2 forwarding This method is a coroutine which attempts to set up layer 2 packet forwarding between local and remote TAP devices. If the request is successful, the return value is an :class:`SSHForwarder` object which can be used later to shut down the forwarding. :param local_unit: The unit number of the local TAP device to use :param remote_unit: The unit number of the remote TAP device to use :type local_unit: `int` or `None` :type remote_unit: `int` or `None` :returns: :class:`SSHForwarder` :raises: | :exc:`OSError` if the local TUN device can't be opened | :exc:`ChannelOpenError` if the SSH channel can't be opened r cLttjtS)z8Return an SSHTunTapSession used to do layer 2 forwarding)rrrrrsrrz8SSHClientConnection.forward_tap..session_factorys((++,A:NP Pr N)rrrrars`` r forward_tapzSSHClientConnection.forward_tapsB0 P!1 P EE4L$''Frr path_encodingc K|jd||dd{\}}}t||j|||||d{S7+7w)a_ Start an SFTP client This method is a coroutine which attempts to start a secure file transfer session. If it succeeds, it returns an :class:`SFTPClient` object which can be used to copy and access files on the remote host. An optional Unicode encoding can be specified for sending and receiving pathnames, defaulting to UTF-8 with strict error checking. If an encoding of `None` is specified, pathnames will be left as bytes rather than being converted to & from strings. :param env: (optional) The environment variables to set for this SFTP session. Keys and values passed in here will be converted to Unicode strings encoded as UTF-8 (ISO 10646) for transmission. .. note:: Many SSH servers restrict which environment variables a client is allowed to set. The server's configuration may need to be edited before environment variables can be successfully set in the remote environment. :param send_env: (optional) A list of environment variable names to pull from `os.environ` and set for this SFTP session. Wildcards patterns using `'*'` and `'?'` are allowed, and all variables with matching names will be sent with whatever value is set in the local environment. If a variable is present in both env and send_env, the value from env will be used. :param path_encoding: The Unicode encoding to apply when sending and receiving remote pathnames :param path_errors: The error handling strategy to apply on encode/decode errors :param sftp_version: (optional) The maximum version of the SFTP protocol to support, currently either 3 or 4, defaulting to 3. :type env: `dict` with `str` keys and values :type send_env: `list` of `str` :type path_encoding: `str` or `None` :type path_errors: `str` :type sftp_version: `int` :returns: :class:`SFTPClient` :raises: :exc:`SFTPError` if the session can't be opened sftpN)rZr[r\rX)rqrr ) rr[r\r path_errors sftp_versionwriterreaderrYs rrz%SSHClientConnection.start_sftp_clientsjp#'"3"3f8;h=A#4#CC'tTZZ'4k'355 5 C5s!A A&A A A  A NNNr )rrrrr,r)r r rr__annotations__r0rrr2rrrrr.rrTr_ClientHostKeyrrrrrrrrrrrrr rr rrrrrrr r!rr*rr%r+rr'rr.rr0r,rr2r-rr4r7r:r.r rr=rar?rBrAr)r rUr(rrr_Env_SendEnvrrrrrnrrrrqrrioDEFAULT_BUFFER_SIZErrrr~rrrrrrrrrrrrrurrr!_TCPServerHandlerFactoryrrrprrvr_UNIXServerHandlerFactoryr_ClientFactoryrrrrrrrrrrrrrrrrrrrrrrrrrUr5s@rr_r_ sB+* 011-104'+ AMW66AM6AM)AM!.AM } AMFQAhHY/D. <^ < <6$ %Xf%5 % I# I=*.? (>*C4 5.?`B*1EBHx}8 4c 4.1 46;CHo 4' - +Xc]+4+.69"'/'?> CY C "$44 5 C I) I -& e(<< = I!LI!L -M!:: ;!LFA3A58A=AA$ 6$ 6nn45 6 F$ F&(889 FL#Lnj&@@AL6 4C 4D 4> > -+@!AA B>8E#Eni &==>E 8#8(,8 B+YB+4B+HK.>v.FK+3C=K-5c]K6:K %# $ K&* 6(:*t*ACcAC35<>GIBD@BBDIKDFFHEGAC5757:c&.c]c&.c]c +33-!c" "$44 5#cJ@@&@ )Y 1 2@27;485959,.,B,B.2T V&V$,V$4V$1V&3V&3 V '* V (, V ?C V(.V3C62JVVrDF/1/E/E:>7;8<8<:>=38I=3)1(3-)@=3),=3(0'7=3(5 =3 )6 =3 )6 =3+33-=3+1=3 (*?? @=3@6;-1,2v,2d,2#E?,2",2':,2`BDH>B"/3 H#7#?HH+.H;>HH.6c]H H-0 H  H mF+]6-BBC HTB6BVB )Y& 'B:'+()3 WM#5f#=WMWM+.WMsmWM58WM WM  WM 9D WMWMr(92J(9"((94:(9?J(9(9X<@"/3 8#8#@88+3C=88-08 8 nV,nV.DDE 8tBB&B )Y& 'B<<@"/3 <N#6v#><N<N+3C=<N<N-0<N <N9D <N<N|*>#<*>*>%+*>0;*>*>ZFH@.@*-@5=c]@.4@+Y67@$ @c @# @$* @/D @ @ /c /# /,2 /7L / / ?S ?Xc] ?#) ?.9 ? ?3579.S.'/}.+1.6A..$*.,@O3,#:,!#,:=,,&(889 ,`*.,@O3,#:,!#,:=,,&(889 ,\BFBfB )Y& 'B8BFBfB )Y& 'B8:>J"J14JADJ$%56JBMJJX0C0470470?A?F.6/? =58D>=5*28*<=5/7}=5EO =5=5r ceZdZUdZded<eed<eeed< dndejddd e d e d ee f fd Z d eeddffd ZdodZdodZdeedefdZdeefdZdodZdefdZdefdZde de de defdZdefdZde dede de d ed!edefd"Zde d#edeefd$Z de d#e!deefd%Z"de dedeefd&Z#de dedeefd'Z$defd(Z%de ded ed!edef d)Z&defd*Z'de d+e defd,Z(de d-e d.e defd/Z)defd0Z*de d1e d2e de+fd3Z,de d4e-de+fd5Z.d6e/de0e1e2ffd7Z3d6e/de0e4ee5effd8Z6d6e/ddfd9Z7d:e d;e8ddfd<Z9d6e/ddfd=Z:d6e/de0e;eeZ=d6e/ddfd?Z>d@e ddfdAZ?d6e/ddfdBZ@d6e/de0eAeBffdCZCd6e/ddfdDZDdEe1eEdFedGedHe8dee f dIZFdEeGeEddfdJZHdefdKZIdee fdLZJeKfd e d1e ddfdMZLdNeMddfdOZNdpdPe dQeOdeOfdRZPdSe defdTZQ dpdPe dQeOdeOfdUZRdSe defdVZS dqdWee dXe dYe8dZe8de1f d[ZT drdd\eUeVd]d^eWeEd_e d`e8dae dbe8dWee dXe dYe8dZe8de0e4eEe5eEffdcZXddeOdeeOde0eYeZffdfZ[dd\eUeVd]d^e\eEdge dWee dXe dYe8dZe8de0e;eEe` method and return a tuple of the :class:`SSHServerChannel` object returned from that and either an :class:`SSHServerSession` object or a coroutine which returns an :class:`SSHServerSession`. Similarly, :class:`SSHServer` objects wishing to create TCP connection objects with non-default channel properties can call :meth:`create_tcp_channel` from their :meth:`connection_requested() ` method and return a tuple of the :class:`SSHTCPChannel` object returned from that and either an :class:`SSHTCPSession` object or a coroutine which returns an :class:`SSHTCPSession`. :class:`SSHServer` objects wishing to create UNIX domain socket connection objects with non-default channel properties can call :meth:`create_unix_channel` from the :meth:`unix_connection_requested() ` method and return a tuple of the :class:`SSHUNIXChannel` object returned from that and either an :class:`SSHUNIXSession` object or a coroutine which returns an :class:`SSHUNIXSession`. SSHServerConnectionOptionsrrrNr%rprrrct||||||d||_|j|_|j |_t|jj|_ |j|_ |j|_ |j|_|j |_|j$|_|j(|_|j,|_|j0|_|j4|_|j8|_|j<|_|j@|_!|jD|_#|jH|_%|jL|_'|jP|_)|jT|_+|jX|_-|j\|_/|j`|_1|jd|_3|jhrY tk|jh|jl|_7|jp|_9|jt|_;|jv|_<d|_>i|_?d|_@d|_Ad|_By#tz$rY/wxYw)NTrF)Cr-r.rserver_host_keys_server_host_keysall_server_host_keys_all_server_host_keysrkeysrknown_client_hosts_known_client_hoststrust_client_host_trust_client_hostauthorized_client_keys_authorized_client_keys allow_pty _allow_pty line_editor _line_editor line_echo _line_echo line_history _line_historymax_line_length_max_line_length rdns_lookup _rdns_lookupra_x11_forwardingrc_x11_auth_pathagent_forwarding_agent_forwardingprocess_factory_process_factoryr_session_factoryrX _encodingrY_errors sftp_factory _sftp_factoryr _sftp_version allow_scp _allow_scprZ_windowr[ _max_pktsizerrdrr[rr\rr]r_rer _key_options _cert_optionsr_agent_listener)rr%rprrrr5s rr.zSSHServerConnection.__init__0s  w-d  ,  !(!9!9%,%A%A"%)'*B*B*G*G*I%J"#*#=#= ")";";'.'E'E$!++#//!++$11 ' 7 7#//&55%33!(!9!9 ' 7 7 ' 7 7 ))~~ $11$11!++~~ #//    %g&6&68I8IJ ' !(!1!1%)^^"7;/1:>%*";?  sAI I"!I"rIr c~|jr!|jjd|_t| |y)zClean up this server connectionN)r&rr-r)rrIr5s rrzSSHServerConnection._cleanupcs5     & & (#'D  r c|jjd|jjrIdj d|jjD}|jjd|y|jjd|j |j f|jjd|j|jfy)rzAccepted SSH client connectionrc3FK|]}tj|ywr,rrs rrz7SSHServerConnection._connection_made..rrrrrrN) r{r~rr{rrrrr)rr{s rrz$SSHServerConnection._connection_madels 9: == & &HH%B%)]]%@%@%BBM KK  2M B KK  2"..0@0@A C KK  1"oot? Ar c 4K|jrP|jj|j|jft j d{\|_}tj|jd|j|j|j|j|jd{}||_ |j|_|j |_|j$|_|j(|_|j,|_|j0|_|j4|_|j8|_|j<|_|j@|_!|jD|_#|jH|_%y7A7ۭw)z-Re-evaluate config with updated match optionsNT)rpreload accept_addr accept_portrdr client_addr)&rr rrrrrrr constructrrrrrNrOrPrQrRrSrTrUrrrr rarrrrarbrcrdrhrirjrk)rrYrps rr!z!SSHServerConnection.reload_config{sS   '+zz'='=$//2F4I4I(K"K DOQ3<<MM$D>T__=FF   ' 7 7 ' 7 7#//%33'.'E'E$!++&55!(!9!9#//%33$+$?$?!#*#=#= 1"KFs&AFFA'F:F;CFFrc|D]H}|jj|}|s!||jk7r|j|||_yy)zChoose the server host key to use Given a list of host key algorithms supported by the client, select the first compatible server host key we have and return whether or not we were able to find a match. TF)rrrrr)rrrrs rr z*SSHServerConnection.choose_server_host_keysS&C,,005G'+++--c2(/%&r c|jS)zReturn the chosen server host key This method returns a keypair object containing the chosen server host key and a corresponding public key or certificate. rrs rrz'SSHServerConnection.get_server_host_keys$$$r c|jr_|jjd|jjDcgc] }t |}}|j dg|y|jjdycc}w)z'Send list of available server host keyszSending server host keysshostkeys-00@openssh.comz!Sending server host keys disabledN)rr{r~rrr)rrrs rrz)SSHServerConnection.send_server_host_keyssx  % % KK  7 8+/+E+E+J+J+LM+LCF3K+LDM %D % %&@ H4 H KK  @ ANsBcd|jr$|jJ|jjSy)z;Return whether GSS key exchange authentication is supportedF)r^r[completers rgss_kex_auth_supportedz*SSHServerConnection.gss_kex_auth_supporteds0   99( ((99%% %r c|jS)z2Return whether GSS MIC authentication is supportedrrs rgss_mic_auth_supportedz*SSHServerConnection.gss_mic_auth_supporteds!!!r rduser_principalrcK|jj|||}tj|rt t t |d{}t t |S7w)zValidate the GSS principal name for the specified user Return whether the user principal acquired during GSS authentication is valid for the specified user. N)rvalidate_gss_principalrrrr r)rrdr8rrs rr:z*SSHServerConnection.validate_gss_principalsY33Hn4BD   v & $88FD&!!9A A&A$A&c|jxr1t|jxs|jj S)z?%%&' ' M1 +   "/0;]L  # #  # #D$<$.:sF4ErW}4Esno-touch-requiredF)rrrrrrDrvalidate_ca_keyrrrr rr$get_key_optionrrrrrprrrr%rset_touch_requiredget_certificate_option)rrdrrprallowed_addressesrGs @r_validate_openssh_certificatez1SSHServerConnection._validate_openssh_certificates 04  ' '22;;  $//T<;G ?[[004;K;KLF""6*#IdOV<<G#   | ,H  MM.( 3!)!4!%!1!12B!CE DOO,BF4EFF!\\ ##$$%8%@I,,-@%H J Kxx==  s7B.F61F%2#F6F',B:F6' F30F62F33F6cK|jsy|jj||j|j\}}|y||_|j drd}|j Jt|j }|r||gz } |j||jt|j||jS#t$rYywxYww)z;Validate an X.509 client certificate for the specified userNrDr)r8)r validate_x509rrr$rJr>rrr@rSrErr)rrdrrp trusted_cert trusted_certss r _validate_x509_certificate_chainz4SSHServerConnection._validate_x509_certificate_chainEs ++  ( ( 6 6doot 8  ?#   | ,H''333T556  l^ +M     t/L/L #t':':/7  9 xx  s*B C 2C ? C CCCCcK t|}|jr(|j|t t |d{S|j |t t|d{S#t$rYywxYw7;7w)z4Validate a client certificate for the specified userN)rrrrSrrrNr)rrdrrs r_validate_client_certificatez0SSHServerConnection._validate_client_certificatehs )(3D   >>$6=?? ?;;$4d;== =  ?=sCA> A+/A>A:'A>&A<'A>+ A74A>6A77A><A>cK t|}d}|jr1|jj||j|j }|U|j j||}tj|rttt|d{}|syi}||_ |j|jdd |S#t$rYywxYw7Cw)z3Validate a client public key for the specified userNrHF)rrrrrrrvalidate_public_keyrrrr rr$rKrJ)rrdrrrprs r_validate_client_public_keyz/SSHServerConnection._validate_client_public_keyxs '1C04  ' '22;;T__doo7G ?[[44XsCF""6*#IdOV<<G# ##$7? ? A 3  =s4C! CB C!C4C! CC!CC!c|jxr1t|jxs|jj S)z&kk113)-D &r r submethodscK|jr ddtdf}|S|jj|||}t j |r!t tt|d{}|St t|}|S7w)z,Return a keyboard-interactive auth challenger))z Password:FN) rr<rget_kbdint_challengerrrr r)rrdrrf challengers rrhz(SSHServerConnection.get_kbdint_challenges  % %*,b,*A*CI[[55h6@BF""6*"&y'A6"JJ !&9  KsA%B'B(B responsescK|jrvt|dk7ry |jj||d}t j |r t tt|d{}nt t|}|S|jj||}t j |r!t tt|d{}|St t|}|S7{#t$rd}Y|SwxYw7,w)zRReturn whether the keyboard-interactive response is valid for this userrFrN) rrrr_rrrr rrvalidate_kbdint_responser)rrdrj pw_resultnext_challengers rrlz,SSHServerConnection.validate_kbdint_responses  % %9~" ' KK99il, &&y1+/ $+K%KN%)$ %:N[[99(INF""6*'+Io,F'O!O"&ov!>&L* '"' '"PsHC?AC+-C).C+A C?C=C?)C++ C:6C?9C::C?rUc:|j|js|js |jr|j |j |j |j|j}|jr:t|j|j|j|j}||fSt|j|j|j|j}||fS|jj}|stt dt#|t$r|\}}n<|j |j |j |j|j}t'|rt|}||fSt)t*|}||fS)z(Process an incoming session open requestzSession refused)rrrrcreate_server_channelrrr"r#rrr!rrsession_requestedrrZretuplerrr)rrUrrrs rr%z)SSHServerConnection._process_session_opensr   D$9$9T=O=O--dnndll.2llD-.11)YGIF fe $!LD&**,D F )%08G=/8G G#Y/ 1 /)Y1GH ##Iy)YOW}_" :!/059 : :s "HHc|j}|j}|j |jdj }|jdr|jds0|jjd||f|jdy|j|j||y#t $r t ddwxYw)z2Process an incoming TCP/IP port forwarding requestrzInvalid TCP/IP forward requestNrtzDRequest for TCP listener on %s denied: port forwarding not permittedF)rrIrrr rrrxryr{r~rr_finish_port_forward)rrUlisten_host_bytesrrs r%_process_tcpip_forward_global_requestz9SSHServerConnection._process_tcpip_forward_global_request}s#--/'')  L+227;AACK(():;001BC KK  8);7 9  ( ( /  22; LM" L @At K Ls CCrrcK|jj||} tj|rt t t |d{}|dur|j||||d{}n(t|r|j|||||d{}|s0|jjd||f|jdy|dk(r|j}t|}nd}|jjd||f||j ||f<|j|y777#t$r/|jjd|jdYywxYww)z2Finish processing a TCP/IP port forwarding requestNTzFailed to create TCP listenerFz4Request for TCP listener on %s denied by applicationrzCreated TCP listener on %s)rserver_requestedrrrr _ListenerArgrrrtr{rrr~rrr)rrrrrs rr}z(SSHServerConnection._finish_port_forwards;;// [I ""8,!%i &=x!HH4!%!8!8k;"HH(#!%!8!8h"88 KK  +-8+,F H  ( ( /  ! "++-KK(FF 5%{3 5;Ck;67 $$V,EIH8  KK  > ?  ( ( /  s_E4/D9D3D9/D50(D9D7D9BE43D95D97D995E1.E40E11E4c|j}|j}|j |jdj } |jj||f}|jjd||f|j|jdy#t $r t ddwxYw#t$r t ddwxYw)z2Process a request to cancel TCP/IP port forwardingrz%Invalid TCP/IP cancel forward requestNzTCP/IP listener not foundzClosed TCP listener on %sT)rrIrrr rrrrrJr{r~rr)rrUr~rrrs r,_process_cancel_tcpip_forward_global_requestz@SSHServerConnection._process_cancel_tcpip_forward_global_requests#--/'')  =+227;AACK  G,,00+{1KLH 4%{3 5  $$T*" =!238< = =  G ;<$ F GsB/C/CCc|j}|j}|j}|j |jd}|j dr|jdsttd|jj|}|sttd|dur&ttt|j!|}t#|t$r|\}}n|j'}t)|rt+t|}nttt|}|j,j/d||j1|||fS#t$r t ddwxYw) z:Process an incoming direct UNIX domain socket open requestrz/Invalid direct UNIX domain channel open requestNrtrurwTz%Accepted direct UNIX connection on %s)rrIrrrrrxryrrYrunix_connection_requestedrZrrrryrerrr`rrr{r~r<)rrUr6rYrwrrrs rr2zGSSHServerConnection._process_direct_streamlocal_at_openssh_dot_com_opensv !++-         :'..w7I (():;001BC"#C#BD D66yA"#68LM M T>./66yACF fe $!LD&++-D F *51&9G>%0&9G @)L ##I.W}E" :!/059 : :s E((E>cz|j}|j |jd}|j dr|j ds.|jjd||jdy|j|j|y#t$r t ddwxYw)z9Process an incoming UNIX domain socket forwarding requestrz*Invalid UNIX domain socket forward requestNrtzERequest for UNIX listener on %s denied: port forwarding not permittedF) rrrrrrxryr{r~rr_finish_path_forward)rrUlisten_path_bytesrs r>_process_streamlocal_forward_at_openssh_dot_com_global_requestzRSSHServerConnection._process_streamlocal_forward_at_openssh_dot_com_global_request s#--/ =+227;K (():;001BC KK  89D F  ( ( /  22;?@" =!238< = =s B$$B:rcZK|jj|} tj|rt t t |d{}|dur|j||d{}|s.|jjd||jdy|jjd|t t||j|<|jdy77#t$r/|jjd|jdYywxYww)z9Finish processing a UNIX domain socket forwarding requestNTzFailed to create UNIX listenerFz5Request for UNIX listener on %s denied by applicationzCreated UNIX listener on %s)runix_server_requestedrrrr rrrtr{rrr~rrr)rrrs rrz(SSHServerConnection._finish_path_forward$s;;44[A ""8,!%i &=x!HH4!%!8!89D"FF KK  +,7 9  ( ( /  6 D-1+x-Hk* $$T*)IF  KK  ? @  ( ( /  sMD+/C0C,C0,C.-C01A;D+,C0.C005D(%D+'D((D+c~|j}|j |jd} |j j |}|jjd||j|jdy#t$r t ddwxYw#t$r t ddwxYw)z9Process a request to cancel UNIX domain socket forwardingrz*Invalid UNIX domain cancel forward requestNzUNIX domain listener not foundr9T) rrrrrrrrJr{r~rr)rrUrrrs rE_process_cancel_streamlocal_forward_at_openssh_dot_com_global_requestzYSSHServerConnection._process_cancel_streamlocal_forward_at_openssh_dot_com_global_requestAs#--/ =+227;K  L,,00=H 5{C $$T*" =!238< = =  L @At K LsB B& B#&B<c|j}|j}|j|tk(rd}|tk(r|jj |}n'|t k(r|jj|}nd}|sttd|dur tt|j||}t|tr|\}}n|j}t!|r t#|}ntt|}|j$j'd|tk(rdnd|tk(rdn t)||j+|||fS) z(Process an incoming TUN/TAP open requestNFrwTz+Accepted layer %d tunnel request to unit %sr$rr)rIrrrr tun_requestedr tap_requestedrrZrrrrerrrcrrr{r~rset_mode)rrUrrrrrs rr4z8SSHServerConnection._process_tun_at_openssh_dot_com_openYs:   "$//1 # #D , ,[[..t4F * *[[..t4FF"#68LM M T>*D,?,?d,KLF fe $!LD&--/D F ,V4G+V4G F"&??Q"&*:":D  K dW}r c tdt|jz}g}|rX |j}|j|}|j t|j |t|z|rX|jdj|y#t tf$r|jdYywxYw)z=Prove the server has private keys for all requested host keysrFFNr ) rr$rrrrrJrrr)rrUr signaturesrrs r<_process_hostkeys_prove_00_at_openssh_dot_com_global_requestzPSSHServerConnection._process_hostkeys_prove_00_at_openssh_dot_com_global_requests78(()*  !,,.00:!!&&6(;K2K)L"MN  $$SXXj%9: n- ,,U3 sAB CCr auth_proto auth_datascreenclK|jr"|jdr|jds|jj dy|j s0t ||j|j||d{|_|j r|j j||Sy72w)z(Attach a channel to a remote X11 displayzX11-forwardingz;X11 forwarding request denied: X11 forwarding not permittedN) rrxryr{r~rrr rrT)rrrrrs rrUz'SSHServerConnection.attach_x11_listeners $$--.>?556FG KK  8 9!!'Adjj$"5"5z9(N"ND    %%,,T6: : "NsA=B4?B23B4cd|jr$|jj|rd|_yyy)z+Detach a session from a remote X11 listenerNrWrs rrz'SSHServerConnection.detach_x11_listenerrYr cK|jr"|jdr|jds|jj dy|j ry t jd}tt|jd}t||j|j|d{}t||||_y7#t$rYywxYww) z6Create a listener for forwarding ssh-agent connectionszagent-forwardingz?Agent forwarding request denied: Agent forwarding not permittedFTz asyncssh-)ragentN)rrxryr{r~r&tempfileTemporaryDirectoryrrr6rxr create_agent_connectionrrt)rtempdirpath unix_listeners rcreate_agent_listenerz)SSHServerConnection.create_agent_listeners&&--.@A556HI KK  8 9    11EGtGLL'23D">djj$">">#FFM$4GT4A$CD  F   s=ACAC5C 6C C C CCCCcP|jr|jjSy)z8Return the path of the ssh-agent listener, if one existsN)r&get_pathrs rget_agent_pathz"SSHServerConnection.get_agent_paths%   ''002 2r c|jr td|jjd|j t t |t |y)a9Send an authentication banner to the client This method can be called to send an authentication banner to the client, displaying information while authentication is in progress. It is an error to call this method after the authentication is complete. :param msg: The message to display :param lang: The language the message is in :type msg: `str` :type lang: `str` :raises: :exc:`OSError` if authentication is already completed z Authentication already completedzSending authentication bannerN)r|rtr{rrMrSr)rrsrs rsend_auth_bannerz$SSHServerConnection.send_auth_bannersG&   <= = :; ,fSk6$<Hr authorized_keyscTt|ttfr t|}||_y)aOSet the keys trusted for client public key authentication This method can be called to set the trusted user and CA keys for client public key authentication. It should generally be called from the :meth:`begin_auth ` method of :class:`SSHServer` to set the appropriate keys for the user attempting to authenticate. :param authorized_keys: The keys to trust for client public key authentication :type authorized_keys: *see* :ref:`SpecifyingAuthorizedKeys` N)rerrr'r)rrs rset_authorized_keysz'SSHServerConnection.set_authorized_keyss$ oT{ 32?CO'6$r optionr7c:|jj||S)a Return option from authorized_keys If a client key or certificate was presented during authentication, this method returns the value of the requested option in the corresponding authorized_keys entry if it was set. Otherwise, it returns the default value provided. The following standard options are supported: | command (string) | environment (dictionary of name/value pairs) | from (list of host patterns) | no-touch-required (boolean) | permitopen (list of host/port tuples) | principals (list of usernames) Non-standard options are also supported and will return the value `True` if the option is present without a value or return a list of strings containing the values associated with each occurrence of that option name. If the option is not present, the specified default value is returned. :param option: The name of the option to look up. :param default: The default value to return if the option is not present. :type option: `str` :returns: The value of the option in authorized_keys, if set r$rrrr7s rrJz"SSHServerConnection.get_key_option sB  $$VW55r  permissioncB|jjd|zd S)aCheck permissions in authorized_keys If a client key or certificate was presented during authentication, this method returns whether the specified permission is allowed by the corresponding authorized_keys entry. By default, all permissions are granted, but they can be revoked by specifying an option starting with 'no-' without a value. The following standard options are supported: | X11-forwarding | agent-forwarding | port-forwarding | pty | user-rc AsyncSSH internally enforces X11-forwarding, agent-forwarding, port-forwarding and pty permissions but ignores user-rc since it does not implement that feature. Non-standard permissions can also be checked, as long as the option follows the convention of starting with 'no-'. :param permission: The name of the permission to check (without the 'no-'). :type permission: `str` :returns: A `bool` indicating if the permission is granted. zno-Frrrs rrxz(SSHServerConnection.check_key_permission,s&B$$(();UCCCr cV|j|jj||S|S)aReturn option from user certificate If a user certificate was presented during authentication, this method returns the value of the requested option in the certificate if it was set. Otherwise, it returns the default value provided. The following options are supported: | force-command (string) | no-touch-required (boolean) | source-address (list of CIDR-style IP network addresses) :param option: The name of the option to look up. :param default: The default value to return if the option is not present. :type option: `str` :returns: The value of the option in the user certificate, if set )r%rrs rrLz*SSHServerConnection.get_certificate_optionOs.2    )%%))&': :Nr cv|j-tt|jjd|zdSy)aCheck permissions in user certificate If a user certificate was presented during authentication, this method returns whether the specified permission was granted in the certificate. Otherwise, it acts as if all permissions are granted and returns `True`. The following permissions are supported: | X11-forwarding | agent-forwarding | port-forwarding | pty | user-rc AsyncSSH internally enforces agent-forwarding, port-forwarding and pty permissions but ignores the other values since it does not implement those features. :param permission: The name of the permission to check (without the 'permit-'). :type permission: `str` :returns: A `bool` indicating if the permission is granted. zpermit-FT)r%rrrrs rryz0SSHServerConnection.check_certificate_permissionmsA8    )d0044Y5K5:<= =r rXrYrZr[c t||j|j|j|j|j |j |dk(r |jn||dk(r |jn||xs |j|xs |j S)arCreate an SSH server channel for a new SSH session This method can be called by :meth:`session_requested() ` to create an :class:`SSHServerChannel` with the desired encoding, Unicode error handling strategy, window, and max packet size for a newly created SSH server session. :param encoding: (optional) The Unicode encoding to use for data exchanged on the session, defaulting to UTF-8 (ISO 10646) format. If `None` is passed in, the application can send and receive raw bytes. :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: :class:`SSHServerChannel` r) r*r r r r rrrrr"r#r]s rrpz)SSHServerConnection.create_server_channelsy> djj$// $ 1 14?? $ 2 2D4I4I2:b.h06"  & & 6$,, + @t/@/@ B Br rWrhrrrrirjcK|jjd||f|jjd||f|j|||| } | j|||||d{} | | fS7w)a Create an SSH TCP forwarded connection This method is a coroutine which can be called to notify the client about a new inbound TCP connection arriving on the specified remote host and port. If the connection is successfully opened, a new SSH channel will be opened with data being handled by a :class:`SSHTCPSession` object created by `session_factory`. Optional arguments include the host and port of the original client opening the connection when performing TCP port forwarding. By default, this class expects data to be sent and received as raw bytes. However, an optional encoding argument can be passed in to select the encoding to use, allowing the application to send and receive string data. When encoding is set, an optional errors argument can be passed in to select what Unicode error handling strategy to use. Other optional arguments include the SSH receive window size and max packet size which default to 2 MB and 32 KB, respectively. :param session_factory: A `callable` which returns an :class:`SSHTCPSession` object that will be created to handle activity on this session :param remote_host: The hostname or address the connection was received on :param remote_port: The port number the connection was received on :param orig_host: (optional) The hostname or address of the client requesting the connection :param orig_port: (optional) The port number of the client requesting the connection :param encoding: (optional) The Unicode encoding to use for data exchanged on the connection :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type session_factory: `callable` :type remote_host: `str` :type remote_port: `int` :type orig_host: `str` :type orig_port: `int` :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: an :class:`SSHTCPChannel` and :class:`SSHTCPSession` z&Opening forwarded TCP connection to %sr)N)r{r~r^acceptrs rrz%SSHServerConnection.create_connectionsz A%{3 5 /)Y1GH&&xM O[$/IGGW}Grr[rcK|jtg|i|d{\}}t||t||fS7w)aOpen an SSH TCP forwarded connection This method is a coroutine wrapper around :meth:`create_connection` designed to provide a "high-level" stream interface for creating an SSH TCP forwarded connection. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it returns :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on the connection. With the exception of `session_factory`, all of the arguments to :meth:`create_connection` are supported and have the same meaning here. :returns: an :class:`SSHReader` and :class:`SSHWriter` Nrrps rrz#SSHServerConnection.open_connectionsV(5d44 2"&2*022 g $'7D)AAA 2rrncK|jjd||j||||}|j||d{}||fS7w)aCreate an SSH UNIX domain socket forwarded connection This method is a coroutine which can be called to notify the client about a new inbound UNIX domain socket connection arriving on the specified remote path. If the connection is successfully opened, a new SSH channel will be opened with data being handled by a :class:`SSHUNIXSession` object created by `session_factory`. By default, this class expects data to be sent and received as raw bytes. However, an optional encoding argument can be passed in to select the encoding to use, allowing the application to send and receive string data. When encoding is set, an optional errors argument can be passed in to select what Unicode error handling strategy to use. Other optional arguments include the SSH receive window size and max packet size which default to 2 MB and 32 KB, respectively. :param session_factory: A `callable` which returns an :class:`SSHUNIXSession` object that will be created to handle activity on this session :param remote_path: The path the connection was received on :param encoding: (optional) The Unicode encoding to use for data exchanged on the connection :param errors: (optional) The error handling strategy to apply on encode/decode errors :param window: (optional) The receive window size for this session :param max_pktsize: (optional) The maximum packet size for this session :type session_factory: `callable` :type remote_path: `str` :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :returns: an :class:`SSHTCPChannel` and :class:`SSHUNIXSession` z'Opening forwarded UNIX connection to %sN)r{r~r`rrs rrpz*SSHServerConnection.create_unix_connectionsW` BKP''&&+N O[AAW}BrcK|jtg|i|d{\}}t||t||fS7w)a,Open an SSH UNIX domain socket forwarded connection This method is a coroutine wrapper around :meth:`create_unix_connection` designed to provide a "high-level" stream interface for creating an SSH UNIX domain socket forwarded connection. Instead of taking a `session_factory` argument for constructing an object which will handle activity on the session via callbacks, it returns :class:`SSHReader` and :class:`SSHWriter` objects which can be used to perform I/O on the connection. With the exception of `session_factory`, all of the arguments to :meth:`create_unix_connection` are supported and have the same meaning here. :returns: an :class:`SSHReader` and :class:`SSHWriter` Nrrps rrz(SSHServerConnection.open_unix_connectionQsY*.$--$7'+7/57 7 g $'7D)AAA  7rrcK|jjd|j||}|j|||d{}||fS7w)z&Create an SSH X11 forwarded connectionz Opening forwarded X11 connectionN)r{r~rer)rrrirjrZr[rrs rcreate_x11_connectionz)SSHServerConnection.create_x11_connectionmsR ;<&&v{; /9iHHW}IsAAA AcK|jsttd|jj d|j ||}|j |d{}||fS7w)z:Create a forwarded ssh-agent connection back to the clientzAgent forwarding not permittedz"Opening forwarded agent connectionN)r&rrYr{r~rgr)rrrZr[rrs rrz+SSHServerConnection.create_agent_connection}sm##"#C#CE E =>((= /22W}3sAA+ A)! A+cK|jtd{\}}tt||t t||fS7-w)z8Open a forwarded ssh-agent connection back to the clientN)rrrrr)rrrs ropen_agent_connectionz)SSHServerConnection.open_agent_connectionsN ../CD D g . %0@$0OOO EsA A .A rr r,)rrrrr)er r rrrrrrr2rrrrr.rTrrr!rrrr rrrr5r7r:r=rArrrNrrSrUrXrZrWr]r_rcrerrhr rlrrr*rr%r+rr'rrr}rr,rr2rrrr-rr4rr rUr(rrrr<r _AuthKeysArgrrrJrxrLryrprrrrrrrrrprr.rr/rrrUrs@rrr sOB+* 011-104'+ 1@W661@61@)1@!.1@ } 1@fHY/D A><3;E?GK* %Xj%9 % B"" "S"#"58"=A"";4;)"s)"e)"47)"JM)",1)">C)"HL)"V..'<. .`!!'>! !F==+0=5=f5E= #49>Fv>NB;4;#',9>CG,MM ""s"t" "c " ",/ "48 " t 3c/27F$ s 2@   D)I) "$44 5)V<< -& e(<< =<|NIN$N.*-c*-03*-8<*-X+#+(,+41#1nU+^E-BBC1fA#A(,A.+c+d+:+#+(,+0+#+&(889+Z;#;(,;(.>v.F.3@E*-2:3-,* 6(:*t*T6 6BICIsIdI47<7D7*!6S!66!6V!6F!Ds!Dt!DH26S(.:@< s t D?A>?12%Bhsm%B&)%B8;%B+.%B7G%BRBDF>B"/3 F#7#?FF+.F;>FF.6c]F F-0 F  F mF+]6-BBC FPB6BVB )Y& 'B:<@"/3 6#8#@66+3C=66-06 6 nV,nV.DDE 6pBB&B )Y& 'B<34*3 #7#>,/  m]5%99: $)3#8#?o~e'<<= & P )E"Ie$44 5 Pr rc<eZdZUdZeed<eejed<e ed<e ed<e ed<e ed<e ed<eee ed <e ed <eed <eed <ee ed <ee ed<ee ed<ee ed<ee ed<eed<eed<eed<eed<eeeed<eeed<ede ee fed<e ed<eed<eeed<eed<eed<e ed<d)d ed!d"e ffd# Zed)d ed!d"e d$efd%Zdede dede dee de d&eed eed ee d eed eed ededededededededededeede deee e fdeeee fdeeee fdeee fd'eee fde d$df0JKM mS )&}5M*3&B, JJ(8(8 9; JJ}- xzR7G#,)Q$8"$"9L ND13 68_h+^-T9 ; 3 t+T] t2 /R*? 4d; =  /R*? 148 :  kR&7{ 9JJ@$GI J   (;} 3T: <   )%&89E||$&=>> "&h/A&BE!J  "/Dz((*$&559F&<==0 #5'>$* x}hsm34L(3 5 10 " ,K " .K  S )*;7K ! EF F B 0M B 2M  s +/ >M ]a/GH H os +1/BO 2AB B mS )/ >M ]Q.?@ @ (# .!45G!H  "4q"8DE E ! #MN N&*.6$*"4#6 r r,)#r r rrr9rrr2Future_ProtocolFactoryrrrrrrrrrrrr. classmethodrr/ _VersionArgrr~ _ProxyCommandr_AuthArgrrrrUrs@rrrs  W^^ $$&& N I I NHSM** Kuoe_$uouo%UO# *>%h//sHSM122e_$M 4MvMIhz&:I"(I-5IIV7iV7"2V7=HV7V7!)#V78>V7%Z0V7 ( 6 V7AI V7 %X. V7 @H~ V7 # V7 6> V7#V77?V7!)V7IV7*2();V7 0V7&eCHo6V7 (eSj(9:V7"*%s *;!<V7 %UCZ0!V7"%*%*$5#V7$&)%V7$.2%V7r ceZdZUdZeed<eed<eed<eed<e e ed<e e e e fed<e ed<e ed <e e ed <e e ed <e eed <e e eefed <e e ed<e ed<e e eed<e eed<eed<ee e ed<e eeefed<eed<eed<eed<e e ed<eed<e e ed<e e eed<e e ed<e e ed<e e ed<e e ed<e e ed <eed!<eed"<eed#<e e ed$<eed%<eed&<e ee fed'<e e ed(<e e ed)<eed*<e e ed+<e ed,<eed-<eed.<d/d/d/d0d/d1d2d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d3d1d1d1ed1d1d1d1d1d/d1d/d1d/d1d/d1d1d1d/d1d1d/d1d1d1d1d0d1d1d1d1d/d1d/d1d1d1d/d/d/d1d/d/d0d4d5eefJd6e ej@d7e e!dee"d8ede ede#d9e d:eed;e$dee&d?eed@e'dAe'dBe'dCe'dDe'dEe(dFe(dGe(dHe(dIe)dJe edKe*dLee ee fdMee e+e fdNee e e+e fdOe e+e fdPee e+e fdQeededee e de'de d ee d e e d ee,dRe e-dSe ede e dee de-de edTe edeedee e de e ee.fdeedeedeedee e e e fdedee e dee e/dUeedee e de e dee e d e e d!eed"eed#eed$e e d%ed&ed'ee ee fd(e e d)e e d*ed+e e d,e d-ed.edVd/ffdW Z0xZ1S)XraeSSH client connection options The following options are available to control the establishment of SSH client connections: :param client_factory: (optional) A `callable` which returns an :class:`SSHClient` object that will be created for each new connection. :param proxy_command: (optional) A string or list of strings specifying a command and arguments to run to make a connection to the SSH server. Data will be forwarded to this process over stdin/stdout instead of opening a TCP connection. If specified as a string, standard shell quoting will be applied when splitting the command and its arguments. :param known_hosts: (optional) The list of keys which will be used to validate the server host key presented during the SSH handshake. If this is not specified, the keys will be looked up in the file :file:`.ssh/known_hosts`. If this is explicitly set to `None`, server host key validation will be disabled. :param host_key_alias: (optional) An alias to use instead of the real host name when looking up a host key in known_hosts and when validating host certificates. :param server_host_key_algs: (optional) A list of server host key algorithms to use instead of the default of those present in known_hosts when performing the SSH handshake, taken from :ref:`server host key algorithms `. This is useful when using the validate_host_public_key callback to validate server host keys, since AsyncSSH can not determine which server host key algorithms are preferred. This argument can also be set to 'default' to specify that the client should always send its default list of supported algorithms to avoid leaking information about what algorithms are present for the server in known_hosts. .. note:: The 'default' keyword should be used with caution, as it can result in a host key mismatch if the client trusts only a subset of the host keys the server might return. :param server_host_keys_handler: (optional) A `callable` or coroutine handler function which if set will be called when a global request from the server is received which provides an updated list of server host keys. The handler takes four arguments (added, removed, retained, and revoked), each of which is a list of SSHKey public keys, reflecting differences between what the server reported and what is currently matching in known_hosts. .. note:: This handler will only be called when known host checking is enabled and the check succeeded. :param x509_trusted_certs: (optional) A list of certificates which should be trusted for X.509 server certificate authentication. If no trusted certificates are specified, an attempt will be made to load them from the file :file:`.ssh/ca-bundle.crt`. If this argument is explicitly set to `None`, X.509 server certificate authentication will not be performed. .. note:: X.509 certificates to trust can also be provided through a :ref:`known_hosts ` file if they are converted into OpenSSH format. This allows their trust to be limited to only specific host names. :param x509_trusted_cert_paths: (optional) A list of path names to "hash directories" containing certificates which should be trusted for X.509 server certificate authentication. Each certificate should be in a separate file with a name of the form *hash.number*, where *hash* is the OpenSSL hash value of the certificate subject name and *number* is an integer counting up from zero if multiple certificates have the same hash. If no paths are specified, an attempt with be made to use the directory :file:`.ssh/crt` as a certificate hash directory. :param x509_purposes: (optional) A list of purposes allowed in the ExtendedKeyUsage of a certificate used for X.509 server certificate authentication, defulting to 'secureShellServer'. If this argument is explicitly set to `None`, the server certificate's ExtendedKeyUsage will not be checked. :param username: (optional) Username to authenticate as on the server. If not specified, the currently logged in user on the local machine will be used. :param password: (optional) The password to use for client password authentication or keyboard-interactive authentication which prompts for a password, or a `callable` or coroutine which returns the password to use. If this is not specified or set to `None`, client password authentication will not be performed. :param client_host_keysign: (optional) Whether or not to use `ssh-keysign` to sign host-based authentication requests. If set to `True`, an attempt will be made to find `ssh-keysign` in its typical locations. If set to a string, that will be used as the `ssh-keysign` path. When set, client_host_keys should be a list of public keys. Otherwise, client_host_keys should be a list of private keys with optional paired certificates. :param client_host_keys: (optional) A list of keys to use to authenticate this client via host-based authentication. If `client_host_keysign` is set and no host keys or certificates are specified, an attempt will be made to find them in their typical locations. If `client_host_keysign` is not set, host private keys must be specified explicitly or host-based authentication will not be performed. :param client_host_certs: (optional) A list of optional certificates which can be paired with the provided client host keys. :param client_host: (optional) The local hostname to use when performing host-based authentication. If not specified, the hostname associated with the local IP address of the SSH connection will be used. :param client_username: (optional) The local username to use when performing host-based authentication. If not specified, the username of the currently logged in user will be used. :param client_keys: (optional) A list of keys which will be used to authenticate this client via public key authentication. These keys will be used after trying keys from a PKCS11 provider or an ssh-agent, if either of those are configured. If no client keys are specified, an attempt will be made to load them from the files :file:`.ssh/id_ed25519_sk`, :file:`.ssh/id_ecdsa_sk`, :file:`.ssh/id_ed448`, :file:`.ssh/id_ed25519`, :file:`.ssh/id_ecdsa`, :file:`.ssh/id_rsa`, and :file:`.ssh/id_dsa` in the user's home directory, with optional certificates loaded from the files :file:`.ssh/id_ed25519_sk-cert.pub`, :file:`.ssh/id_ecdsa_sk-cert.pub`, :file:`.ssh/id_ed448-cert.pub`, :file:`.ssh/id_ed25519-cert.pub`, :file:`.ssh/id_ecdsa-cert.pub`, :file:`.ssh/id_rsa-cert.pub`, and :file:`.ssh/id_dsa-cert.pub`. If this argument is explicitly set to `None`, client public key authentication will not be performed. :param client_certs: (optional) A list of optional certificates which can be paired with the provided client keys. :param passphrase: (optional) The passphrase to use to decrypt client keys if they are encrypted, or a `callable` or coroutine which takes a filename as a parameter and returns the passphrase to use to decrypt that file. If not specified, only unencrypted client keys can be loaded. If the keys passed into client_keys are already loaded, this argument is ignored. .. note:: A callable or coroutine passed in as a passphrase will be called on all filenames configured as client keys or client host keys each time an SSHClientConnectionOptions object is instantiated, even if the keys aren't encrypted or aren't ever used for authentication. :param ignore_encrypted: (optional) Whether or not to ignore encrypted keys when no passphrase is specified. This defaults to `True` when keys are specified via the IdentityFile config option, causing encrypted keys in the config to be ignored when no passphrase is specified. Note that encrypted keys loaded into an SSH agent can still be used when this option is set. :param host_based_auth: (optional) Whether or not to allow host-based authentication. By default, host-based authentication is enabled if client host keys are made available. :param public_key_auth: (optional) Whether or not to allow public key authentication. By default, public key authentication is enabled if client keys are made available. :param kbdint_auth: (optional) Whether or not to allow keyboard-interactive authentication. By default, keyboard-interactive authentication is enabled if a password is specified or if callbacks to respond to challenges are made available. :param password_auth: (optional) Whether or not to allow password authentication. By default, password authentication is enabled if a password is specified or if callbacks to provide a password are made available. :param gss_host: (optional) The principal name to use for the host in GSS key exchange and authentication. If not specified, this value will be the same as the `host` argument. If this argument is explicitly set to `None`, GSS key exchange and authentication will not be performed. :param gss_store: (optional) The GSS credential store from which to acquire credentials. :param gss_kex: (optional) Whether or not to allow GSS key exchange. By default, GSS key exchange is enabled. :param gss_auth: (optional) Whether or not to allow GSS authentication. By default, GSS authentication is enabled. :param gss_delegate_creds: (optional) Whether or not to forward GSS credentials to the server being accessed. By default, GSS credential delegation is disabled. :param preferred_auth: A list of authentication methods the client should attempt to use in order of preference. By default, the preferred list is gssapi-keyex, gssapi-with-mic, hostbased, publickey, keyboard-interactive, and then password. This list may be limited by which auth methods are implemented by the client and which methods the server accepts. :param disable_trivial_auth: (optional) Whether or not to allow "trivial" forms of auth where the client is not actually challenged for credentials. Setting this will cause the connection to fail if a server does not perform some non-trivial form of auth during the initial SSH handshake. If not specified, all forms of auth supported by the server are allowed, including none. :param agent_path: (optional) The path of a UNIX domain socket to use to contact an ssh-agent process which will perform the operations needed for client public key authentication, or the :class:`SSHServerConnection` to use to forward ssh-agent requests over. If this is not specified and the environment variable `SSH_AUTH_SOCK` is set, its value will be used as the path. If this argument is explicitly set to `None`, an ssh-agent will not be used. :param agent_identities: (optional) A list of identities used to restrict which SSH agent keys may be used. These may be specified as byte strings in binary SSH format or as public keys or certificates (*see* :ref:`SpecifyingPublicKeys` and :ref:`SpecifyingCertificates`). If set to `None`, all keys loaded into the SSH agent will be made available for use. This is the default. :param agent_forwarding: (optional) Whether or not to allow forwarding of ssh-agent requests from processes running on the server. By default, ssh-agent forwarding requests from the server are not allowed. :param pkcs11_provider: (optional) The path of a shared library which should be used as a PKCS#11 provider for accessing keys on PIV security tokens. By default, no local security tokens will be accessed. :param pkcs11_pin: (optional) The PIN to use when accessing security tokens via PKCS#11. .. note:: If your application opens multiple SSH connections using PKCS#11 keys, you should consider calling :func:`load_pkcs11_keys` explicitly instead of using these arguments. This allows you to pay the cost of loading the key information from the security tokens only once. You can then pass the returned keys via the `client_keys` argument to any calls that need them. Calling :func:`load_pkcs11_keys` explicitly also gives you the ability to load keys from multiple tokens with different PINs and to select which tokens to load keys from and which keys on those tokens to load. :param client_version: (optional) An ASCII string to advertise to the SSH server as the version of this client, defaulting to `'AsyncSSH'` and its version number. :param kex_algs: (optional) A list of allowed key exchange algorithms in the SSH handshake, taken from :ref:`key exchange algorithms `. :param encryption_algs: (optional) A list of encryption algorithms to use during the SSH handshake, taken from :ref:`encryption algorithms `. :param mac_algs: (optional) A list of MAC algorithms to use during the SSH handshake, taken from :ref:`MAC algorithms `. :param compression_algs: (optional) A list of compression algorithms to use during the SSH handshake, taken from :ref:`compression algorithms `, or `None` to disable compression. :param signature_algs: (optional) A list of public key signature algorithms to use during the SSH handshake, taken from :ref:`signature algorithms `. :param rekey_bytes: (optional) The number of bytes which can be sent before the SSH session key is renegotiated. This defaults to 1 GB. :param rekey_seconds: (optional) The maximum time in seconds before the SSH session key is renegotiated. This defaults to 1 hour. :param connect_timeout: (optional) The maximum time in seconds allowed to complete an outbound SSH connection. This includes the time to establish the TCP connection and the time to perform the initial SSH protocol handshake, key exchange, and authentication. This is disabled by default, relying on the system's default TCP connect timeout and AsyncSSH's login timeout. :param login_timeout: (optional) The maximum time in seconds allowed for authentication to complete, defaulting to 2 minutes. Setting this to 0 will disable the login timeout. .. note:: This timeout only applies after the SSH TCP connection is established. To set a timeout which includes establishing the TCP connection, use the `connect_timeout` argument above. :param keepalive_interval: (optional) The time in seconds to wait before sending a keepalive message if no data has been received from the server. This defaults to 0, which disables sending these messages. :param keepalive_count_max: (optional) The maximum number of keepalive messages which will be sent without getting a response before disconnecting from the server. This defaults to 3, but only applies when keepalive_interval is non-zero. :param command: (optional) The default remote command to execute on client sessions. An interactive shell is started if no command or subsystem is specified. :param subsystem: (optional) The default remote subsystem to start on client sessions. :param env: (optional) The default environment variables to set for client sessions. Keys and values passed in here will be converted to Unicode strings encoded as UTF-8 (ISO 10646) for transmission. .. note:: Many SSH servers restrict which environment variables a client is allowed to set. The server's configuration may need to be edited before environment variables can be successfully set in the remote environment. :param send_env: (optional) A list of environment variable names to pull from `os.environ` and set by default for client sessions. Wildcards patterns using `'*'` and `'?'` are allowed, and all variables with matching names will be sent with whatever value is set in the local environment. If a variable is present in both env and send_env, the value from env will be used. :param request_pty: (optional) Whether or not to request a pseudo-terminal (PTY) by default for client sessions. This defaults to `True`, which means to request a PTY whenever the `term_type` is set. Other possible values include `False` to never request a PTY, `'force'` to always request a PTY even without `term_type` being set, or `'auto'` to request a TTY when `term_type` is set but only when starting an interactive shell. :param term_type: (optional) The default terminal type to set for client sessions. :param term_size: (optional) The terminal width and height in characters and optionally the width and height in pixels to set for client sessions. :param term_modes: (optional) POSIX terminal modes to set for client sessions, where keys are taken from :ref:`POSIX terminal modes ` with values defined in section 8 of :rfc:`RFC 4254 <4254#section-8>`. :param x11_forwarding: (optional) Whether or not to request X11 forwarding for client sessions, defaulting to `False`. If set to `True`, X11 forwarding will be requested and a failure will raise :exc:`ChannelOpenError`. It can also be set to `'ignore_failure'` to attempt X11 forwarding but ignore failures. :param x11_display: (optional) The display that X11 connections should be forwarded to, defaulting to the value in the environment variable `DISPLAY`. :param x11_auth_path: (optional) The path to the Xauthority file to read X11 authentication data from, defaulting to the value in the environment variable `XAUTHORITY` or the file :file:`.Xauthority` in the user's home directory if that's not set. :param x11_single_connection: (optional) Whether or not to limit X11 forwarding to a single connection, defaulting to `False`. :param encoding: (optional) The default Unicode encoding to use for data exchanged on client sessions. :param errors: (optional) The default error handling strategy to apply on Unicode encode/decode errors. :param window: (optional) The default receive window size to set for client sessions. :param max_pktsize: (optional) The default maximum packet size to set for client sessions. :param config: (optional) Paths to OpenSSH client configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. .. note:: Specifying configuration files when creating an :class:`SSHClientConnectionOptions` object will cause the config file to be read and parsed at the time of creation of the object, including evaluation of any conditional blocks. If you want the config to be parsed for every new connection, this argument should be added to the connect or listen calls instead. However, if you want to save the parsing overhead and your configuration doesn't depend on conditions that would change between calls, this argument may be an option. :param options: (optional) A previous set of options to use as the base to incrementally build up a configuration. When an option is not explicitly specified, its value will be pulled from this options object (if present) before falling back to the default value. :type client_factory: `callable` returning :class:`SSHClient` :type proxy_command: `str` or `list` of `str` :type known_hosts: *see* :ref:`SpecifyingKnownHosts` :type host_key_alias: `str` :type server_host_key_algs: `str` or `list` of `str` :type server_host_keys_handler: `callable` or coroutine :type x509_trusted_certs: *see* :ref:`SpecifyingCertificates` :type x509_trusted_cert_paths: `list` of `str` :type x509_purposes: *see* :ref:`SpecifyingX509Purposes` :type username: `str` :type password: `str` :type client_host_keysign: `bool` or `str` :type client_host_keys: *see* :ref:`SpecifyingPrivateKeys` or :ref:`SpecifyingPublicKeys` :type client_host_certs: *see* :ref:`SpecifyingCertificates` :type client_host: `str` :type client_username: `str` :type client_keys: *see* :ref:`SpecifyingPrivateKeys` :type client_certs: *see* :ref:`SpecifyingCertificates` :type passphrase: `str` or `bytes` :type ignore_encrypted: `bool` :type host_based_auth: `bool` :type public_key_auth: `bool` :type kbdint_auth: `bool` :type password_auth: `bool` :type gss_host: `str` :type gss_store: `str`, `bytes`, or a `dict` with `str` or `bytes` keys and values :type gss_kex: `bool` :type gss_auth: `bool` :type gss_delegate_creds: `bool` :type preferred_auth: `str` or `list` of `str` :type disable_trivial_auth: `bool` :type agent_path: `str` :type agent_identities: *see* :ref:`SpecifyingPublicKeys` and :ref:`SpecifyingCertificates` :type agent_forwarding: `bool` :type pkcs11_provider: `str` or `None` :type pkcs11_pin: `str` :type client_version: `str` :type kex_algs: `str` or `list` of `str` :type encryption_algs: `str` or `list` of `str` :type mac_algs: `str` or `list` of `str` :type compression_algs: `str` or `list` of `str` :type signature_algs: `str` or `list` of `str` :type rekey_bytes: *see* :ref:`SpecifyingByteCounts` :type rekey_seconds: *see* :ref:`SpecifyingTimeIntervals` :type connect_timeout: *see* :ref:`SpecifyingTimeIntervals` :type login_timeout: *see* :ref:`SpecifyingTimeIntervals` :type keepalive_interval: *see* :ref:`SpecifyingTimeIntervals` :type keepalive_count_max: `int` :type command: `str` :type subsystem: `str` :type env: `dict` with `str` keys and values :type send_env: `list` of `str` :type request_pty: `bool`, `'force'`, or `'auto'` :type term_type: `str` :type term_size: `tuple` of 2 or 4 `int` values :type term_modes: `dict` with `int` keys and values :type x11_forwarding: `bool` or `'ignore_failure'` :type x11_display: `str` :type x11_auth_path: `str` :type x11_single_connection: `bool` :type encoding: `str` or `None` :type errors: `str` :type window: `int` :type max_pktsize: `int` :type config: `list` of `str` :type options: :class:`SSHClientConnectionOptions` r^rr,rrrrrdrrrrrrr client_certsignore_encryptedrrrrrrrrrrrrr&rZr[r\r]r^r_r`rarbrcrdrXrYrZr[NFrrsecureShellServerrrWr%rr+rkrmrZr{ryrzrrrGrrJrLrNrPrRrTr=r?rDrarcrrrjrhclient_host_keysclient_host_certsr]rr cK$ tj}K|dk(rR|r |jsDt dddj }Ltj|LtjrLgng}tj|||K|$||}|dk(rJt dddj }Mtj|Mtjr tM}|dk(r7t dddj }N|Njr tNg}|dk(r4ttt t"tf|j%d d}|dk(r1tt t"tf|j%d t&}|dk(r$tt(|j%d t*}t,P|]||xst0|||| |-| | | | ||||||||||||||||||| dk7r| nRtt2t|j%d gtt2t|j%d gzxsd|_ttt|!dk7r|!n|j%d|_|"|_t;|"tt<t|j%ddg|#|_tAtt|$dk7r|$n|j%dK|_!|%|_"|&dk(r ttF|j%dd}&|&rn|7dk(rt|_>nd|_>|+r%tSttT|+|-|,O|.||_@n|+t|-|,|_@nd|_@|j|6|_B|9|_C|:|_Dnd|_Bd|_Cd|_D|8dk(r ttF|j%d"d}8|8r|6nd|_Ettt|;dk7r|;n|j%d#|_F|<|_Gtt|=dk7r|=n|j%d$|_Itt|>dk7r|>n|j%d%|_Ktt|?dk7r|?n|j%d&d|_M@|_NA|_OB|_Ptt tFtfCdk7rCn|j%d'xrd(|_QD|_RE|_SF|_TG|_UH|_VI|_WJ|_Xy#t$r tddwxYw))z/Prepare client connection configuration optionszWUnknown local username: set one of LOGNAME, USER, LNAME, or USERNAME in the environmentNrrrr^z ca-bundle.crtcrtConnectTimeoutServerAliveIntervalServerAliveCountMaxUserKnownHostsFileGlobalKnownHostsFile HostKeyAliasrUserEnableSSHKeySignFr%ccacheGSSAPIKeyExchangeTGSSAPIAuthenticationGSSAPIDelegateCredentialsPreferredAuthenticationsra IdentityAgent SSH_AUTH_SOCKrPKCS11Provider IdentityFileCertificateFileIdentitiesOnly ForwardAgent RemoteCommandSetEnvSendEnv RequestTTYForwardX11Trustedignore_failure)YgetpassgetuserrJrloadedrrr`rrr:loadrrrrrrr_DEFAULT_KEEPALIVE_INTERVALr_DEFAULT_KEEPALIVE_COUNT_MAXr-rr0r rrrrrrrrdrrrmrrrrrrrrrrrrerrrrrrfrrrS_ClientKeysArgrrrrrrrrrrrr&rZrr[rr\ _RequestPTYr]r^r_r`rarbrcrdrXrYrZr[)Qrr%rr^r+rr,rkrmrZr{ryrzrrrGrrJrLrNrPrRrTr=r?rDrarcrrrjrhrrrrrdrrrrrrrrr]rrrrrrrrrrrrrr&rZr[r\r]r^r_r`rarbrcrdrXrYrZr[local_usernamedefault_configdefault_x509_certsdefault_x509_cert_pathidentities_onlyr5sQ rrz"SSHClientConnectionOptions.prepare[sD :$__.N R<K4F4F!#vx8CCEN)+>3577*#)::.>#EGO  #U5#:& 3H3N)PQ  " $S&**%:%ACD  ;)^dFJ v"M8_ "2N'+%'9/ % *,? A+6*;; $s)VZZ(C DE LIK  #.B2F >* , %9! 2 # +> C Db J)A% cx2~8&,jj&H"JK ! " $T6::&8%@A  "./B"C $T*6F%GH(,I+J("& d>3CD(*;$H  %$7 &'S"b(3B.<)> ?! i% .& 2DN&DNDW]' JJ*D 13 Tx2~8 JJ-t 46 #'t"4":  6>#@ R S&**%?DE  nc *+11#6N-$8!  hsmVZZ-LMJ  ;?*O=M#')   $4ZND #D     '(DO#2D (DO"DO#'D "DO r !#D&**^U*KL 0@*dHSMgm7 JJ ') #SBYcFJJx4HIX8r>x JJy !#  K2"?@@#(:.//8$$x}%%Z3455 MNSM! x//  %c]"  c]} I}$)$$#C= sm K K=A3704U;?.0b&(29;(*1302%'R%'b+-2,.*,24>@2E9;=?IK3IBD57-/:<13CG*,=?=A8:-113.035373546IM*,57FH-268HJ35;=,035+/r/157+/)-+/=?-1/3.3*1-#7e'w889e'%i0e'!-e'?Ce'!) 8 e' !, e' 9< e' sm e' 39 e' ( 6e'! e'%X.e' (~e'#e';Ce'#e'Fe' (e' %0!e'"*2();#e'$ 0%e'&&eCHo6'e'( (eSj(9:)e'*"*(53D*E!F+e', %UCZ0-e'.%-U5#:->$?/e'0&.c]1e'2+3e'4!)# 75e'6'/7e'8+A9e':#3-;e':9A ;e'<&.k%:=e'>#+>":?e'@$,H#5Ae'B&c]Ce'D"*#Ee'F,Ge'H'x0Ie'J%Z0Ke'L#+4.Me'N#8C=1Oe'P$E*n*D$EFQe'R"$Se'R9ASe'T%-TNUe'V!)sHSM/A)B CWe'X'+Ye'Z%Xc]3[e'\#+8O+D"E]e'^#+4._e'`"*(3-!8ae'b%SMce'd"(3-0ee'f$C=ge'f7?tnge'h#8,ie'j&k2ke'l$C=me'n'oe'p)qe'r!)tSy)9 :se't&c]ue'v (}we'x(,ye'z#3-{e'ze!d?e"d@e"dAe"dBe"dCe#dDe$e%dEe&dFe e'ee fdGe e'e(e fdHe e'e(e fdIe e'e(e fdJe e'e(e fdKe ede)dLe#dedMe ed e d ed e*d e e e d e e'ee+fde ede ede ededededede edede e de ede ede ede e de de ededed ed!edNd"ffdO Z,xZ-S)PragISSH server connection options The following options are available to control the acceptance of SSH server connections: :param server_factory: A `callable` which returns an :class:`SSHServer` object that will be created for each new connection. :param proxy_command: (optional) A string or list of strings specifying a command and arguments to run when using :func:`connect_reverse` to make a reverse direction connection to an SSH client. Data will be forwarded to this process over stdin/stdout instead of opening a TCP connection. If specified as a string, standard shell quoting will be applied when splitting the command and its arguments. :param server_host_keys: (optional) A list of private keys and optional certificates which can be used by the server as a host key. Either this argument or `gss_host` must be specified. If this is not specified, only GSS-based key exchange will be supported. :param server_host_certs: (optional) A list of optional certificates which can be paired with the provided server host keys. :param send_server_host_keys: (optional) Whether or not to send a list of the allowed server host keys for clients to use to update their known hosts like for the server. .. note:: Enabling this option will allow multiple server host keys of the same type to be configured. Only the first key of each type will be actively used during key exchange, but the others will be reported as reserved keys that clients should begin to trust, to allow for future key rotation. If this option is disabled, specifying multiple server host keys of the same type is treated as a configuration error. :param passphrase: (optional) The passphrase to use to decrypt server host keys if they are encrypted, or a `callable` or coroutine which takes a filename as a parameter and returns the passphrase to use to decrypt that file. If not specified, only unencrypted server host keys can be loaded. If the keys passed into server_host_keys are already loaded, this argument is ignored. .. note:: A callable or coroutine passed in as a passphrase will be called on all filenames configured as server host keys each time an SSHServerConnectionOptions object is instantiated, even if the keys aren't encrypted or aren't ever used for server validation. :param known_client_hosts: (optional) A list of client hosts which should be trusted to perform host-based client authentication. If this is not specified, host-based client authentication will be not be performed. :param trust_client_host: (optional) Whether or not to use the hostname provided by the client when performing host-based authentication. By default, the client-provided hostname is not trusted and is instead determined by doing a reverse lookup of the IP address the client connected from. :param authorized_client_keys: (optional) A list of authorized user and CA public keys which should be trusted for certificate-based client public key authentication. :param x509_trusted_certs: (optional) A list of certificates which should be trusted for X.509 client certificate authentication. If this argument is explicitly set to `None`, X.509 client certificate authentication will not be performed. .. note:: X.509 certificates to trust can also be provided through an :ref:`authorized_keys ` file if they are converted into OpenSSH format. This allows their trust to be limited to only specific client IPs or user names and allows SSH functions to be restricted when these certificates are used. :param x509_trusted_cert_paths: (optional) A list of path names to "hash directories" containing certificates which should be trusted for X.509 client certificate authentication. Each certificate should be in a separate file with a name of the form *hash.number*, where *hash* is the OpenSSL hash value of the certificate subject name and *number* is an integer counting up from zero if multiple certificates have the same hash. :param x509_purposes: (optional) A list of purposes allowed in the ExtendedKeyUsage of a certificate used for X.509 client certificate authentication, defulting to 'secureShellClient'. If this argument is explicitly set to `None`, the client certificate's ExtendedKeyUsage will not be checked. :param host_based_auth: (optional) Whether or not to allow host-based authentication. By default, host-based authentication is enabled if known client host keys are specified or if callbacks to validate client host keys are made available. :param public_key_auth: (optional) Whether or not to allow public key authentication. By default, public key authentication is enabled if authorized client keys are specified or if callbacks to validate client keys are made available. :param kbdint_auth: (optional) Whether or not to allow keyboard-interactive authentication. By default, keyboard-interactive authentication is enabled if the callbacks to generate challenges are made available. :param password_auth: (optional) Whether or not to allow password authentication. By default, password authentication is enabled if callbacks to validate a password are made available. :param gss_host: (optional) The principal name to use for the host in GSS key exchange and authentication. If not specified, the value returned by :func:`socket.gethostname` will be used if it is a fully qualified name. Otherwise, the value used by :func:`socket.getfqdn` will be used. If this argument is explicitly set to `None`, GSS key exchange and authentication will not be performed. :param gss_store: (optional) The GSS credential store from which to acquire credentials. :param gss_kex: (optional) Whether or not to allow GSS key exchange. By default, GSS key exchange is enabled. :param gss_auth: (optional) Whether or not to allow GSS authentication. By default, GSS authentication is enabled. :param allow_pty: (optional) Whether or not to allow allocation of a pseudo-tty in sessions, defaulting to `True` :param line_editor: (optional) Whether or not to enable input line editing on sessions which have a pseudo-tty allocated, defaulting to `True` :param line_echo: (bool) Whether or not to echo completed input lines when they are entered, rather than waiting for the application to read and echo them, defaulting to `True`. Setting this to `False` and performing the echo in the application can better synchronize input and output, especially when there are input prompts. :param line_history: (int) The number of lines of input line history to store in the line editor when it is enabled, defaulting to 1000 :param max_line_length: (int) The maximum number of characters allowed in an input line when the line editor is enabled, defaulting to 1024 :param rdns_lookup: (optional) Whether or not to perform reverse DNS lookups on the client's IP address to enable hostname-based matches in authorized key file "from" options and "Match Host" config options, defaulting to `False`. :param x11_forwarding: (optional) Whether or not to allow forwarding of X11 connections back to the client when the client supports it, defaulting to `False` :param x11_auth_path: (optional) The path to the Xauthority file to write X11 authentication data to, defaulting to the value in the environment variable `XAUTHORITY` or the file :file:`.Xauthority` in the user's home directory if that's not set :param agent_forwarding: (optional) Whether or not to allow forwarding of ssh-agent requests back to the client when the client supports it, defaulting to `True` :param process_factory: (optional) A `callable` or coroutine handler function which takes an AsyncSSH :class:`SSHServerProcess` argument that will be called each time a new shell, exec, or subsystem other than SFTP is requested by the client. If set, this takes precedence over the `session_factory` argument. :param session_factory: (optional) A `callable` or coroutine handler function which takes AsyncSSH stream objects for stdin, stdout, and stderr that will be called each time a new shell, exec, or subsystem other than SFTP is requested by the client. If not specified, sessions are rejected by default unless the :meth:`session_requested() ` method is overridden on the :class:`SSHServer` object returned by `server_factory` to make this decision. :param encoding: (optional) The Unicode encoding to use for data exchanged on sessions on this server, defaulting to UTF-8 (ISO 10646) format. If `None` is passed in, the application can send and receive raw bytes. :param errors: (optional) The error handling strategy to apply on Unicode encode/decode errors of data exchanged on sessions on this server, defaulting to 'strict'. :param sftp_factory: (optional) A `callable` which returns an :class:`SFTPServer` object that will be created each time an SFTP session is requested by the client, or `True` to use the base :class:`SFTPServer` class to handle SFTP requests. If not specified, SFTP sessions are rejected by default. :param sftp_version: (optional) The maximum version of the SFTP protocol to support, currently either 3 or 4, defaulting to 3. :param allow_scp: (optional) Whether or not to allow incoming scp requests to be accepted. This option can only be used in conjunction with `sftp_factory`. If not specified, scp requests will be passed as regular commands to the `process_factory` or `session_factory`. to the client when the client supports it, defaulting to `True` :param window: (optional) The receive window size for sessions on this server :param max_pktsize: (optional) The maximum packet size for sessions on this server :param server_version: (optional) An ASCII string to advertise to SSH clients as the version of this server, defaulting to `'AsyncSSH'` and its version number. :param kex_algs: (optional) A list of allowed key exchange algorithms in the SSH handshake, taken from :ref:`key exchange algorithms ` :param encryption_algs: (optional) A list of encryption algorithms to use during the SSH handshake, taken from :ref:`encryption algorithms ` :param mac_algs: (optional) A list of MAC algorithms to use during the SSH handshake, taken from :ref:`MAC algorithms ` :param compression_algs: (optional) A list of compression algorithms to use during the SSH handshake, taken from :ref:`compression algorithms `, or `None` to disable compression :param signature_algs: (optional) A list of public key signature algorithms to use during the SSH handshake, taken from :ref:`signature algorithms ` :param rekey_bytes: (optional) The number of bytes which can be sent before the SSH session key is renegotiated, defaulting to 1 GB :param rekey_seconds: (optional) The maximum time in seconds before the SSH session key is renegotiated, defaulting to 1 hour :param connect_timeout: (optional) The maximum time in seconds allowed to complete an outbound SSH connection. This includes the time to establish the TCP connection and the time to perform the initial SSH protocol handshake, key exchange, and authentication. This is disabled by default, relying on the system's default TCP connect timeout and AsyncSSH's login timeout. :param login_timeout: (optional) The maximum time in seconds allowed for authentication to complete, defaulting to 2 minutes. Setting this to 0 will disable the login timeout. .. note:: This timeout only applies after the SSH TCP connection is established. To set a timeout which includes establishing the TCP connection, use the `connect_timeout` argument above. :param keepalive_interval: (optional) The time in seconds to wait before sending a keepalive message if no data has been received from the client. This defaults to 0, which disables sending these messages. :param keepalive_count_max: (optional) The maximum number of keepalive messages which will be sent without getting a response before disconnecting a client. This defaults to 3, but only applies when keepalive_interval is non-zero. :param tcp_keepalive: (optional) Whether or not to enable keepalive probes at the TCP level to detect broken connections, defaulting to `True` :param config: (optional) Paths to OpenSSH server configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. .. note:: Specifying configuration files when creating an :class:`SSHServerConnectionOptions` object will cause the config file to be read and parsed at the time of creation of the object, including evaluation of any conditional blocks. If you want the config to be parsed for every new connection, this argument should be added to the connect or listen calls instead. However, if you want to save the parsing overhead and your configuration doesn't depend on conditions that would change between calls, this argument may be an option. :param options: (optional) A previous set of options to use as the base to incrementally build up a configuration. When an option is not explicitly specified, its value will be pulled from this options object (if present) before falling back to the default value. :type server_factory: `callable` returning :class:`SSHServer` :type proxy_command: `str` or `list` of `str` :type family: `socket.AF_UNSPEC`, `socket.AF_INET`, or `socket.AF_INET6` :type server_host_keys: *see* :ref:`SpecifyingPrivateKeys` :type server_host_certs: *see* :ref:`SpecifyingCertificates` :type send_server_host_keys: `bool` :type passphrase: `str` or `bytes` :type known_client_hosts: *see* :ref:`SpecifyingKnownHosts` :type trust_client_host: `bool` :type authorized_client_keys: *see* :ref:`SpecifyingAuthorizedKeys` :type x509_trusted_certs: *see* :ref:`SpecifyingCertificates` :type x509_trusted_cert_paths: `list` of `str` :type x509_purposes: *see* :ref:`SpecifyingX509Purposes` :type host_based_auth: `bool` :type public_key_auth: `bool` :type kbdint_auth: `bool` :type password_auth: `bool` :type gss_host: `str` :type gss_store: `str`, `bytes`, or a `dict` with `str` or `bytes` keys and values :type gss_kex: `bool` :type gss_auth: `bool` :type allow_pty: `bool` :type line_editor: `bool` :type line_echo: `bool` :type line_history: `int` :type max_line_length: `int` :type rdns_lookup: `bool` :type x11_forwarding: `bool` :type x11_auth_path: `str` :type agent_forwarding: `bool` :type process_factory: `callable` or coroutine :type session_factory: `callable` or coroutine :type encoding: `str` or `None` :type errors: `str` :type sftp_factory: `callable` :type sftp_version: `int` :type allow_scp: `bool` :type window: `int` :type max_pktsize: `int` :type server_version: `str` :type kex_algs: `str` or `list` of `str` :type encryption_algs: `str` or `list` of `str` :type mac_algs: `str` or `list` of `str` :type compression_algs: `str` or `list` of `str` :type signature_algs: `str` or `list` of `str` :type rekey_bytes: *see* :ref:`SpecifyingByteCounts` :type rekey_seconds: *see* :ref:`SpecifyingTimeIntervals` :type connect_timeout: *see* :ref:`SpecifyingTimeIntervals` :type login_timeout: *see* :ref:`SpecifyingTimeIntervals` :type keepalive_interval: *see* :ref:`SpecifyingTimeIntervals` :type keepalive_count_max: `int` :type config: `list` of `str` :type options: :class:`SSHServerConnectionOptions` r^server_factoryr.zOrderedDict[bytes, SSHKeyPair]rrrrrrrrrrrr r rrrrarcrrrrXrYrrr rZr[NFrrrsecureShellClientTrrWr%rr+r,r-rdrr.rkrmrZr{ryrzrrrGrrJrLrNrPrRrTr=r?rDrarcrrrjrhserver_host_certsr]r cB tj|||||||| }|"dk(r1tttt f|j dt}"|#dk(r1tttt f|j dt}#|$dk(r$tt|j dt}$tE|1|| xst| | | ||(|||||||||||||||||| |!|"|#|$|%dk(r&ttt |j d}%|&dk(r'ttt |j dd}&t|%|(|&|}Bt!|_t!|_|BD]z}C|Cj&D]i}D|D|j"vr |'st)dDj+d d D|j"vrC|j"D<|'sQC|j$|Cj,<k||)|_|*|_|+dk(r(|r&tt2t |j d }+t5|+t t6frt9|+|_n|+|_|,dk(r,t=j>},d |,vrt=j@},|,|_!t5|-tDt fr d |-i|_#n|-|_#ttH|.dk7r|.n|j dd|_%ttH|/dk7r|/n|j dd|_&Bs |,s t)dttH|0dk7r|0n|j dd|_'|1|_(|2|_)|3|_*|4|_+ttH|5dk7r|5n|j dd|_,|6|_-|7|_.ttH|8dk7r|8n|j dd|_/|9|_0|:|_1|;|_2|<|_3|=durthn|=|_5|>|_6|?|_7@|_8A|_9y)z/Prepare server connection configuration optionsrLoginGraceTimeClientAliveIntervalClientAliveCountMaxHostKeyHostCertificaterzMultiple keys of type rzL found: Enable send_server_host_keys to allow reserved keys to be configuredAuthorizedKeysFilerrrTrzNo server host keys provided PermitTTYUseDNSFAllowAgentForwardingN):r;rrrrrrrrrrr-rrrrrrrhost_key_algorithmsrr public_datarrr rerr'rr gethostnamegetfqdnrrrrrrrr r rrrrarcrrrrXrYrrrr rZr[)Frr%rr^r+r,r-rdrr.rr.rkrmrZr{ryrzrrrGrrJrLrNrPrRrTr=r?rDrarcrrrjrhrrrr]rrrrrrrrr r rrrrarcrrrrXrYrrr rZr[ server_keysrrr5sF rrz"SSHServerConnectionOptions.prepare s1r!%%k66&1;&1;@ B U5#:& 3C3I)KL   #U5#:& 3H3N)PQ  " $S&**%:%ACD  ;)^dFJ v"M8_ "2N'+%'9/#]O%'9;N P r !#HSM6::i3HI   " $Xc]%+ZZ0A2%F!H $$4j$5DB !, $/M!"G22$///8M$%=(+ 7(;'<=L&LMM d33318D))#.(ELD--g.A.AB3##5!2 !R 'FT#Y +? @A # ,sDk :$%;<  '+AD ' r>))+H("!>>+! i% .& 2DN&DNDW]' JJ*D 13 Tx2~8 JJ-t 46 8;< <dbI JJ{D )+'"(.[B5Fk JJx ')-* $T 0B 6  148!: /.   *6$*>JL(" &r ).r r rrr;r_ServerFactoryrrrorrr&rr r~rrrr_DEFAULT_LINE_HISTORY_DEFAULT_MAX_LINE_LENGTHrrrr2rr9r8rrrrrrrrrrrrrrrrrUrs@rrrsJX ""66::%%$X.?%@AAsmZ3455 MNOOC= 566566sm K,--O K=A3704U#%! "r#%;?.0b&(29;(*1302%'R%'b+-2,.*,24>@2E9;=??C=?BD573513.33748*/7946IM*,+-,.$("&$9'?.0',/335EIEI*1<@$4"'#7mv'w889v'%i0v'!-v'?Cv'! v'58 v'  v' 25 v' ! v'!) 8v'!,v'9<v'smv'39v' ( 6v'! v'%X.v' (~v'#v';Cv'#v'F#v'$ (%v'&%0'v'(*2();)v'* 0+v',&eCHo6-v'. (eSj(9:/v'0"*%s *;!<1v'2 (eSj(9:3v'4%-U5#:->$?5v'6&.c]7v'8#19v':$/;v'<(,=v'>%Z0?v'@%2Av'B$(Cv'D)5Ev'F#8C=1Gv'H$E*n*D$EFIv'J"$Kv'L#4.Mv'N$D>Ov'P"Qv'R Sv'T"Uv'V"%Wv'X&d^Yv'Z!%[v'\ (}]v'^#+4._v'`"**A!Bav'b"**A!Bcv'd#3-ev'd.conn_factory!#46BBr r^NrzStarting SSH client onrr_r2rrr/wait_forrrrrr^rprr'r%r7s @@r run_clientr=!sLC-C  ! ! #D2<<**"(**K!!fdAt\) +++- --* -#=BA>7B9B:BBc Kdtffd }tjtj|fd|i|d{tj t |d||djd{S7<7w)a2Start an SSH server connection on an already-connected socket This function is a coroutine which starts an SSH server on an existing already-connected TCP socket. It can be used instead of :func:`listen` when connections are accepted outside of asyncio. :param sock: An existing already-connected socket to run SSH over, instead of opening up a new connection. :param config: (optional) Paths to OpenSSH server configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. By default, no OpenSSH configuration files will be loaded. See :ref:`SupportedServerConfigOptions` for details on what configuration options are currently supported. :param options: (optional) Options to use when starting the reverse-direction SSH server. These options can be specified either through this parameter or as direct keyword arguments to this function. :type sock: :class:`socket.socket` :type config: `list` of `str` :type options: :class:`SSHServerConnectionOptions` :returns: :class:`SSHServerConnection` r c tdS'Return an SSH server connection factoryrr4rr6srr'z run_server..conn_factory"r8r r^NrzStarting SSH server onr9rr2rrr/r;rrr<s @@r run_serverrE!sBC-C  ! ! #D2<<**"(**K!!fdAt\) +++- --* -r>)rZryrqrzrrr^rprmrZryrzc  Kdtf fd } tj tj|f||||||d| d{ tj t | ||| d jd{S7<7w)aMake an SSH client connection This function is a coroutine which can be run to create an outbound SSH client connection to the specified host and port. When successful, the following steps occur: 1. The connection is established and an instance of :class:`SSHClientConnection` is created to represent it. 2. The `client_factory` is called without arguments and should return an instance of :class:`SSHClient` or a subclass. 3. The client object is tied to the connection and its :meth:`connection_made() ` method is called. 4. The SSH handshake and authentication process is initiated, calling methods on the client object if needed. 5. When authentication completes successfully, the client's :meth:`auth_completed() ` method is called. 6. The coroutine returns the :class:`SSHClientConnection`. At this point, the connection is ready for sessions to be opened or port forwarding to be set up. If an error occurs, it will be raised as an exception and the partially open connection and client objects will be cleaned up. :param host: (optional) The hostname or address to connect to. :param port: (optional) The port number to connect to. If not specified, the default SSH port is used. :param tunnel: (optional) An existing SSH client connection that this new connection should be tunneled over. If set, a direct TCP/IP tunnel will be opened over this connection to the requested host and port rather than connecting directly via TCP. A string of the form [user@]host[:port] may also be specified, in which case a connection will be made to that host and then used as a tunnel. A comma-separated list may also be specified to establish a tunnel through multiple hosts. .. note:: When specifying tunnel as a string, any config options in the call will apply only when opening a connection to the final destination host and port. However, settings to use when opening tunnels may be specified via a configuration file. To get more control of config options used to open the tunnel, :func:`connect` can be called explicitly, and the resulting client connection can be passed as the tunnel argument. :param family: (optional) The address family to use when creating the socket. By default, the address family is automatically selected based on the host. :param flags: (optional) The flags to pass to getaddrinfo() when looking up the host address :param local_addr: (optional) The host and port to bind the socket to before connecting :param sock: (optional) An existing already-connected socket to run SSH over, instead of opening up a new connection. When this is specified, none of host, port family, flags, or local_addr should be specified. :param config: (optional) Paths to OpenSSH client configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. If no paths are specified and no config paths were set when constructing the `options` argument (if any), an attempt will be made to load the configuration from the file :file:`.ssh/config`. If this argument is explicitly set to `None`, no new configuration files will be loaded, but any configuration loaded when constructing the `options` argument will still apply. See :ref:`SupportedClientConfigOptions` for details on what configuration options are currently supported. :param options: (optional) Options to use when establishing the SSH client connection. These options can be specified either through this parameter or as direct keyword arguments to this function. :type host: `str` :type port: `int` :type tunnel: :class:`SSHClientConnection` or `str` :type family: `socket.AF_UNSPEC`, `socket.AF_INET`, or `socket.AF_INET6` :type flags: flags to pass to :meth:`getaddrinfo() ` :type local_addr: tuple of `str` and `int` :type sock: :class:`socket.socket` or `None` :type config: `list` of `str` :type options: :class:`SSHClientConnectionOptions` :returns: :class:`SSHClientConnection` r c tdSr2r5r6srr'zconnect..conn_factoryw"r8r r^rkrmrZryrzNzOpening SSH connection tor9r: rkrmrZryrqrzrrr^rprr'r%r7s @@rrhrh"sLC-C  ! ! #D2<<8TV*80688K!!fdE4, .++- -- 8 -$ABB7B>B?BBc  Kdtf fd } tj tj|f||||||d| d{ tj t | ||| d jd{S7<7w)aaCreate a reverse direction SSH connection This function is a coroutine which behaves similar to :func:`connect`, making an outbound TCP connection to a remote server. However, instead of starting up an SSH client which runs on that outbound connection, this function starts up an SSH server, expecting the remote system to start up a reverse-direction SSH client. Arguments to this function are the same as :func:`connect`, except that the `options` are of type :class:`SSHServerConnectionOptions` instead of :class:`SSHClientConnectionOptions`. :param host: (optional) The hostname or address to connect to. :param port: (optional) The port number to connect to. If not specified, the default SSH port is used. :param tunnel: (optional) An existing SSH client connection that this new connection should be tunneled over. If set, a direct TCP/IP tunnel will be opened over this connection to the requested host and port rather than connecting directly via TCP. A string of the form [user@]host[:port] may also be specified, in which case a connection will be made to that host and then used as a tunnel. A comma-separated list may also be specified to establish a tunnel through multiple hosts. .. note:: When specifying tunnel as a string, any config options in the call will apply only when opening a connection to the final destination host and port. However, settings to use when opening tunnels may be specified via a configuration file. To get more control of config options used to open the tunnel, :func:`connect` can be called explicitly, and the resulting client connection can be passed as the tunnel argument. :param family: (optional) The address family to use when creating the socket. By default, the address family is automatically selected based on the host. :param flags: (optional) The flags to pass to getaddrinfo() when looking up the host address :param local_addr: (optional) The host and port to bind the socket to before connecting :param sock: (optional) An existing already-connected socket to run SSH over, instead of opening up a new connection. When this is specified, none of host, port family, flags, or local_addr should be specified. :param config: (optional) Paths to OpenSSH server configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. By default, no OpenSSH configuration files will be loaded. See :ref:`SupportedServerConfigOptions` for details on what configuration options are currently supported. :param options: (optional) Options to use when starting the reverse-direction SSH server. These options can be specified either through this parameter or as direct keyword arguments to this function. :type host: `str` :type port: `int` :type tunnel: :class:`SSHClientConnection` or `str` :type family: `socket.AF_UNSPEC`, `socket.AF_INET`, or `socket.AF_INET6` :type flags: flags to pass to :meth:`getaddrinfo() ` :type local_addr: tuple of `str` and `int` :type sock: :class:`socket.socket` or `None` :type config: `list` of `str` :type options: :class:`SSHServerConnectionOptions` :returns: :class:`SSHServerConnection` r c tdSrArCr6srr'z%connect_reverse..conn_factory"r8r rHNz!Opening reverse SSH connection tor9rDrIs @@rrr"shC-C  ! ! #D2<<8TV*80688K!!fdE44 6++- -- 8 -rJdF) rZryrqrrrrrrrr^rprrc , Kdtf fd }tjtj| f| ||||d| d{d_tj t| ||||||d jd{S7F7w)a[Start an SSH server This function is a coroutine which can be run to create an SSH server listening on the specified host and port. The return value is an :class:`SSHAcceptor` which can be used to shut down the listener. :param host: (optional) The hostname or address to listen on. If not specified, listeners are created for all addresses. :param port: (optional) The port number to listen on. If not specified, the default SSH port is used. :param tunnel: (optional) An existing SSH client connection that this new connection should be tunneled over. If set, a direct TCP/IP tunnel will be opened over this connection to the requested host and port rather than connecting directly via TCP. A string of the form [user@]host[:port] may also be specified, in which case a connection will be made to that host and then used as a tunnel. A comma-separated list may also be specified to establish a tunnel through multiple hosts. .. note:: When specifying tunnel as a string, any config options in the call will apply only when opening a connection to the final destination host and port. However, settings to use when opening tunnels may be specified via a configuration file. To get more control of config options used to open the tunnel, :func:`connect` can be called explicitly, and the resulting client connection can be passed as the tunnel argument. :param family: (optional) The address family to use when creating the server. By default, the address families are automatically selected based on the host. :param flags: (optional) The flags to pass to getaddrinfo() when looking up the host :param backlog: (optional) The maximum number of queued connections allowed on listeners :param sock: (optional) A pre-existing socket to use instead of creating and binding a new socket. When this is specified, host and port should not be specified. :param reuse_address: (optional) Whether or not to reuse a local socket in the TIME_WAIT state without waiting for its natural timeout to expire. If not specified, this will be automatically set to `True` on UNIX. :param reuse_port: (optional) Whether or not to allow this socket to be bound to the same port other existing sockets are bound to, so long as they all set this flag when being created. If not specified, the default is to not allow this. This option is not supported on Windows or Python versions prior to 3.4.4. :param acceptor: (optional) A `callable` or coroutine which will be called when the SSH handshake completes on an accepted connection, taking the :class:`SSHServerConnection` as an argument. :param error_handler: (optional) A `callable` which will be called whenever the SSH handshake fails on an accepted connection. It is called with the failed :class:`SSHServerConnection` and an exception object describing the failure. If not specified, failed handshakes result in the connection object being silently cleaned up. :param config: (optional) Paths to OpenSSH server configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. By default, no OpenSSH configuration files will be loaded. See :ref:`SupportedServerConfigOptions` for details on what configuration options are currently supported. :param options: (optional) Options to use when accepting SSH server connections. These options can be specified either through this parameter or as direct keyword arguments to this function. :type host: `str` :type port: `int` :type tunnel: :class:`SSHClientConnection` or `str` :type family: `socket.AF_UNSPEC`, `socket.AF_INET`, or `socket.AF_INET6` :type flags: flags to pass to :meth:`getaddrinfo() ` :type backlog: `int` :type sock: :class:`socket.socket` or `None` :type reuse_address: `bool` :type reuse_port: `bool` :type acceptor: `callable` or coroutine :type error_handler: `callable` :type config: `list` of `str` :type options: :class:`SSHServerConnectionOptions` :returns: :class:`SSHAcceptor` r c tS)rBrCrrr%r7srr'zlisten..conn_factoryU##4h NNr r^rkrmrZryNzCreating SSH listener onr9) rr2rrr/r{r;rrrkrmrZryrqrrrrrrrr^rprr'r%r7s `` @@rrr"sPO-OO  ! ! #D2<<!TV!!!K !%K!! VT5'4L*D F++- --! -%AB B AB B BBc , Kdtf fd }tjtj| f| ||||d| d{d_tj t| ||||||d jd{S7F7w)aCreate a reverse-direction SSH listener This function is a coroutine which behaves similar to :func:`listen`, creating a listener which accepts inbound connections on the specified host and port. However, instead of starting up an SSH server on each inbound connection, it starts up a reverse-direction SSH client, expecting the remote system making the connection to start up a reverse-direction SSH server. Arguments to this function are the same as :func:`listen`, except that the `options` are of type :class:`SSHClientConnectionOptions` instead of :class:`SSHServerConnectionOptions`. The return value is an :class:`SSHAcceptor` which can be used to shut down the reverse listener. :param host: (optional) The hostname or address to listen on. If not specified, listeners are created for all addresses. :param port: (optional) The port number to listen on. If not specified, the default SSH port is used. :param tunnel: (optional) An existing SSH client connection that this new connection should be tunneled over. If set, a direct TCP/IP tunnel will be opened over this connection to the requested host and port rather than connecting directly via TCP. A string of the form [user@]host[:port] may also be specified, in which case a connection will be made to that host and then used as a tunnel. A comma-separated list may also be specified to establish a tunnel through multiple hosts. .. note:: When specifying tunnel as a string, any config options in the call will apply only when opening a connection to the final destination host and port. However, settings to use when opening tunnels may be specified via a configuration file. To get more control of config options used to open the tunnel, :func:`connect` can be called explicitly, and the resulting client connection can be passed as the tunnel argument. :param family: (optional) The address family to use when creating the server. By default, the address families are automatically selected based on the host. :param flags: (optional) The flags to pass to getaddrinfo() when looking up the host :param backlog: (optional) The maximum number of queued connections allowed on listeners :param sock: (optional) A pre-existing socket to use instead of creating and binding a new socket. When this is specified, host and port should not :param reuse_address: (optional) Whether or not to reuse a local socket in the TIME_WAIT state without waiting for its natural timeout to expire. If not specified, this will be automatically set to `True` on UNIX. :param reuse_port: (optional) Whether or not to allow this socket to be bound to the same port other existing sockets are bound to, so long as they all set this flag when being created. If not specified, the default is to not allow this. This option is not supported on Windows or Python versions prior to 3.4.4. :param acceptor: (optional) A `callable` or coroutine which will be called when the SSH handshake completes on an accepted connection, taking the :class:`SSHClientConnection` as an argument. :param error_handler: (optional) A `callable` which will be called whenever the SSH handshake fails on an accepted connection. It is called with the failed :class:`SSHClientConnection` and an exception object describing the failure. If not specified, failed handshakes result in the connection object being silently cleaned up. :param config: (optional) Paths to OpenSSH client configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. If no paths are specified and no config paths were set when constructing the `options` argument (if any), an attempt will be made to load the configuration from the file :file:`.ssh/config`. If this argument is explicitly set to `None`, no new configuration files will be loaded, but any configuration loaded when constructing the `options` argument will still apply. See :ref:`SupportedClientConfigOptions` for details on what configuration options are currently supported. :param options: (optional) Options to use when starting reverse-direction SSH clients. These options can be specified either through this parameter or as direct keyword arguments to this function. :type host: `str` :type port: `int` :type tunnel: :class:`SSHClientConnection` or `str` :type family: `socket.AF_UNSPEC`, `socket.AF_INET`, or `socket.AF_INET6` :type flags: flags to pass to :meth:`getaddrinfo() ` :type backlog: `int` :type sock: :class:`socket.socket` or `None` :type reuse_address: `bool` :type reuse_port: `bool` :type acceptor: `callable` or coroutine :type error_handler: `callable` :type config: `list` of `str` :type options: :class:`SSHClientConnectionOptions` :returns: :class:`SSHAcceptor` r c tS)r3r5rPsrr'z$listen_reverse..conn_factory#rQr rRNz*Creating reverse direction SSH listener onr9) r_r2rrr/r{r;rrrSs `` @@rrri#snO-OO  ! ! #D2<<!TV!!!K !%K!! VT5'4z<< >++ - --! -rTrc|Kt||fd|i|d{}|tt|jfS7$w)aCreate an SSH client connection This is a coroutine which wraps around :func:`connect`, providing backward compatibility with older AsyncSSH releases. The only differences are that the `client_factory` argument is the first positional argument in this call rather than being a keyword argument or specified via an :class:`SSHClientConnectionOptions` object and the return value is a tuple of an :class:`SSHClientConnection` and :class:`SSHClient` rather than just the connection, mirroring :meth:`asyncio.AbstractEventLoop.create_connection`. :returns: An :class:`SSHClientConnection` and :class:`SSHClient` rN)rhrr0r)rrkrmrrjs rrr#sJ&t#N#!# #D i!12 22 #s <:%<rc<Kt||fd|i|d{S7w)aCreate an SSH server This is a coroutine which wraps around :func:`listen`, providing backward compatibility with older AsyncSSH releases. The only difference is that the `server_factory` argument is the first positional argument in this call rather than being a keyword argument or specified via an :class:`SSHServerConnectionOptions` object, mirroring :meth:`asyncio.AbstractEventLoop.create_server`. rNr)rrkrmrs rr!r!$s2d">" " "" "r) rZr{ryrqrzrrr,rrr^rpr{r,rrc Kdtffd } tjtj | | ||||||d| dddd| |d{tj t | ||| djd{}|j}|j|jd{|S7v7@7 w)a,Retrieve an SSH server's host key This is a coroutine which can be run to connect to an SSH server and return the server host key presented during the SSH handshake. A list of server host key algorithms can be provided to specify which host key types the server is allowed to choose from. If the key exchange is successful, the server host key sent during the handshake is returned. .. note:: Not all key exchange methods involve the server presenting a host key. If something like GSS key exchange is used without a server host key, this method may return `None` even when the handshake completes. :param host: (optional) The hostname or address to connect to :param port: (optional) The port number to connect to. If not specified, the default SSH port is used. :param tunnel: (optional) An existing SSH client connection that this new connection should be tunneled over. If set, a direct TCP/IP tunnel will be opened over this connection to the requested host and port rather than connecting directly via TCP. A string of the form [user@]host[:port] may also be specified, in which case a connection will be made to that host and then used as a tunnel. A comma-separated list may also be specified to establish a tunnel through multiple hosts. .. note:: When specifying tunnel as a string, any config options in the call will apply only when opening a connection to the final destination host and port. However, settings to use when opening tunnels may be specified via a configuration file. To get more control of config options used to open the tunnel, :func:`connect` can be called explicitly, and the resulting client connection can be passed as the tunnel argument. :param proxy_command: (optional) A string or list of strings specifying a command and arguments to run to make a connection to the SSH server. Data will be forwarded to this process over stdin/stdout instead of opening a TCP connection. If specified as a string, standard shell quoting will be applied when splitting the command and its arguments. :param family: (optional) The address family to use when creating the socket. By default, the address family is automatically selected based on the host. :param flags: (optional) The flags to pass to getaddrinfo() when looking up the host address :param local_addr: (optional) The host and port to bind the socket to before connecting :param sock: (optional) An existing already-connected socket to run SSH over, instead of opening up a new connection. When this is specified, none of host, port family, flags, or local_addr should be specified. :param client_version: (optional) An ASCII string to advertise to the SSH server as the version of this client, defaulting to `'AsyncSSH'` and its version number. :param kex_algs: (optional) A list of allowed key exchange algorithms in the SSH handshake, taken from :ref:`key exchange algorithms ` :param server_host_key_algs: (optional) A list of server host key algorithms to allow during the SSH handshake, taken from :ref:`server host key algorithms `. :param config: (optional) Paths to OpenSSH client configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. If no paths are specified and no config paths were set when constructing the `options` argument (if any), an attempt will be made to load the configuration from the file :file:`.ssh/config`. If this argument is explicitly set to `None`, no new configuration files will be loaded, but any configuration loaded when constructing the `options` argument will still apply. See :ref:`SupportedClientConfigOptions` for details on what configuration options are currently supported. :param options: (optional) Options to use when establishing the SSH client connection used to retrieve the server host key. These options can be specified either through this parameter or as direct keyword arguments to this function. :type host: `str` :type port: `int` :type tunnel: :class:`SSHClientConnection` or `str` :type proxy_command: `str` or `list` of `str` :type family: `socket.AF_UNSPEC`, `socket.AF_INET`, or `socket.AF_INET6` :type flags: flags to pass to :meth:`getaddrinfo() ` :type local_addr: tuple of `str` and `int` :type sock: :class:`socket.socket` or `None` :type client_version: `str` :type kex_algs: `str` or `list` of `str` :type server_host_key_algs: `str` or `list` of `str` :type config: `list` of `str` :type options: :class:`SSHClientConnectionOptions` :returns: An :class:`SSHKey` public key or `None` r c tdS)r3rr4r5r6srr'z)get_server_host_key..conn_factory$s#45AAr Nr)r^rkrmrZr{ryrzrrr=r?rDrrr,zFetching server host key fromr9) r_r2rrr/r;rrrrQr)rkrmrZr{ryrqrzrrr,rrr^rpr'rjserver_host_keyr%r7s @@rrr!$sfB-B  ! ! #D2<<TV#Fz/CdX% =''K!!fdE40 2++- -D ..0OJJL     '' -s6A C C7C C7C >C ?C C  C rdc Kdtffd }tjtj | | |||||||d| dddd| | d{tj t | |||djd{}|j}|j|jd{|S7v7@7 w)arRetrieve an SSH server's allowed auth methods This is a coroutine which can be run to connect to an SSH server and return the auth methods available to authenticate to it. .. note:: The key exchange with the server must complete successfully before the list of available auth methods can be returned, so be sure to specify any arguments needed to complete the key exchange. Also, auth methods may vary by user, so you may want to specify the specific user you would like to get auth methods for. :param host: (optional) The hostname or address to connect to :param port: (optional) The port number to connect to. If not specified, the default SSH port is used. :param username: (optional) Username to authenticate as on the server. If not specified, the currently logged in user on the local machine will be used. :param tunnel: (optional) An existing SSH client connection that this new connection should be tunneled over. If set, a direct TCP/IP tunnel will be opened over this connection to the requested host and port rather than connecting directly via TCP. A string of the form [user@]host[:port] may also be specified, in which case a connection will be made to that host and then used as a tunnel. A comma-separated list may also be specified to establish a tunnel through multiple hosts. .. note:: When specifying tunnel as a string, any config options in the call will apply only when opening a connection to the final destination host and port. However, settings to use when opening tunnels may be specified via a configuration file. To get more control of config options used to open the tunnel, :func:`connect` can be called explicitly, and the resulting client connection can be passed as the tunnel argument. :param proxy_command: (optional) A string or list of strings specifying a command and arguments to run to make a connection to the SSH server. Data will be forwarded to this process over stdin/stdout instead of opening a TCP connection. If specified as a string, standard shell quoting will be applied when splitting the command and its arguments. :param family: (optional) The address family to use when creating the socket. By default, the address family is automatically selected based on the host. :param flags: (optional) The flags to pass to getaddrinfo() when looking up the host address :param local_addr: (optional) The host and port to bind the socket to before connecting :param sock: (optional) An existing already-connected socket to run SSH over, instead of opening up a new connection. When this is specified, none of host, port family, flags, or local_addr should be specified. :param client_version: (optional) An ASCII string to advertise to the SSH server as the version of this client, defaulting to `'AsyncSSH'` and its version number. :param kex_algs: (optional) A list of allowed key exchange algorithms in the SSH handshake, taken from :ref:`key exchange algorithms ` :param server_host_key_algs: (optional) A list of server host key algorithms to allow during the SSH handshake, taken from :ref:`server host key algorithms `. :param config: (optional) Paths to OpenSSH client configuration files to load. This configuration will be used as a fallback to override the defaults for settings which are not explicitly specified using AsyncSSH's configuration options. If no paths are specified and no config paths were set when constructing the `options` argument (if any), an attempt will be made to load the configuration from the file :file:`.ssh/config`. If this argument is explicitly set to `None`, no new configuration files will be loaded, but any configuration loaded when constructing the `options` argument will still apply. See :ref:`SupportedClientConfigOptions` for details on what configuration options are currently supported. :param options: (optional) Options to use when establishing the SSH client connection used to retrieve the server host key. These options can be specified either through this parameter or as direct keyword arguments to this function. :type host: `str` :type port: `int` :type tunnel: :class:`SSHClientConnection` or `str` :type proxy_command: `str` or `list` of `str` :type family: `socket.AF_UNSPEC`, `socket.AF_INET`, or `socket.AF_INET6` :type flags: flags to pass to :meth:`getaddrinfo() ` :type local_addr: tuple of `str` and `int` :type sock: :class:`socket.socket` or `None` :type client_version: `str` :type kex_algs: `str` or `list` of `str` :type server_host_key_algs: `str` or `list` of `str` :type config: `list` of `str` :type options: :class:`SSHClientConnectionOptions` :returns: a `list` of `str` r c tdS)r3r#r4r5r6srr'z-get_server_auth_methods..conn_factory#%s#4>JJr Nr)r^rkrmrdrZr{ryrzrrr=r?rDrrr,z!Fetching server auth methods fromr9) r_r2rrr/r;rrrrQr)rkrmrdrZr{ryrqrzrrr,rrr^rpr'rjserver_auth_methodsr%r7s @@rrr$sdK-K  ! ! #D2<<Tx]641dX%=''K!!fdE44 6++- -D 668JJL     )' -s6A C C7C C7C ?C C C  C r,)rNr)rrr(xrr2rr rrr`rrrrr] collectionsrrpathlibrtypesrtypingrrr r r r r rrrrrrrrrtyping_extensionsrrrrrrrrrrr r!r"r#r$r% auth_keysr&r'channelr(r)r*r+r,r-r.r/clientr0rr1r2r3r4r5r6r7r^r8r9r:r; constantsr<r=r>r?r@rArBrCrDrErFrGrHrIrJrKrLrMrNrOrPrQrRrSrTrUrVrWrXrYrZr[rr\r]r^r_r`forwardragssrbrcrdrerrfrgrhrirjkeysignrkrlrmrnrrorprrqrrrsrtrurvrwrxryloggingrzr{rQr|r}miscr~rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrUrrrrrrrrrrrpkcs11rr|rrrrrrr public_keyrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrstreamrrrrrrrrrr subprocessrrrrtuntaprrrrrrx11rrrrrcryptorrr-rrrrrrrrrTrr8r1rrrrrrrrr_GlobalRequestr_GlobalRequestResultr_KeyOrCertOptionsrrrrr_TunnelConnector_TunnelListenerrrrrr;r5r8rrrrrrrrr.r/rr[rorrrrrrrrrrr_rrrrr=rErhr AI_PASSIVErrrr!rrrr rrzs*  #HHFFF'',3BB8GG>CCDD3GGM9LL1*+OOLLF/:LLA@<>*L073=!8888)339,A=O+&3JJFFHHGG>>II;+=@@CCNN@@$$77A7FFLLLL=CEHJ19<G)@-AADDBBCC:::##;;;DDBB==**EEAADD33 &&;;GG''"i-("i-(78/ :%; <!(DL$v,,0L$v,,H+5d+;,<#=> h 330ox0(O#4j6F#FGH?#+I#6#89=#>?@  U+;=M+M%NNO 9+t+, E#x},- . D>dCc4EEFG z#445z>12gc3h'#678 HSM "x/D@AS)^,CK(T;&' sHSM123 D#I #S#J0G$GH$R)@%@As$<<=c#::;z" S#J 4(889$'  HE''HE2:3-HEr5y)HE.3HEVHZ4H' 4&'DG%JG%0EG% 22G%;>G%!&--0G%"*"e)!4G%----`s-79*,1352624BF s-8C=s-"#34s-"3-s-58s-'x0s-!/ s- #;/ s- $$>? s-#s-(;s-s-l)+a--/ ")+(,(*8<a-!#a-)*a- a-,/a-X& a- v}}% a- % a-45a-a-1a-a-Hx-57)+9J9J #T',,00413AEx-(3-x-!/2x-!#x-36x-x-,4FMM+Bx-!% x-;? x- * x- !. x-"+.x-##=>x-"x-'2x-x-vH-=?13&,&7&79=/4488<9;IMH-(3-H-!)/!:H-!)#H-!$H-CFH- ( 6 H- )- H- CG H- $2 H-)6H-"*+!6H-#++E"FH-$*H-/:H-H-X>@3N3-5c]3&,3 !9,-329;"")1#""("-8""&*,M-/13R(,/1"(*8<M!#M)*M .M>Fc]M M%-X$6 M v}}% M !, MM8@M%M45MMbHJM-/13R(,/1"(*8<M!#M7?}M)*M .M>Fc]M M%-X$6 M v}}% M !, MM8@M%M45MBJ#Mr