U
|
£ý°dND ã @ s d Z ddlZddlZddlZddlmZ ddlmZmZm Z ddl
|
m Z m Z ddl m Z z ddlZW n, ek
|
r dZejdkre d dY nX zddlZddlZW n ek
|
r dZdZY nX d
|
d lmZ ejdkrÞd nd ZG dd d eZG dd d eZdS )z Kerberos Authentication Plugin.é N)ÚPath)ÚAnyÚOptionalÚTupleé )ÚInterfaceErrorÚProgrammingError)ÚloggerÚntzwModule gssapi is required for GSSAPI authentication mechanism but was not found. Unable to authenticate with the serveré )ÚBaseAuthPluginÚMySQLSSPIKerberosAuthPluginÚMySQLKerberosAuthPluginc @ sÜ e Zd ZU dZdZeed< dZeed< dZ e
|
e j ed< e edd d
|
Ze edd d Zee jjjd ddZe eeeef dddZd e
|
e e
|
e dddZe
|
e ee
|
e ef dddZeedddZdS ) r z3Implement the MySQL Kerberos authentication plugin.Ú authentication_kerberos_clientÚ plugin_nameFÚ requires_sslNÚcontext)Úreturnc C sb z:t jdd} t| j}| d¡dkr6| dd¡\}}|W S t jjjk
|
r\ t
|
¡ Y S X dS )z(Get user from credentials without realm.Úinitiate©Úusageú@éÿÿÿÿr N) ÚgssapiÚ CredentialsÚstrÚnameÚfindÚsplitÚrawÚmiscÚGSSErrorÚgetpassÚgetuser)ÚcredsÚuserÚ_© r' úmd:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\mysql/connector/plugins/authentication_kerberos_client.pyÚget_user_from_credentialsL s
|
z1MySQLKerberosAuthPlugin.get_user_from_credentialsc C s` t j dt jdkr dt ¡ n td d¡¡} | s<tdt d| ¡ dd |
|
d
|
¡i}|S ) zäGet a credentials store dictionary.
|
|
Returns:
|
dict: Credentials store dictionary with the krb5 ccache name.
|
|
Raises:
|
InterfaceError: If 'KRB5CCNAME' environment variable is empty.
|
Z
|
KRB5CCNAMEÚposixz /tmp/krb5cc_z%TEMP%Zkrb5ccz5The 'KRB5CCNAME' environment variable is set to emptyz Using krb5 ccache name: FILE:%ss ccachezFILE:úutf-8) ÚosÚenvironÚgetr Úgetuidr Újoinpathr r ÚdebugÚencode)Z
|
krb5ccnameÚstorer' r' r( Ú get_storeX s
|
ÿ üÿ z!MySQLKerberosAuthPlugin.get_store)Úupnr c
|
C s t d¡ t |tjj¡}| j d¡}z:tjj ||dd}|j
|
}tjj | ¡ |tj jddd W n8 tjjjk
|
r } ztd| |W 5 d}~X Y nX |S ) zÆAcquire and store credentials through provided password.
|
|
Args:
|
upn (str): User Principal Name.
|
|
Returns:
|
gssapi.raw.creds.Creds: GSSAPI credentials.
|
z8Attempt to acquire credentials through provided passwordr+ r r T)r$ ZmechÚ overwriteÚ set_defaultz7Unable to acquire credentials with the given password: N)r r1 r ÚNameÚNameTyper% Ú _passwordr2 r Zacquire_cred_with_passwordr$ Zstore_cred_intor4 ÚMechTypeÚkerberosr r! r )Úselfr5 r% ÚpasswordZacquire_cred_resultr$ Úerrr' r' r( Ú_acquire_cred_with_passwordp s0
|
ÿû
|
ÿþz3MySQLKerberosAuthPlugin._acquire_cred_with_password©Úpacketr c C s t d| dd
¡d }| dd
} t d| d| d|
¡d }| |d
} t d| dd
¡d }t d| d| dd
¡d }| ¡ | ¡ fS ©aY Parse authentication data.
|
|
Get the SPN and REALM from the authentication data packet.
|
|
Format:
|
SPN string length two bytes <B1> <B2> +
|
SPN string +
|
UPN realm string length two bytes <B1> <B2> +
|
UPN realm string
|
|
Returns:
|
tuple: With 'spn' and 'realm'.
|
z<HNr r ú<Ús©ÚstructÚunpackÚdecode©rB Zspn_lenÚspnZ realm_lenÚrealmr' r' r( Ú_parse_auth_data s z(MySQLKerberosAuthPlugin._parse_auth_data©Ú auth_datar c
|
C s¼ d}d}|rTz| |¡\}}W n4 tjk
|
rR } ztd| |W 5 d}~X Y nX |dkrd| ¡ S | jrz| j d| nd}t d|¡ t d|¡ zÎtj dd}t
|
|j }t d¡ t d |¡ | d¡d
|
krä| dd ¡\}} n|}d} | jr| j d| n|}| jr<| j|kr<t d ¡ | jdk r<| |¡}| rb| |krb| jdk rb| |¡}W n® tjjjk
|
r¼ } z2|r| jdk r| |¡}ntd | |W 5 d}~X Y nX tjjjk
|
r } z2|rò| jdk rò| |¡}ntd| |W 5 d}~X Y nX tjjtjjtjjf}
|
tj|tjj d} | tj j ¡} tj | |t!|
|
dd| _"z| j" #¡ } W n: tjjjk
|
rª } ztd| |W 5 d}~X Y nX t d| ¡ | S )ú(Prepare the first message to the server.Nú Invalid authentication data: r úService Principal: %sú Realm: %sr r zCached credentials foundzCached credentials UPN: %sr r zBThe user from cached credentials doesn't match with the given userzCredentials has expired: z-Unable to retrieve cached credentials error: )Z name_type)r r$ Úflagsr ú%Unable to initiate security context: úInitial client token: %s)$rM rG ÚerrorÚInterruptedErrorZprepare_passwordÚ _usernamer r1 r r r r r r r: r@ r Ú
|
exceptionsZExpiredCredentialsErrorr r r! ZRequirementFlagZmutual_authenticationZextended_errorZdelegate_to_peerr8 r9 Zkerberos_principalÚ canonicalizer; r< ÚSecurityContextÚsumr Ústep)r= rO rK rL r? r5 r$ Z creds_upnZ
|
creds_userZ creds_realmrT r ÚcnameÚinitial_client_tokenr' r' r( Ú auth_response© sx "
|
|
ÿ
|
ÿþý ÿ" z%MySQLKerberosAuthPlugin.auth_response©Útgt_auth_challenger c C s@ t d|¡ | j |¡}t d|¡ t d| jj¡ || jjfS )á! Continue with the Kerberos TGT service request.
|
|
With the TGT authentication service given response generate a TGT
|
service request. This method must be invoked sequentially (in a loop)
|
until the security context is completed and an empty response needs to
|
be send to acknowledge the server.
|
|
Args:
|
tgt_auth_challenge: the challenge for the negotiation.
|
|
Returns:
|
tuple (bytearray TGS service request,
|
bool True if context is completed otherwise False).
|
útgt_auth challenge: %szContext step response: %súContext completed?: %s)r r1 r r^ Úcomplete)r= rc Úrespr' r' r( Ú auth_continue÷ s
|
z%MySQLKerberosAuthPlugin.auth_continue)Úmessager c
|
C sÞ | j jstdt d|¡ t d| j j¡ z | j |¡}t d|¡ W nD tjj j
|
k
|
r } z t d|¡ t d| |W 5 d}~X Y nX t d|¡ t d }t d
|
|¡ | j j |d d }t d |d t|d ¡ |jS )a_ Accept handshake and generate closing handshake message for server.
|
|
This method verifies the server authenticity from the given message
|
and included signature and generates the closing handshake for the
|
server.
|
|
When this method is invoked the security context is already established
|
and the client and server can send GSSAPI formated secure messages.
|
|
To finish the authentication handshake the server sends a message
|
with the security layer availability and the maximum buffer size.
|
|
Since the connector only uses the GSSAPI authentication mechanism to
|
authenticate the user with the server, the server will verify clients
|
message signature and terminate the GSSAPI authentication and send two
|
messages; an authentication acceptance b' ' and a
|
OK packet (that must be received after sent the returned message from
|
this method).
|
|
Args:
|
message: a wrapped gssapi message from the server.
|
|
Returns:
|
bytearray (closing handshake message to be send to the server).
|
z!Security context is not completedzServer message: %szGSSAPI flags in use: %sz Unwraped: %sz#Unable to unwrap server message: %sz!Unable to unwrap server message: Nz Unwrapped server message: %ss zMessage response: %sF)Zencryptz(Wrapped message response: %s, length: %dr )r rg r r r1 Z actual_flagsÚunwrapr r rZ Z BadMICErrorr Ú bytearrayÚwrapÚlenrj )r= rj Zunwrapedr? ÚresponseZwrapedr' r' r( Úauth_accept_close_handshake s( "
|
ýz3MySQLKerberosAuthPlugin.auth_accept_close_handshake)N)Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__r r Ú__annotations__r Úboolr r r r\ Ú staticmethodr) Údictr4 r r$ ZCredsr@ Úbytesr rM ra ri rp r' r' r' r( r E s
|
Oþ c @ s e Zd ZU dZdZeed< dZeed< dZ e
|
ed< dZ e
|
ed< e e eeef d d
|
d Zdee ee d d dZee eee ef dddZdS )r zDImplement the MySQL Kerberos authentication plugin with Windows SSPIr r Fr Nr Ú
|
clientauthrA c C s t d| dd
¡d }| dd
} t d| d| d|
¡d }| |d
} t d| dd
¡d }t d| d| dd
¡d }| ¡ | ¡ fS rC rF rJ r' r' r( rM P s z,MySQLSSPIKerberosAuthPlugin._parse_auth_datarN c
|
C s t d¡ d}d}|r^z| |¡\}}W n4 tjk
|
r\ } ztd| |W 5 d}~X Y nX t d|¡ t d|¡ tdkstdkrtdtj tj
|
f}| j r¶| j r¶| j || j f}nd}|}t d|¡ t d|dk¡ tj d ||t|tjd
|
| _zZd}| j |¡\}} t d |¡ t d | ¡ t d | jj¡ | d j}
|
t d| jj¡ W n4 tk
|
r } ztd| |W 5 d}~X Y nX t d|
|
¡ |
|
S )rP zauth_response for sspiNrQ rR rS zKPackage "pywin32" (Python for Win32 (pywin32) extensions) is not installed.z targetspn: %sz_auth_info is None: %sZ Negotiate)Ú targetspnZ auth_infoZscflagsZdatarepúContext step err: %súContext step out_buf: %srf r z pkg_info: %srU rV )r r1 rM rG rW rX ÚsspiconÚsspir ZISC_REQ_MUTUAL_AUTHZISC_REQ_DELEGATErY r: Z
|
ClientAuthr] ZSECURITY_NETWORK_DREPrz Ú authorizeÚ authenticatedÚBufferÚpkg_infoÚ Exceptionr ) r= rO rK rL r? rT Z
|
_auth_infor{ ÚdataÚout_bufr` r' r' r( ra j sP
|
" ÿ û
|
" z)MySQLSSPIKerberosAuthPlugin.auth_responserb c C sf t d|¡ | j |¡\}}t d|¡ t d|¡ |d j}t d|¡ t d| jj¡ || jjfS )rd re r| r} r zContext step resp: %srf )r r1 rz r r r )r= rc r? r rh r' r' r( ri ³ s
|
z)MySQLSSPIKerberosAuthPlugin.auth_continue)N)rq rr rs rt r r ru r rv r r rz rw ry r rM r ra ri r' r' r' r( r H s
|
Jþ)rt r" r, rG Úpathlibr Útypingr r r Úerrorsr r r r Ú ImportErrorr r r~ Ú r ZAUTHENTICATION_PLUGIN_CLASSr r r' r' r' r( Ú<module> s<
|
ÿü
|
ÿ
|
