o
    �õ±j„  ã                   @   sj   d dl mZmZ d dlmZmZmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ G dd„ dƒZdS )	é    )ÚAP_REQÚAP_REP)ÚEnctypeÚKeyÚ_enctype_table)ÚWinSSPIÚSSPIPackage)ÚISC_REQ)Ú
get_gssapic                   @   s^   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zddd„Zdd„ Z	de
jddddfdd„ZdS )ÚKerberosClientSSPIc                 C   s:   d| _ || _ttjƒ| _d | _d | _d | _d | _	d | _
d S )Nr   )Ú
iterationsÚ
credentialr   r   ÚKERBEROSÚksspiÚgssapiÚetypeÚactual_ctx_flagsÚ
seq_numberÚsession_key)Úselfr   © r   ú™/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/kerberos/client/sspi.pyÚ__init__
   s   
zKerberosClientSSPI.__init__c                 C   s   | j du r| j ¡ | _ | j S )ax  
		Fetches the starting sequence number. This is either zero or can be found in the authenticator field of the 
		AP_REQ structure. As windows uses a random seq number AND a subkey as well, we can't obtain it by decrypting the 
		AP_REQ structure. Insead under the hood we perform an encryption operation via EncryptMessage API which will 
		yield the start sequence number
		N)r   r   Úget_seq_number©r   r   r   r   r      s   
z!KerberosClientSSPI.get_seq_numberc                 C   ó   t j| jv S ©N)r	   Ú	INTEGRITYr   r   r   r   r   Úsigning_needed    ó   z!KerberosClientSSPI.signing_neededc                 C   r   r   )r	   ÚCONFIDENTIALITYr   r   r   r   r   Úencryption_needed#   r   z$KerberosClientSSPI.encryption_neededc                 Ã   s   �| j  ||¡S r   )r   ÚGSS_Wrap)r   ÚdataÚ
message_nor   r   r   Úencrypt&   s   €zKerberosClientSSPI.encryptÚinitNc                 Ã   s   �| j j||||d�S )N)Ú	directionÚ	auth_data)r   Ú
GSS_Unwrap)r   r#   r$   r'   r(   r   r   r   Údecrypt)   s   €zKerberosClientSSPI.decryptc                 C   s   | j d u r| j ¡ | _ | j S r   )r   r   Úget_session_keyr   r   r   r   r+   ,   s   
z"KerberosClientSSPI.get_session_keyr   c              
   Ë   sÌ  �zÍt j|v st j|v r�| jdkrEt jt jB t jB t jB t jB t jB }| jj	|||||d�\}| _
}	|	d ur8|	‚|  jd7  _|dd fW S | jdkr‰t j}| jj	|||||d�\}| _
}	|	d urb|	‚t |¡j}
t|
d d |  ¡ ƒ}|  ¡  t|ƒ| _|  jd7  _|dd fW S tdƒ‚| jj	||||d	�\}| _
}	|	d ur¡|	‚|  ¡ du s­|  ¡ du rÉ|  ¡  t |¡}t|jd
 d d |  ¡ ƒ}t|ƒ| _|dd fW S  tyå } zd d|fW  Y d }~S d }~ww )Nr   )ÚflagsÚ
token_dataÚcb_dataÚclient_nameé   Tzenc-partr   FzFSSPI Kerberos -RPC - auth encountered too many calls for authenticate.)r,   r.   r/   Úticket)r	   ÚUSE_DCE_STYLEÚMUTUAL_AUTHr   r    r   ÚREPLAY_DETECTÚSEQUENCE_DETECTr   Úget_ticket_for_spnr   r   ÚloadÚnativer   r+   r   Ú
gssapi_smbr   Ú	Exceptionr!   r   r   r
   )r   ÚauthDatar,   r   r/   Úspnr.   ÚkwargsÚtokenÚerrÚaprepÚsubkeyÚapreqrawÚapreqÚskeyÚer   r   r   Úauthenticate1   sZ   €
ÿþýüû



€ÿzKerberosClientSSPI.authenticate)r&   N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r!   r%   r*   r+   r	   Ú
CONNECTIONrF   r   r   r   r   r   	   s    
r   N)Ú"minikerberos.protocol.asn1_structsr   r   Ú minikerberos.protocol.encryptionr   r   r   Úasyauth.common.winapi.winsspir   r   Úasyauth.common.winapi.constantsr	   Ú!asyauth.protocols.kerberos.gssapir
   Ú$asyauth.protocols.kerberos.gssapismbr9   r   r   r   r   r   Ú<module>   s    