o
    �õ±j^;  ã                   @   sŒ  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	 d dlm
Z
 d dlmZ d dlmZ d d	lmZmZ d d
lmZmZmZ d dlmZmZmZmZ d dlmZ d dlmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8 d dl9m:Z: d dl;m<Z<m=Z=m>Z> d dl?m@Z@ dd„ ZAG dd„ dƒZBG dd„ dƒZCdS )é    N)Úhashlib)Úcms)Úalgos)Úcore)Úx509)Úkeys)Úparse_pkcs12)Úrsa_pkcs1v15_signÚload_private_key)Ú	NAME_TYPEÚMESSAGE_TYPEÚ
PaDataType)ÚEnctypeÚ_checksum_tableÚ_enctype_tableÚKey)ÚAuthenticatorChecksum)ÚKDC_REQ_BODYÚPrincipalNameÚHostAddressÚ
KDCOptionsÚEncASRepPartÚAP_REQÚAuthorizationDataÚChecksumÚ	krb5_pvnoÚRealmÚEncryptionKeyÚAuthenticatorÚTicketÚ	APOptionsÚEncryptedDataÚAS_REQÚAP_REP)
ÚPKAuthenticatorÚAuthPackÚDunno1ÚDunno2ÚMetaDataÚInfoÚ
CertIssuerÚCertIssuersÚPA_PK_AS_REPÚKDCDHKeyInfo)ÚKRB_FINISHED)ÚLSAP_TOKEN_INFO_INTEGRITYÚKERB_AD_RESTRICTION_ENTRYÚKERB_AD_RESTRICTION_ENTRYS)ÚGSSAPIFlagsc                 C   sP   | dkr| j dddd�S |   |  ¡ d d d¡}dt|ƒB j dddd�}|| S )	Né   é   ÚbigF©Úsignedé   é   é€   )Úto_bytesÚ
bit_lengthÚlen)ÚxÚlbÚt© rA   ú†/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/pkinit.pyÚlength_encode$   s
   rC   c                   @   sH   e Zd Zdd„ Zedd„ ƒZedd„ ƒZedd„ ƒZd	d
„ Zdd„ Z	dS )ÚDirtyDHc                 C   sF   d | _ d | _d | _d | _t d¡| _t| j ¡ dƒ| _	t d¡| _
d S )Né    é   )ÚpÚgÚ
shared_keyÚshared_key_intÚosÚurandomÚprivate_keyÚintÚhexÚprivate_key_intÚdh_nonce©ÚselfrA   rA   rB   Ú__init__.   s   zDirtyDH.__init__c                 C   s   t ƒ }| |_||_|S ©N©rD   rG   rH   )rG   rH   ÚddrA   rA   rB   Úfrom_params7   s   zDirtyDH.from_paramsc                 C   s   t ƒ }| d |_| d |_|S )NrG   rH   rV   )ÚdhprW   rA   rA   rB   Ú	from_dict>   s   

zDirtyDH.from_dictc                 C   s   t j | ¡j}t |¡S rU   )r   ÚDHParametersÚloadÚnativerD   rZ   )Ú
asn1_bytesrY   rA   rA   rB   Ú	from_asn1E   s   
zDirtyDH.from_asn1c                 C   s   t | j| j| jƒS rU   )ÚpowrH   rP   rG   rR   rA   rA   rB   Úget_public_keyK   s   zDirtyDH.get_public_keyc                 C   sN   t || j| jƒ| _t| jƒdd … }t|ƒd dkrd| }t |¡| _| jS )Né   r   Ú0)	r`   rP   rG   rJ   rO   r=   ÚbytesÚfromhexrI   )rS   Úbob_intr>   rA   rA   rB   ÚexchangeO   s   zDirtyDH.exchangeN)
Ú__name__Ú
__module__Ú__qualname__rT   ÚstaticmethodrX   rZ   r_   ra   rg   rA   rA   rA   rB   rD   -   s    	


rD   c                   @   s˜   e Zd Zdd„ Zddd„Zeddd„ƒZedd	d
„ƒZddd„Zddg d¢fdd„Z	e
je
jB e
jB fdd„Zddd„Zddd„Zdd„ Zddd„ZdS )ÚPKINITc                 C   s:   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d S rU   )	ÚprivkeyinfoÚcertificateÚextra_certsÚuser_sidÚ	user_nameÚissuerÚcnameÚdiffieÚ_PKINIT__hcertrR   rA   rA   rB   rT   Y   s   
zPKINIT.__init__ÚMYNc                 C   s"   ddl m} |||ƒ\| _| _d S )Nr   )Úfind_cert_by_cn)Ú#minikerberos.common.windows.crypt32rw   rn   ru   )rS   ÚusernameÚcertstore_nameÚcert_serialrw   rA   rA   rB   Úinit_windows_certe   s   zPKINIT.init_windows_certc                 C   s&   t ƒ }|j| ||d� |j|d� |S )N)rz   r{   ©Ú	dh_params)rl   r|   Úsetup)ry   rz   r{   r~   ÚpkinitrA   rA   rB   Úfrom_windows_certstorej   s   zPKINIT.from_windows_certstorec                 C   sz   t ƒ }t|tƒr| ¡ }t| dƒ�}t| ¡ |d�\|_|_|_	t
|jƒ|_W d   ƒ n1 s0w   Y  |j|d� |S )NÚrb)Úpasswordr}   )rl   Ú
isinstanceÚstrÚencodeÚopenr   Úreadrm   rn   ro   r
   Úprivkeyr   )ÚpfxfileÚpfxpassr~   r€   ÚfrA   rA   rB   Úfrom_pfxr   s   
þzPKINIT.from_pfxc                 C   sÞ   | j jjd D ]}| d¡r|| _q| d¡dkr|| _q| j jjd | _d d| j| jg¡| _	|d u rGt
dƒ t tdƒj¡| _t
d	ƒ d S t|tƒrTt |¡| _d S t|tƒrat |¡| _d S t|tƒrk|| _d S td
ƒ‚)NÚcommon_namezS-1-12ú@éÿÿÿÿú\ÚAzureADzGenerating DH params...i   zDH params generated.z.DH params must be either a bytearray or a dict)rn   Úsubjectr]   Ú
startswithrp   Úfindrq   rr   Újoinrs   ÚprintrD   rZ   Úgenerate_dh_parametersrt   r„   Údictrd   r_   Ú	Exception)rS   r~   r>   rA   rA   rB   r      s&   
€



zPKINIT.setup)ÚforwardableÚ	renewableÚ	proxiableÚcanonicalizec                 C   st  t |tƒr	t|ƒ}|d urt |tƒr|g}n| jg}|d ur't |tƒr&|g}ndg}tj tjj¡}i }t	|ƒ|d< t
tjj|dœƒ|d< d|d< t
tjj|dœƒ|d< |tjdd	� jd
d�|d< |tjdd	� jd
d�|d< t d¡|d< ddg|d< tdddœƒg|d< t|ƒ}t | ¡ ¡ ¡ }i }|j|d< |jd
d�|d< t d¡|d< ||d< i }	| jj|	d< | jj|	d< d
|	d< i }
d|
d< t |	¡|
d< i }t |
¡|d< | j ¡ |d < i }t |ƒ|d!< t !|¡|d"< | jj"|d#< t#|ƒ}| j$| ¡ d$d%�}t%t&|ƒƒ| }d&| }d't%t&|ƒƒ | }i }t'j(j|d(< ||d)< i }d*|d+< d,|d-< |g|d.< ||d/< t)|ƒ ¡ S )0Nú	127.0.0.1zkdc-options©z	name-typezname-stringrs   úWELLKNOWN:PKU2UÚrealmÚsnamer4   )Údaysr   ©ÚmicrosecondÚtillÚrtimeé   Únonceé   é   Úetypeé   s	   127.0.0.1)z	addr-typeÚaddressÚ	addressesÚcusecÚctimeÚ
paChecksumrG   rH   Úqz1.2.840.10046.2.1Ú	algorithmÚ
parametersÚ
public_keyÚpkAuthenticatorÚclientPublicValueÚclientDHNonceF)Úwrap_signedó   €ó   0úpadata-typeúpadata-valueé   Úpvnoé
   úmsg-typeÚpadatazreq-body)*r„   ÚlistÚsetr…   rs   ÚdatetimeÚnowÚtimezoneÚutcr   r   r   ÚMS_PRINCIPALÚvalueÚ	timedeltaÚreplaceÚsecretsÚrandbitsr   r   r   Úsha1ÚdumpÚdigestr¦   rt   rG   rH   r   ÚDomainParametersÚPublicKeyAlgorithmra   r$   ÚPublicKeyInforQ   r%   Úsign_authpackrC   r=   r   Ú	PK_AS_REQr"   )rS   Útargetrs   ÚkdcoptsrÈ   Úkdc_req_body_dataÚkdc_req_bodyÚchecksumÚauthenticatorÚdpÚpkaÚspkiÚauthpackÚsigned_authpackÚpayloadÚ	pa_data_1ÚasreqrA   rA   rB   Úbuild_asreq    st   

€
€

zPKINIT.build_asreqc                 C   s  t |d  }t|j|d ƒ}td }	i }
d|
d< |	 |d|¡|
d< i }t|
ƒ|d< t|ƒ ¡ }d}|jd	d
dd�t	|ƒjd	d
dd� | }t
ƒ }||_d|_i }d|d< | ¡ | |d< tƒ }d|_d|_t d¡|_i }d|d< | ¡ |d< t|ƒ}t|gƒ ¡ }td|dœgƒ ¡ }tj tjj¡}i }t|d< t|d ƒ|d< |d |d< |j|d< |jdd�|d< t|ƒ|d< d|d< td|dœgƒ|d < t|ƒ|d!< | |d"t |ƒ ¡ d ¡}d#g}i }t|d$< t!j"j#|d%< t$|d& ƒ|d&< t%t&|ƒƒ|d'< t'|j|d(œƒ|d)< t(|ƒ ¡ S )*NÚkeytypeÚkeyvaluerF   Ú	cksumtypeé)   rÝ   zgss-micrb   é   r5   T)Ú	byteorderr7   s                   i€  r4   i    Ú@7e303fffe6bff25146addca4fbddf1b94f1634178eb4528fb2731c669ca23cder   zrestriction-typeÚrestrictioné�   )zad-typezad-datazauthenticator-vnoÚcrealmrs   r±   r¥   r²   Úsubkeyin,­(z
seq-numberzauthorization-dataÚcksumé   zmutual-requiredrÁ   rÃ   Úticketz
ap-options)r­   ÚcipherrÞ   ))r   r   Úenctyper   rÝ   r   r.   rÒ   r;   r=   r   ÚflagsÚchannel_bindingr/   ÚFlagsÚTokenILrd   re   Ú	MachineIDr0   r1   r   rÇ   rÈ   rÉ   rÊ   r   r   r¦   rÎ   r   Úencryptr   r   Ú
KRB_AP_REQrÌ   r   r    rÆ   r!   r   )rS   ÚasrepÚsession_keyrö   Úsubkey_dataÚkrb_finished_datarø   Úsubkey_cipherÚ
subkey_keyÚsubkey_checksumÚkrb_finished_checksum_dataÚkrb_finishedÚaÚextensions_dataÚacÚchksumÚtiiÚrestriction_datar>   ÚrestrictionsrÈ   Úauthenticator_dataÚauthenticator_data_encÚap_optsÚap_reqrA   rA   rB   Úbuild_apreqî   s^   (
zPKINIT.build_apreqFc                 C   s0   | j d urddlm} || j |ƒS |  | ||¡S )Nr   )Ú
pkcs7_sign)ru   rx   r  Úsign_authpack_native)rS   Údatar»   r  rA   rA   rB   r×   >  s   
zPKINIT.sign_authpackc                 C   sJ  i }t  d¡|d< i }d|d< t | jj| jjdœ¡|d< t  |¡|d< t dd	gd
œ¡t dt	 
|¡ ¡ gd
œ¡g|d< t  ddi¡|d< t| jt |d ¡ ¡ dƒ|d< i }d	|d< ||d< i }d|d< t  |¡g|d< t |¡|d< | jg|d< t t |¡g¡|d< |du rži }d|d< t |¡|d< t |¡ ¡ S t |¡ ¡ S )a  
		Creating PKCS7 blob which contains the following things:

		1. 'data' blob which is an ASN1 encoded "AuthPack" structure
		2. the certificate used to sign the data blob
		3. the singed 'signed_attrs' structure (ASN1) which points to the "data" structure (in point 1)
		z1.3.14.3.2.26rµ   Úv1Úversion)rr   Úserial_numberÚsidÚdigest_algorithmÚcontent_typez1.3.6.1.5.2.3.1)ÚtypeÚvaluesÚmessage_digestÚsigned_attrsz1.2.840.113549.1.1.1Úsignature_algorithmrÑ   Ú	signatureÚcontentÚv3Údigest_algorithmsÚencap_content_infoÚcertificatesÚsigner_infosTz1.2.840.113549.1.7.2)r   ÚDigestAlgorithmIdr   ÚIssuerAndSerialNumberrn   rr   r  ÚDigestAlgorithmÚCMSAttributer   rÑ   rÓ   ÚSignedDigestAlgorithmr	   r‰   ÚCMSAttributesrÒ   ÚEncapsulatedContentInfoÚSignerInfosÚ
SignerInfoÚ
SignedDataÚContentInfo)rS   r  r»   ÚdaÚsiÚecÚsdÚcirA   rA   rB   r  E  s:   	þþ zPKINIT.sign_authpack_nativec                 C   s   dd„ }|d D ]}|d dkrt  |d ¡j} nqtdƒ‚tj |d ¡j}|d	 }|d
 dkr6tdƒ‚t |d ¡j}td dgdd„ |d D ƒ ¡dƒ}tj	t
 |d ¡ ¡ dd … ddd�}| j |¡}	|d }
|	| jj |
 }|d d }t| }|tjkrŠ||dƒ}n|tjkr•||dƒ}n	|tjkržtdƒ‚t|j|ƒ}|d d }| |d|¡}t |¡j}tt|d  d! ƒ }t|j|d  d" ƒ}|||fS )#Nc                 S   s~   d}d}t |ƒ|k r=t t|gƒ|  ¡ ¡ }t |ƒt |ƒ |kr/||d |t |ƒ … 7 }	 |S ||7 }|d7 }t |ƒ|k s
|S )Nó    r   r4   )r=   r   rÑ   rd   rÓ   )rÌ   ÚkeysizeÚoutputÚ
currentNumÚcurrentDigestrA   rA   rB   Útruncate_key|  s   ýúz*PKINIT.decrypt_asrep.<locals>.truncate_keyrÄ   r¾   r¬   r¿   zPA_PK_AS_REP not found!ÚdhSignedDatar&  r  z1.3.6.1.5.2.3.2z%Keyinfo content type unexpected valuer#  Ú Ú1c                 S   s   g | ]}t |ƒ‘qS rA   )r…   )Ú.0r>   rA   rA   rB   Ú
<listcomp>•  s    z(PKINIT.decrypt_asrep.<locals>.<listcomp>ÚsubjectPublicKeyrb   r8   r5   Fr6   ÚserverDHNoncezenc-partr­   rE   rF   zBRC4 key truncation documentation missing. it is different from AESrö   é   Úkeyrè   ré   )r,   r\   r]   rš   r   r2  r-   rN   r–   Ú
from_bytesr   Ú	BitStringrÒ   rt   rg   rQ   r   r   ÚAES256ÚAES128ÚRC4ÚNotImplementedErrorr   r÷   Údecryptr   )rS   Úas_repr>  ÚpaÚpkasrepr7  ÚkeyinfoÚauthdataÚpubkeyrI   Úserver_nonceÚfullKeyr­   rö   Út_keyrG  Úenc_dataÚdec_dataÚencasrepr   rA   rA   rB   Údecrypt_asrepx  s@   þ$&



zPKINIT.decrypt_asrepc                 C   sž   |d urt |tƒr|g}ndg}i }d|d< | j|d< t|gƒ}t|gƒ}i }d|d< ttjj|dœƒ|d< i }t	|ƒ|d	< t
d
| ¡ iƒg|d< t|ƒ ¡ S )NrŸ   z2.5.4.3r  rÌ   r¡   Úpku2ur    Ú
clientInfor)   r  rA  )r„   r…   rr   r&   r'   r   r   rË   rÌ   r)   r*   rÒ   r(   )rS   rÙ   r8  r  ÚinfoÚmdrA   rA   rB   Úget_metadata±  s"   
€


zPKINIT.get_metadata)rv   N)rv   NNrU   )F)rh   ri   rj   rT   r|   rk   r�   r�   r   rç   r2   ÚGSS_C_MUTUAL_FLAGÚGSS_C_INTEG_FLAGÚGSS_C_EXTENDED_ERROR_FLAGr  r×   r  r[  r`  rA   rA   rA   rB   rl   X   s    

!N
P
39rl   )DrK   rÇ   rÏ   ÚplatformÚ	unicryptor   Ú
asn1cryptor   r   r   r   r   Úoscrypto.keysr   Úoscrypto.asymmetricr	   r
   Úminikerberos.protocol.constantsr   r   r   Ú minikerberos.protocol.encryptionr   r   r   r   Ú minikerberos.protocol.structuresr   Ú"minikerberos.protocol.asn1_structsr   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   Úminikerberos.protocol.rfc4556r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   Ú minikerberos.protocol.rfc_iakerbr.   Úminikerberos.protocol.mskiler/   r0   r1   Úminikerberos.gssapi.gssapir2   rC   rD   rl   rA   rA   rA   rB   Ú<module>   s.   	L0	+