�
Ϫ�f�@ � �B � d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z ddl
mZ ddlmZmZmZ ddlmZmZ dd lmZ dd
lmZ dd lmZ G d � d
e � Z G d� de � Z G d� de � Z G d� de � Z G d� de � Z e e e � G d� d� � Z! G d� d� Z" e e � G d� d� � Z# e e � G d � d � � Z$ e e � G d � d � � Z% e e � G d � d!� � Z& G d"� d#e � Z' e e'� G d$� d%� � Z(y)&z�
This module defines L{ICredentials}, an interface for objects that represent
authentication credentials to provide, and also includes a number of useful
implementations of that interface.
� N)�hexlify)�md5)� Interface� implementer)�error)�calcHA1�calcHA2� calcResponse)� nativeString�
networkString)�deprecatedModuleAttribute)� secureRandom)�Versionc � � e Zd ZdZy)� ICredentialsz�
I check credentials.
Implementors I{must} specify the sub-interfaces of ICredentials
to which it conforms, using L{zope.interface.implementer}.
N��__name__�
__module__� __qualname__�__doc__� � �:/usr/lib/python3/dist-packages/twisted/cred/credentials.pyr r s � �r r c � � e Zd ZdZd� Zy)�IUsernameDigestHashz�
This credential is used when a CredentialChecker has access to the hash
of the username:realm:password as in an Apache .htdigest file.
c � � y)a-
@param digestHash: The hashed username:realm:password to check against.
@return: C{True} if the credentials represented by this object match
the given hash, C{False} if they do not, or a L{Deferred} which
will be called back with one of these values.
Nr )�
digestHashs r � checkHashz IUsernameDigestHash.checkHash- � � r N)r r r r r r r r r r ' s � ��
r r c � � e Zd ZdZd� Zy)�IUsernameHashedPassworda�
I encapsulate a username and a hashed password.
This credential is used when a hashed password is received from the
party requesting authentication. CredentialCheckers which check this
kind of credential must store the passwords in plaintext (or as
password-equivalent hashes) form so that they can be hashed in a manner
appropriate for the particular credentials class.
@type username: L{bytes}
@ivar username: The username associated with these credentials.
c � � y�a�
Validate these credentials against the correct password.
@type password: L{bytes}
@param password: The correct, plaintext password against which to
check.
@rtype: C{bool} or L{Deferred}
@return: C{True} if the credentials represented by this object match the
given password, C{False} if they do not, or a L{Deferred} which will
be called back with one of these values.
Nr ��passwords r �
checkPasswordz%IUsernameHashedPassword.checkPasswordE r r N)r r r r r& r r r r! r! 7 s � � � r r! c �6 � e Zd ZU dZeed< eed< dedefd�Zy)�IUsernamePasswordaK
I encapsulate a username and a plaintext password.
This encapsulates the case where the password received over the network
has been hashed with the identity function (That is, not at all). The
CredentialsChecker may store the password in whatever format it desires,
it need only transform the stored password in a similar way before
performing the comparison.
@type username: L{bytes}
@ivar username: The username associated with these credentials.
@type password: L{bytes}
@ivar password: The password associated with these credentials.
�usernamer% �returnc � � yr# r r$ s r r& z IUsernamePassword.checkPasswordh r r N)r r r r �bytes�__annotations__�boolr& r r r r( r( T s& � �� �O��O� �� �$� r r( c � � e Zd ZdZy)�
IAnonymouszs
I am an explicitly anonymous request for access.
@see: L{twisted.cred.checkers.AllowAnonymousAccess}
Nr r r r r0 r0 w s � �r r0 c �" � e Zd ZdZd� Zd� Zd� Zy)�DigestedCredentialsz?
Yet Another Simple HTTP Digest authentication scheme.
c �< � || _ || _ || _ || _ y �N)r) �method�realm�fields)�selfr) r5 r6 r7 s r �__init__z DigestedCredentials.__init__� s � � ��
� �� ���
� �� r c
�: � | j j d� }| j j d� }| j j d� }| j j d� }| j j d� }| j j dd� j � }| j j dd � }t t || j
| j |||� t || j ||d
� |||||� } | |k( S ) a
Verify that the credentials represented by this object agree with the
given plaintext C{password} by hashing C{password} in the same way the
response hash represented by this object was generated and comparing
the results.
�response�uri�nonce�cnonce�nc� algorithm� md5�qop� authN) r7 �get�lowerr
r r) r6 r r5 )
r8 r% r; r< r= r> r? �algorB �expecteds
r r& z!DigestedCredentials.checkPassword� s� � � �;�;�?�?�:�.���k�k�o�o�e�$��� � ����(����� � ��*��
�[�[�_�_�T�
"���{�{���{�F�3�9�9�;���k�k�o�o�e�W�-�� � �D�$�-�-����X�u�f� M� �D�$�+�+�s�C�� 6� � � � � �
�� �8�#�#r c � � | j j d� }| j j d� }| j j d� }| j j d� }| j j d� }| j j dd� j � }| j j dd � }t t |d
d
d
|||� � t || j ||d
� |||||� } | |k( S ) a4
Verify that the credentials represented by this object agree with the
credentials represented by the I{H(A1)} given in C{digestHash}.
@param digestHash: A precomputed H(A1) value based on the username,
realm, and password associate with this credentials object.
r; r< r= r> r? r@ rA rB rC N)�preHA1)r7 rD rE r
r r r5 )
r8 r r; r< r= r> r? rF rB rG s
r r z DigestedCredentials.checkHash� s� � � �;�;�?�?�:�.���k�k�o�o�e�$��� � ����(����� � ��*��
�[�[�_�_�T�
"���{�{���{�F�3�9�9�;���k�k�o�o�e�W�-�� � �D�$��d�E�6�*� M� �D�$�+�+�s�C�� 6� � � � � �
�� �8�#�#r N)r r r r r9 r& r r r r r2 r2 s � �� � $�6$r r2 c �f � e Zd ZdZ ej
d� ZdZdZd� Z d� Z
d� Z d� Z d � Z
d
� Zd � Zy )
�DigestCredentialFactoryar
Support for RFC2617 HTTP Digest Authentication
@cvar CHALLENGE_LIFETIME_SECS: The number of seconds for which an
opaque should be valid.
@type privateKey: L{bytes}
@ivar privateKey: A random string used for generating the secure opaque.
@type algorithm: L{bytes}
@param algorithm: Case insensitive string specifying the hash algorithm to
use. Must be either C{'md5'} or C{'sha'}. C{'md5-sess'} is B{not}
supported.
@type authenticationRealm: L{bytes}
@param authenticationRealm: case sensitive string that specifies the realm
portion of the challenge
s ([^= ]+)=(?:"([^"]*)"|([^,]+)),?i� s digestc �@ � || _ || _ t d� | _ y )N� )r@ �authenticationRealmr �
privateKey)r8 r@ rN s r r9 z DigestCredentialFactory.__init__� s � �"���#6�� �&�r�*��r c �~ � | j � }| j ||� }||d| j | j d�S )a
Generate the challenge for use in the WWW-Authenticate header.
@param address: The client address to which this challenge is being
sent.
@return: The L{dict} that can be used to generate a WWW-Authenticate
header.
rC )r= �opaquerB r@ r6 )�_generateNonce�_generateOpaquer@ rN )r8 �address�c�os r � getChallengez$DigestCredentialFactory.getChallenge� sI � �
� � � !�� � � ��G� ,�� ��� � � ��-�-�
�
r c �* � t t d� � S )z�
Create a random value suitable for use as the nonce parameter of a
WWW-Authenticate challenge.
@rtype: L{bytes}
rM )r r �r8 s r rR z&DigestCredentialFactory._generateNonce s � � �|�B�'�(�(r c �* � t j � S )z�
Parameterize the time based seed used in C{_generateOpaque}
so we can deterministically unittest it's behavior.
)�timerY s r �_getTimez DigestCredentialFactory._getTime s � �
�y�y�{�r c �~ � dt | j � � fz }|sd}n!t |t � r|j d� }dj |||f� }t
t || j z � j � � }t j |� }dj ||j dd� f� S )z�
Generate an opaque to be returned to the client. This is a unique
string that can be returned to us and verified.
s %dr �ascii� ,� -�
)
�intr\ �
isinstance�str�encode�joinr r rO �digest�base64� b64encode�replace)r8 r= �clientip�now�keyrg �ekeys r rS z'DigestCredentialFactory._generateOpaque s� � � �s�4�=�=�?�+�-�-����H�
��#�
&� ���w�/�H��i�i���#�.�/����S�4�?�?� 2�3�:�:�<�=��� � ��$���y�y�&�$�,�,�u�c�":�;�<�<r c �B � |j d� }t |� dk7 rt j d� �|sd}n!t |t
� r|j
d� }t j |d � }|j d� }t |� dk7 rt j d� �|d |k7 rt j d
� �|d |k7 rt j d � � t |d � }t | j � � |z
t j kD rt j d
� �t t || j z � j# � � }||d k7 rt j d� �y# t $ r t j d � �w xY w)a�
Given the opaque and nonce from the request, as well as the client IP
that made the request, verify that the opaque was generated by us.
And that it's not too old.
@param opaque: The opaque value from the Digest response
@param nonce: The nonce value from the Digest response
@param clientip: The remote IP address of the client making the request
or L{None} if the request was submitted over a channel where this
does not make sense.
@return: C{True} if the opaque was successfully verified.
@raise error.LoginFailed: if C{opaque} could not be parsed or
contained the wrong values.
r` � z&Invalid response, invalid opaque valuer r^ � r_ � r z2Invalid response, incompatible opaque/nonce valuesz3Invalid response, incompatible opaque/client valuesz,Invalid response, invalid opaque/time valuesz3Invalid response, incompatible opaque/nonce too oldT)�split�lenr � LoginFailedrc rd re rh � b64decoderb �
ValueErrorr\ rK �CHALLENGE_LIFETIME_SECSr r rO rg ) r8 rQ r= rk � opaquePartsrm �keyParts�whenrg s r �
_verifyOpaquez%DigestCredentialFactory._verifyOpaque# s� � �$ �l�l�4�(� � �{� �q� ��#�#�$L�M� M���H�
��#�
&� ���w�/�H� � � �{�1�~�.���9�9�T�?�� �x�=�A� ��#�#�$L�M� M� �A�;�%� ��#�#�D��
� �A�;�(� "��#�#�E��
� T��x��{�#�D�
��
�
�� �4� '�%�=�=�
>� �#�#�E��
�
��S�4�?�?� 2�3�:�:�<�=�� �[��^� #��#�#�$L�M� M���! � T��#�#�$R�S� S� T�s �"E? �? F c �8 � dj |j � � }| j j |� }i }|D ]6 \ }}}|xs |j � } | |t |j � � < �8 |j
d� }
|
st j d� �d|vrt j d� �d|vrt j d� �| j |j
d� |j
d� |� rt |
|| j |� S y) a�
Decode the given response and attempt to generate a
L{DigestedCredentials} from it.
@type response: L{bytes}
@param response: A string of comma separated key=value pairs
@type method: L{bytes}
@param method: The action requested to which this response is addressed
(GET, POST, INVITE, OPTIONS, etc).
@type host: L{bytes}
@param host: The address the request was sent from.
@raise error.LoginFailed: If the response does not contain a username,
a nonce, an opaque, or if the opaque is invalid.
@return: L{DigestedCredentials}
� r) z$Invalid response, no username given.rQ z"Invalid response, no opaque given.r= z!Invalid response, no nonce given.N) rf �
splitlines� _parseparts�findall�stripr rD r ru r| r2 rN ) r8 r; r5 �host�parts�authrm �bare�quoted�valuer) s r �decodez DigestCredentialFactory.decodec s � �( �9�9�X� 0� 0� 2�3��� � �(�(��2����!&� 4� �C��v��^�t�*�*�,�E�.3�D� �c�i�i�k�*� +� 4� �8�8�J�'����#�#�$J�K� K� �4� ��#�#�$H�I� I� �$� ��#�#�$G�H� H� � � �d�h�h�x� 0�$�(�(�7�2C�T� J�&�x���9Q�9Q�SW�X� X� Kr N)r r r r �re�compiler� rx �schemer9 rW rR r\ rS r| r� r r r rK rK � sP � ��& �"�*�*� � �K� &��
�F�+�
�*)��=�&>�@'Yr rK c �< � e Zd ZdZdZdZdZd d�Zd� Zd� Z d� Z
d� Z y)
�CramMD5Credentialsas
An encapsulation of some CramMD5 hashed credentials.
@ivar challenge: The challenge to be sent to the client.
@type challenge: L{bytes}
@ivar response: The hashed response from the client.
@type response: L{bytes}
@ivar username: The username from the response from the client.
@type username: L{bytes} or L{None} if not yet provided.
Nr c � � || _ y r4 )r� )r8 r� s r r9 zCramMD5Credentials.__init__� s � ��� r c �
� | j r | j S t j d� }t j � }t d||| j
rt
| j
� nd fz � | _ | j S )Ni���z
<%d.%d@%s>)� challenge�random� randranger[ r r� r )r8 �r�ts r rW z CramMD5Credentials.getChallenge� sh � � �>�>��>�>� !�
� � �Z� (�� �I�I�K��&� �A�q�T�Y�Y�,�t�y�y�"9�D�Q� Q�
��� �~�~� r c �B � |j d d� \ | _ | _ y )Nrq )rs r) r; )r8 r; s r � setResponsez CramMD5Credentials.setResponse� s � �'/�~�~�d�A�'>�$��
�t�}r c � � y)NFr rY s r �moreChallengesz!CramMD5Credentials.moreChallenges� s � �r c � � t t j || j t �� j � � }|| j k( S )N)� digestmod)r �hmac�HMACr� r rg r; )r8 r% �verifys r r& z CramMD5Credentials.checkPassword� s5 � �����8�T�^�^�s�K�R�R�T�U���� � �&�&r r4 ) r r r r r) r� r; r9 rW r� r� r& r r r r� r� � s1 � � � �H��I��H�� � ?��'r r� c �@ � e Zd Z e edddd� ddd � d� Zd� Zy )
�UsernameHashedPassword�Twisted� rp r z6Use twisted.cred.credentials.UsernamePassword instead.ztwisted.cred.credentialsc � � || _ || _ y r4 )r) �hashed)r8 r) r� s r r9 z UsernameHashedPassword.__init__� s � � ��
� �� r c � � | j |k( S r4 )r� �r8 r% s r r& z$UsernameHashedPassword.checkPassword� s � ��{�{�h�&�&r N)r r r r
r r9 r& r r r r� r� � s+ � � �� �2�q�!�$�@�"� � � �'r r� c �0 � e Zd Zdededdfd�Zdedefd�Zy)�UsernamePasswordr) r% r* Nc � � || _ || _ y r4 )r) r% )r8 r) r% s r r9 zUsernamePassword.__init__� s � � ��
� ��
r c � � | j |k( S r4 r$ r� s r r& z UsernamePassword.checkPassword� s � ��}�}��(�(r )r r r r, r9 r. r& r r r r� r� � s/ � �!�� !�%� !�D� !�)�e� )�� )r r� c � � e Zd Zy)� AnonymousN)r r r r r r r� r� � s � �r r� c � � e Zd ZdZy)�ISSHPrivateKeyaj
L{ISSHPrivateKey} credentials encapsulate an SSH public key to be checked
against a user's private key.
@ivar username: The username associated with these credentials.
@type username: L{bytes}
@ivar algName: The algorithm name for the blob.
@type algName: L{bytes}
@ivar blob: The public key blob as sent by the client.
@type blob: L{bytes}
@ivar sigData: The data the signature was made from.
@type sigData: L{bytes}
@ivar signature: The signed data. This is checked to verify that the user
owns the private key.
@type signature: L{bytes} or L{None}
Nr r r r r� r� � s � �r r� c � � e Zd Zd� Zy)�
SSHPrivateKeyc �J � || _ || _ || _ || _ || _ y r4 )r) �algName�blob�sigData� signature)r8 r) r� r� r� r� s r r9 zSSHPrivateKey.__init__� s% � � ��
� �� ��� � �� �"��r N)r r r r9 r r r r� r� � s � �#r r� ))r rh r� r� r� r[ �binasciir �hashlibr �zope.interfacer r � twisted.credr �twisted.cred._digestr r r
�twisted.python.compatr r �twisted.python.deprecater
�twisted.python.randbytesr �twisted.python.versionsr r r r! r( r0 r2 rK r� r� r� r� r� r� r r r �<module>r� sQ ��
� � �
� � � � � 1� � ?� ?� =� >� 1� +��9� �
�,�
� �l� �: � � �F� � �
�
$�&9�:�@$� @$� ;�@$�FGY� GY�T
�
$�%�-'� -'� &�-'�`
�
$�%�
'�
'� &�
'�
�
� �)� )� �)�
�Z�� � � � ��\� �.
�^� �#� #� �#r |