3

�O[�J�@s�dd
lZddl
mZ
ddl
mZ
ddl
mZ
ddlm	Z	m
Z

dd
ljZ
ddlmZ
ddlmZ
ddlmZ
ejej�
Gd	d
�d
ej��
Zd
S)�N)
�sec_contexts)
�message)
�named_tuples)�RequirementFlag�IntEnumFlagSet)
�_utils)
�Name)
�Credentialsc	s
eZ
dZd
Zd6�f
dd�	Zd7dd�
Zdd�Zd	d
�Zdd�Zd
d�Z	dd�Z
dd�Zd8dd�
Zdd�Z
dd�Zd9Zejd!d"��
Zed#d$��
Zed%d&��
Zejdd'�Zejdd(�Zejdd)�Zejdd*�Zejdd+�Zeejd,d-��
�
Zejd:d.d/�
�
Zd0d1�Zd;d2d3�
Z d4d5�Z!�Z"S)<�SecurityContexta�
A GSSAPI Security Context

    This class represents a GSSAPI security context that may be used
    with and/or returned by other GSSAPI methods.

    It inherits from the low-level GSSAPI
    :class:`~gssapi.raw.sec_contexts.SecurityContext` class,
    and thus may used with both low-level and high-level API methods.

    This class may be pickled and unpickled (the attached delegated
    credentials object will not be preserved, however).
    Nc

s$|dk	rtj
|�
}
tt|�j||
�S)
N)�
rsec_contextsZimport_sec_context�superr
�__new__)
�cls�base�token�name�creds�lifetime�flags�mech�channel_bindings�usage)
�	__class__��$/usr/lib64/python3.6/sec_contexts.pyr
s

zSecurityContext.__new__c
Cs6
d
|_|
d
kr�|d
kr�|	d
k	r@|	dkr8d}
t
j|
dd��
|	|_n2|d
k	r\|jdkr\|j|_n|d
k	rld|_nd|_|jdkr�|d
kr�td�
�
||_||_tt|�|_	||_
n(|d
k	s�|d
k	s�|d
k	s�|d
k	r�td	�
�
||_||_d
|_
nDy|jr�d|_nd|_Wn*t
jk
�
r*


d
}
t
j|
dd��
YnXd
|_d
S)a
        The constructor creates a new security context, but does not begin
        the initiate or accept process.

        If the `base` argument is used, an existing
        :class:`~gssapi.raw.sec_contexts.SecurityContext` object from
        the low-level API is converted into a high-level object.

        If the `token` argument is passed, the security context is imported
        using the token.

        Otherwise, a new security context is created.

        If the `usage` argument is not passed, the constructor will attempt
        to detect what the appropriate usage is based on either the existing
        security context (if `base` or `token` are used) or the argument set.

        For a security context of the `initiate` usage, the `name` argument
        must be used, and the `creds`, `mech`, `flags`,
        `lifetime`, and `channel_bindings` arguments may be
        used as well.

        For a security context of the `accept` usage, the `creds` and
        `channel_bindings` arguments may optionally be used.
        N�initiate�acceptz+Usage must be either 'initiate' or 'accept'zsecurity context)
�objZbothzNYou must pass the 'name' argument when creating an initiating security contextzVYou must pass at most the 'creds' argument when creating an accepting security contextz7Cannot extract usage from a partially completed context)rr)Z	_last_err�excsZUnknownUsageErrorr�	TypeError�_target_name�_mechrr�_desired_flags�_desired_lifetime�_channel_bindings�_creds�_delegated_creds�locally_initiated�MissingContextError�	_complete)�selfrrrrrrrrr�msgrrr�__init__&sB



















zSecurityContext.__init__cCstj
||
�S)
aBCalculate the signature for a message.

        This method calculates the signature (called a MIC) for
        the given message, which may be then used with
        :meth:`verify_signature` to confirm the validity of the
        signature.  This is useful if you wish to transmit the
        message signature and message in your own format.

        Args:
            message (bytes): the input message

        Returns:
            bytes: the message signature

        Raises:
            ExpiredContextError
            MissingContextError
            BadQoPError
        )�rmessageZget_mic)r*rrrr�
get_signature�szSecurityContext.get_signaturecCstj
||
|�S)
a�Verify the signature for a message.

        This method verifies that a signature (generated by
        :meth:`get_signature` is valid for the given message.

        If the signature is valid, the method will return.
        Otherwise, it will raise an error.

        Args:
            message (bytes): the message
            mic (bytes): the signature to verify

        Raises:
            BadMICError: the signature was not valid
            InvalidTokenError
            DuplicateTokenError
            ExpiredTokenError
            TokenTooLateError
            TokenTooEarlyError
            ExpiredContextError
            MissingContextError
        )r-Z
verify_mic)r*rZmicrrr�verify_signature�sz SecurityContext.verify_signaturecCstj
||
|�S)
aWrap a message, optionally with encryption

        This wraps a message, signing it and optionally
        encrypting it.

        Args:
            message (bytes): the message to wrap
            encrypt (bool): whether or not to encrypt the message

        Returns:
            WrapResult: the wrapped message and details about it
                (e.g. whether encryption was used succesfully)

        Raises:
            ExpiredContextError
            MissingContextError
            BadQoPError
        )r-�wrap)r*r�encryptrrrr0�szSecurityContext.wrapcCstj
||
�S)
aaUnwrap a wrapped message.

        This method unwraps/unencrypts a wrapped message,
        verifying the signature along the way.

        Args:
            message (bytes): the message to unwrap/decrypt

        Returns:
            UnwrapResult: the unwrapped message and details about it
                (e.g. wheter encryption was used)

        Raises:
            InvalidTokenError
            BadMICError
            DuplicateTokenError
            ExpiredTokenError
            TokenTooLateError
            TokenTooEarlyError
            ExpiredContextError
            MissingContextError
        )r-�unwrap)r*rrrrr2�szSecurityContext.unwrapcCs$|j|
d
d�}|j
stjd�
�
|jS)amEncrypt a message.

        This method wraps and encrypts a message, similarly to
        :meth:`wrap`.  The difference is that encryption is always
        used, and the method will raise an exception if this is
        not possible.  Additionally, this method simply returns
        the encrypted message directly.

        Args:
            message (bytes): the message to encrypt

        Returns:
            bytes: the encrypted message

        Raises:
            EncryptionNotUsed: the encryption could not be used
            ExpiredContextError
            MissingContextError
            BadQoPError
        T)
r1z!Wrapped message was not encrypted)r0�	encryptedr�EncryptionNotUsedr)r*r�resrrrr1�s

zSecurityContext.encryptcCs4|j|
�
}|j
r.|jtj@r.tjd
|jd��
|jS)a"Decrypt a message.

        This method decrypts and unwraps a message, verifying the signature
        along the way, similarly to :meth:`unwrap`.  The difference is that
        this method will raise an exception if encryption was established
        by the context and not used, and simply returns the decrypted
        message directly.

        Args:
            message (bytes): the encrypted message

        Returns:
            bytes: the decrypted message

        Raises:
            EncryptionNotUsed: encryption was expected, but not used
            InvalidTokenError
            BadMICError
            DuplicateTokenError
            ExpiredTokenError
            TokenTooLateError
            TokenTooEarlyError
            ExpiredContextError
            MissingContextError
        zTThe context was established with encryption, but unwrapped message was not encrypted)
Zunwrapped_message)r2r3�actual_flagsrZconfidentialityrr4r)r*rr5rrr�decrypt
s



zSecurityContext.decryptTcCstj
||
|�S)
a.Calculate the maximum message size for a given wrapped message size.

        This method calculates the maximum input message size for a given
        maximum wrapped/encrypted message size.

        Args:
            desired_output_size (int): the maximum output message size
            encrypted (bool): whether or not encryption should be taken
                into account

        Returns:
            int: the maximum input message size

        Raises:
            MissingContextError
            ExpiredContextError
            BadQoPError
        )r-Zwrap_size_limit)r*Zdesired_output_sizer3rrr�get_wrap_size_limit,
s
z#SecurityContext.get_wrap_size_limitcCstj
||
�
d
S)ac
Process an output token asynchronously.

        This method processes an output token even when the security context
        was not expecting it.

        Warning:
            This method is deprecated.

        Args:
            token (bytes): the token to process

        Raises:
            InvalidTokenError
            MissingContextError
        N)rZprocess_context_token)r*rrrr�
process_tokenD
szSecurityContext.process_tokenc

Cs
tj
|�
S)
aB
Export a security context.

        This method exports a security context, allowing it to be passed
        between processes.

        Returns:
            bytes: the exported security context

        Raises:
            ExpiredContextError
            MissingContextError
            OperationUnavailableError
        )rZexport_sec_context)
r*rrr�exportW
szSecurityContext.export�initiator_name�target_namerrr�locally_init�completec
Ks�|
s
d
}nd}x|jD]}|
j
||�|
|<qWtj|f
|
�
}|
j
dd�r^|jdk	r^t|j�
}nd}|
j
dd�r�|jdk	r�t|j�
}nd}tj|||j	|j
|j|j|j
�S)aInspect the security context for information

        This method inspects the security context for information.

        If no keyword arguments are passed, all available information
        is returned.  Otherwise, only the keyword arguments that
        are passed and set to `True` are returned.

        Args:
            initiator_name (bool): get the initiator name for this context
            target_name (bool): get the target name for this context
            lifetime (bool): get the remaining lifetime for this context
            mech (bool): get the :class:`MechType` used by this context
            flags (bool): get the flags set on this context
            locally_init (bool): get whether this context was locally initiated
            complete (bool): get whether negotiation on this context has
                been completed

        Returns:
            InquireContextResult: the results of the inquiry, with unused
                fields set to None

        Raises:
            MissingContextError
        TFr;Nr<)�
_INQUIRE_ARGS�getrZinquire_contextr;rr<�tuplesZInquireContextResultrrrr=r>)r*�kwargsZdefault_val�argr5Z	init_namer<rrr�_inquirek
s$










zSecurityContext._inquirec

Cs
tj
|�
S)
z7The amount of time for which this context remains valid)rZcontext_time)
r*rrrr�
szSecurityContext.lifetimec


Cs|jS)
z�The credentials delegated from the initiator to the acceptor

        .. warning::

            This value will not be preserved across picklings.  These should
            be separately exported and transfered.

        )
r&)
r*rrr�delegated_creds�
s
zSecurityContext.delegated_credsz2The :class:`Name` of the initiator of this contextz/The :class:`Name` of the target of this contextz8The mechanism (:class:`MechType`) in use by this contextzThe flags set on this contextz)Whether this context was locally intiatedc
CsN|jrF|j
d
kr@y|jdd�
j}
Wntjk
r8


dSX|
|_
|j
SdSd
S)z7Whether negotiation for this context has been completedNT)
r>F)Z_startedr)rDr>rr()r*r5rrrr>�
s





zSecurityContext.completecCs&|jd
kr|j
|
d�
S|j|
d�
SdS)a
Perform a negotation step.

        This method performs a negotiation step based on the usage type
        of this context.  If `__DEFER_STEP_ERRORS__` is set to True on
        the class, this method will return a token, even when exceptions
        would be thrown.  The generated exception will be thrown on the next
        method call or property lookup on the context.
        **This is the default behavior.**

        This method should be used in a while loop, as such:

        .. code-block:: python

           input_token = None
           try:
               while not ctx.complete:
                   output_token = ctx.step(input_token)
                   input_token = send_and_receive(output_token)
           except GSSError as e:
                handle_the_issue()

        .. tip::

            Disabling `__DEFER_STEP_ERRORS__` is rarely necessary.
            When this method is used in a loop (as above),
            `__DEFER_STEP_ERRORS__` will ensure that you always
            send an error token when it's available,
            keeping the other end of the security context updated
            with the status of the negotiation.

        Args:
            token (bytes): the input token from the other participant's step

        Returns:
            bytes: the output token to send to the other participant

        Raises:
            InvalidTokenError
            InvalidCredentialsError
            MissingCredentialsError
            ExpiredCredentialsError
            BadChannelBindingsError
            BadMICError
            ExpiredTokenError: (initiate only)
            DuplicateTokenError
            MissingContextError
            BadNameTypeError: (initiate only)
            BadNameError: (initiate only)
            BadMechanismError
        r)
rN)r�_acceptor_step�_initiator_step)r*rrrr�step�
s5

zSecurityContext.stepcCsBtj
|
|j||j�}|jdk	r,t|j�
|_nd|_|j|_|j	S)
N)
rZaccept_sec_contextr%r$rEr	r&�
more_stepsr)r)r*rr5rrrrFs






zSecurityContext._acceptor_stepc	Cs4tj
|j|j||j|j|j|j|
�}|j|_	|j
S)
N)rZinit_sec_contextr r%r!r"r#r$rIr)r)r*rr5rrrrGs






zSecurityContext._initiator_stepc

Cst|�
d|j
�ffS)
N)�typer:)
r*rrr�
__reduce__%szSecurityContext.__reduce__)	NNNNNNNNN)	NNNNNNNNN)
T)r;r<rrrr=r>)
N)
N)#�__name__�
__module__�__qualname__�__doc__r
r,r.r/r0r2r1r7r8r9r:r?rZcheck_last_errrD�propertyrrEZinquire_propertyr;r<rr6r'r>Zcatch_and_return_tokenrHrFrGrK�
__classcell__rr)
rrr
sL





_'

6










9

r
)ZsixZ
gssapi.rawrrrr-rrAZgssapi.raw.typesrrZgssapi.exceptions�
exceptionsrZgssapirZgssapi.namesrZgssapi.credsr	Z
add_metaclassZCheckLastErrorr
rrrr�<module>
s