o þÑÐb}fã@sdZddlmZmZddlmZmZddlZddlZddl Z ddl m Z ddl m Z zddlZWndZYddlmZdd lmZmZe e¡ZGd d „d eƒZGd d „d eƒZGdd„deƒZGdd„deƒZGdd„deƒZGdd„deƒZdd„Z dS)z5Implementing support for MySQL Authentication Pluginsé)Ú b64encodeÚ b64decode)Úsha1Úsha256N)Úquote)Úuuid4é)Úerrors)Únormalize_unicode_stringÚ"validate_normalized_unicode_stringc@s6eZdZdZdZdZ  d dd„Zdd„Zd d „ZdS) ÚBaseAuthPluginaÉBase class for authentication plugins Classes inheriting from BaseAuthPlugin should implement the method prepare_password(). When instantiating, auth_data argument is required. The username, password and database are optional. The ssl_enabled argument can be used to tell the plugin whether SSL is active or not. The method auth_response() method is used to retrieve the password which was prepared by prepare_password(). FÚNcCs"||_||_||_||_||_dS)ZInitializationN)Ú _auth_dataÚ _usernameÚ _passwordZ _databaseÚ _ssl_enabled)ÚselfÚ auth_dataÚusernameÚpasswordZdatabaseZ ssl_enabledÚinstance©rú]/var/www/secure340b-portal/env/lib/python3.10/site-packages/mysql/connector/authentication.pyÚ__init__Es  zBaseAuthPlugin.__init__cCst‚)zåPrepares and returns password to be send to MySQL This method needs to be implemented by classes inheriting from this class. It is used by the auth_response() method. Raises NotImplementedError. )ÚNotImplementedError©rrrrÚprepare_passwordNszBaseAuthPlugin.prepare_passwordcCs(|jr|jst dj|jd¡‚| ¡S)z°Returns the prepared password to send to MySQL Raises InterfaceError on errors. For example, when SSL is required by not enabled. Returns str ú{name} requires SSL©Úname)Ú requires_sslrr ÚInterfaceErrorÚformatÚ plugin_namerrrrrÚ auth_responseXs ÿzBaseAuthPlugin.auth_response)NNNFN) Ú__name__Ú __module__Ú __qualname__Ú__doc__r r#rrr$rrrrr 4s  ÿ r c@ó eZdZdZdZdZdd„ZdS)ÚMySQLNativePasswordAuthPluginzBClass implementing the MySQL Native Password authentication pluginFZmysql_native_passwordc CsÈ|jst d¡‚|js dS|j}t|jtƒr|j d¡}n|j}|j}d}z*t|ƒ ¡}t|ƒ ¡}t||ƒ ¡}dd„t ||ƒDƒ}t j dg|¢RŽ}W|St yc}zt d  |¡¡‚d}~ww) z;Prepares and returns password as native MySQL 4.1+ passwordú"Missing authentication data (seed)óúutf-8NcSóg|]\}}||A‘qSrr)Ú.0Úh1Úh3rrrÚ ózBMySQLNativePasswordAuthPlugin.prepare_password..Z20BzFailed scrambling password; {0})rr r!rÚ isinstanceÚstrÚencoderÚdigestÚzipÚstructÚpackÚ Exceptionr") rrrZhash4Úhash1Úhash2Úhash3ÚxoredÚexcrrrrls.    üÿ€ÿz.MySQLNativePasswordAuthPlugin.prepare_passwordN©r%r&r'r(r r#rrrrrr*fó  r*c@r))ÚMySQLClearPasswordAuthPluginzAClass implementing the MySQL Clear Password authentication pluginTZmysql_clear_passwordcCó,|jsdS|j}t|tƒr| d¡}|dS©ú!Returns password as as clear textóÚutf8©rr4r5r6©rrrrrró   z-MySQLClearPasswordAuthPlugin.prepare_passwordNrArrrrrCŠrBrCc@r))ÚMySQLSHA256PasswordAuthPluginzÆClass implementing the MySQL SHA256 authentication plugin Note that encrypting using RSA is not supported since the Python Standard Library does not provide this OpenSSL functionality. TZsha256_passwordcCrDrErIrJrrrr¦rKz.MySQLSHA256PasswordAuthPlugin.prepare_passwordNrArrrrrLœs  rLc@s8eZdZdZdZdZdZdZdd„Zdd „Z d d „Z d S) Ú"MySQLCachingSHA2PasswordAuthPluginzÕClass implementing the MySQL caching_sha2_password authentication plugin Note that encrypting using RSA is not supported since the Python Standard Library does not provide this OpenSSL functionality. FZcaching_sha2_passwordéécCsž|jst d¡‚|js dSt|jtƒr|j d¡n|j}|j}t|ƒ ¡}tƒ}|  t|ƒ ¡¡|  |¡| ¡}dd„t ||ƒDƒ}t j dg|¢RŽ}|S)z» Returns a scramble of the password using a Nonce sent by the server. The scramble is of the form: XOR(SHA2(password), SHA2(SHA2(SHA2(password)), Nonce)) r+r,r-cSr.rr)r/r0Úh2rrrr2Ór3z@MySQLCachingSHA2PasswordAuthPlugin._scramble..Z32B) rr r!rr4r5r6rr7Úupdater8r9r:)rrrr<r=r?r>rrrÚ _scramble½s"  ÿÿ  z,MySQLCachingSHA2PasswordAuthPlugin._scramblecCs2t|jƒdkr | ¡S|jd|jkr| ¡SdS)Nrr)ÚlenrrRÚperform_full_authenticationÚ_full_authenticationrrrrrØs z3MySQLCachingSHA2PasswordAuthPlugin.prepare_passwordcCsF|js t dj|jd¡‚|jsdS|j}t|tƒr| d¡}|dS)rFrrrGrH) rr r!r"r#rr4r5r6rJrrrrUßsÿ  z7MySQLCachingSHA2PasswordAuthPlugin._full_authenticationN) r%r&r'r(r r#rTZfast_auth_successrRrrUrrrrrM²s rMc@s®eZdZdZgd¢ZdZdZeZdZ dZ dZ dZ dZ dZdd„Zd d „Zd d „Zd d„Zdd„Zdd„Zdd„Zdd„Zd#dd„Zdd„Zdd„Zdd„Zdd „Zd!d"„ZdS)$ÚMySQLLdapSaslPasswordAuthPlugina5Class implementing the MySQL ldap sasl authentication plugin. The MySQL's ldap sasl authentication plugin support two authentication methods SCRAM-SHA-1 and GSSAPI (using Kerberos). This implementation only support SCRAM-SHA-1 and SCRAM-SHA-256. SCRAM-SHA-1 amd SCRAM-SHA-256 This method requires 2 messages from client and 2 responses from server. The first message from client will be generated by prepare_password(), after receive the response from the server, it is required that this response is passed back to auth_continue() which will return the second message from the client. After send this second message to the server, the second server respond needs to be passed to auth_finalize() to finish the authentication process. )z SCRAM-SHA-1z SCRAM-SHA-256ZGSSAPIFZauthentication_ldap_sasl_clientNrcCstdd„t||ƒDƒƒS)NcSr.rr)r/Úb1Úb2rrrr2 r3z8MySQLLdapSaslPasswordAuthPlugin._xor..)Úbytesr8)rZbytes1Zbytes2rrrÚ_xor sz$MySQLLdapSaslPasswordAuthPlugin._xorcCst |||j¡}| ¡S©N)ÚhmacÚnewÚdef_digest_moder7)rrÚsaltZ digest_makerrrrÚ_hmacsz%MySQLLdapSaslPasswordAuthPlugin._hmaccCsJ| ¡}| ||d¡}|}t|dƒD]}| ||¡}| ||¡}q|S)zŽPrepares Hi Hi(password, salt, iterations) where Hi(p,s,i) is defined as PBKDF2 (HMAC, p, s, i, output length of H). sr)r6r`ÚrangerZ)rrr_ÚcountÚpwÚhiZauxÚ_rrrÚ_his z#MySQLLdapSaslPasswordAuthPlugin._hicCs,t|ƒ}t|ƒ}|durt d |¡¡‚|S)Nzbroken_rule: {})Ú norm_ustrÚ valid_normr r!r")rÚstringZnorm_strZ broken_ruleÚcharÚrulerrrÚ _normalize!s z*MySQLLdapSaslPasswordAuthPlugin._normalizecCsHd}ttƒƒ dd¡|_|j| |j¡|jd}t|tƒr"| d¡}|S)aqThis method generates the first message to the server to start the The client-first message consists of a gs2-header, the desired username, and a randomly generated client nonce cnonce. The first message from the server has the form: b'n,a=,n=,r= Returns client's first message z.n,a={user_name},n={user_name},r={client_nonce}ú-r )Ú user_nameÚ client_noncerH) r5rÚreplaceror"rlrr4r6)rZ cfm_fprnatÚcfmrrrÚ_first_message,s ÿ  z.MySQLLdapSaslPasswordAuthPlugin._first_messagec Cs t d|j¡tjjj|j d¡tjj d}z3t  ¡}t d¡z|j Wn"tjj j yG}zt d|¡| |¡t d |¡¡‚d}~wwWn\tjjjy¥}zM|jset d|¡t d  |¡¡‚zt d ¡tjj||j d¡d d }|d }Wntjjjyš}zt d|¡t d |¡¡‚d}~wwWYd}~nd}~wwtjjtjjtjjf}|jr¸|j}nd}t d|¡tj|tjjd}||_ tj!||t"|ƒd d|_#z|j# $¡}Wntjjjyü}zt d|¡t d |¡¡‚d}~wwt d|¡|S)z–Get a TGT Authentication request and initiates security context. This method will contact the Kerberos KDC in order of obtain a TGT. z# user name: %srH)Z name_typezE# Stored credentials found, if password was given it will be ignored.z Credentials has expired: %szCredentials has expired: {}Nz* Unable to retrieve stored credentials: %sz/Unable to retrieve stored credentials error: {}z5# Attempt to retrieve credentials with given passwordZinitiate)Úusagerz; Unable to retrieve credentials with the given password: %sz:Unable to retrieve credentials with the given password: {}z ldap/ldapauthz# service principal: %s)rÚcredsÚflagsrsz'Unable to initiate security context: %sz'Unable to initiate security context: {}z# initial client token: %s)%Ú_LOGGERÚdebugrÚgssapiÚrawÚnamesÚ import_namer6ZNameTypeÚuserÚ CredentialsZlifetimeÚ exceptionsZExpiredCredentialsErrorÚwarningÚacquirer r!r"ÚmiscZGSSErrorrÚerrorZacquire_cred_with_passwordÚProgrammingErrorZRequirementFlagZmutual_authenticationZextended_errorZdelegate_to_peerÚkrb_service_principalÚNameZkerberos_principalÚ target_nameZSecurityContextÚsumÚctxÚstep) rrnÚcredÚerrZacquire_cred_resultZflags_lZservice_principalZservkZinitial_client_tokenrrrÚ_first_message_krb@s‚ÿ    €ýÿ ÿ ÿ ÿþ€ý ÿ€õþ ý €þ z2MySQLLdapSaslPasswordAuthPlugin._first_message_krbcCs@t d|¡|j |¡}t d|¡t d|jj¡||jjfS)a Continue with the Kerberos TGT service request. With the TGT authentication service given response generate a TGT service request. This method must be invoked sequentially (in a loop) until the security context is completed and an empty response needs to be send to acknowledge the server. Args: tgt_auth_challenge the challenge for the negotiation. Returns: tuple (bytearray TGS service request, bool True if context is completed otherwise False). ztgt_auth challenge: %sz# context step response: %sz# context completed?: %s)rvrwrˆr‰Úcomplete)rZtgt_auth_challengeÚresprrrÚauth_continue_krb„s    z1MySQLLdapSaslPasswordAuthPlugin.auth_continue_krbc CsÖ|jjs t d¡‚t d|¡t d|jj¡z|j |¡}t d|¡Wntj j j yB}zt d|¡t  d  |¡¡‚d}~wwt d|¡td ƒ}t d |¡|jj|d d }t d |dt|dƒ¡|jS)aPAccept handshake and generate closing handshake message for server. This method verifies the server authenticity from the given message and included signature and generates the closing handshake for the server. When this method is invoked the security context is already established and the client and server can send GSSAPI formated secure messages. To finish the authentication handshake the server sends a message with the security layer availability and the maximum buffer size. Since the connector only uses the GSSAPI authentication mechanism to authenticate the user with the server, the server will verify clients message signature and terminate the GSSAPI authentication and send two messages; an authentication acceptance b'' and a OK packet (that must be received after sent the returned message from this method). Args: message a wrapped hssapi message from the server. Returns: bytearray closing handshake message to be send to the server. z"Security context is not completed.z# servers message: %sz# GSSAPI flags in use: %sz# unwraped: %sz#Unable to unwrap server message: %sz#Unable to unwrap server message: {}Nz# unwrapped server message: %ssz# message response: %sF)Zencryptz*# wrapped message response: %s, length: %dr)rˆrr rƒrvrwZ actual_flagsÚunwraprxryr~Z BadMICErrorr!r"Ú bytearrayÚwraprSÚmessage)rr“Zunwrapedr‹ÚresponseZwrapedrrrÚauth_accept_close_handshakešs,    ÿ€þ  ÿz;MySQLLdapSaslPasswordAuthPlugin.auth_accept_close_handshakec Csˆ|j ¡}||_t d|¡||jvr(t d |d  |jdd…¡|jd¡¡‚d|jvr8t s4t  d¡‚|  ¡S|jdkr@t |_| ¡S) z„This method will prepare the fist message to the server. Returns bytes to send to the server as the first message. z read_method_name_from_server: %szpThe sasl authentication method "{}" requested from the server is not supported. Only "{}" and "{}" are supportedz", "NéÿÿÿÿsGSSAPIzwModule gssapi is required for GSSAPI authentication mechanism but was not found. Unable to authenticate with the servers SCRAM-SHA-256)rÚdecoder„rvrwÚsasl_mechanismsr r!r"ÚjoinrxrƒrŒrr^rr)rr„Zauth_mechanismrrrr$Ís(   þþ ÿ z-MySQLLdapSaslPasswordAuthPlugin.auth_responsec Csê|jst d¡‚| |j¡}| |t|jƒ|j¡}t   dt |ƒ  ¡¡|  |d¡}t   dt |ƒ  ¡¡| |¡ ¡}t   dt |ƒ  ¡¡|  |d¡}t   dt |ƒ  ¡¡d d  | |j¡¡d  |j¡g¡}t   d |¡d ||jd  t d  | |j¡¡ ¡ƒ  ¡¡d  |j¡g¡}t   d|¡|  || ¡¡}t   dt |ƒ  ¡¡| ||¡} t   dt | ƒ  ¡¡t |  || ¡¡ƒ  ¡|_t   d|j¡t d  | |j¡¡ ¡ƒ  ¡} d d  | ¡d  |j¡d t | ƒ  ¡¡g¡} t   d| ¡|  ¡S)a¥This method generates the second message to the server Second message consist on the concatenation of the client and the server nonce, and cproof. c=>,r=,p= where: : xor(, ) : hmac(salted_password, b"Client Key") : hmac(, ) : h() : ,, c=,r= : n=r= r+zsalted_password: %ss Client Keyzclient_key: %szstored_key: %ss Server Keyzserver_key: %sú,zn={}zr={}zclient_first_no_header: %szc={}zn,a={},z auth_msg: %szclient_signature: %szclient_proof: %szserver_auth_var: %szp={}zsecond_message: %s)rr r!rlrrfrÚ server_saltÚ iterationsrvrwrr—r`r^r7r™r"rroÚ servers_firstr6Ú server_noncerZÚserver_auth_var) rZpasswZsalted_passwordZ client_keyZ stored_keyZ server_keyZclient_first_no_headerZauth_msgZclient_signatureZ client_proofZ client_headerÚmsgrrrÚ_second_messageésr  þ ÿ   þ   ÿÿÿ û  ÿ ÿÿÿÿ  þ z/MySQLLdapSaslPasswordAuthPlugin._second_messagecCs2|r t|ttfƒst d |¡¡‚z| ¡}||_| d¡\}}}Wnt y1t d |¡¡‚w|  d¡rA|  d¡rA|  d¡sIt d |¡¡‚|j |vr]|dd…|_ t  d |j ¡nt d  |¡¡‚|dd…|_t  d |jt|jƒ¡z|dd…}t  d  |¡¡t|ƒ|_WdSt d  |¡¡‚)zâValidates first message from the server. Extracts the server's salt and iterations from the servers 1st response. First message from the server is in the form: ,i= zUnexpected server message: {}ršzr=zs=zi=z&Incomplete reponse from the server: {}éNzserver_nonce: %sz, ) where: : hmac(, b"Server Key") : ,, c=,r= Our server_proof must be equal to the Auth variable send on this second response. r¢sv=z(The server's proof is not well formated.Nzserver auth variable: %s) r4r‘rSr¥r r!r—rvrwrŸ)rZservers_secondZ server_varrrrÚ_validate_second_reponse]s ÿÿ   z8MySQLLdapSaslPasswordAuthPlugin._validate_second_reponsecCs| |¡s t d¡‚dS)zÁfinalize the authentication process. Raises errors.InterfaceError if the ervers_second_response is invalid. Returns True in succesfull authentication False otherwise. z7Authentication failed: Unable to proof server identity.T)r©r r!)rZservers_second_responserrrÚ auth_finalizets  z-MySQLLdapSaslPasswordAuthPlugin.auth_finalizer[)r%r&r'r(r˜r r#rr^roZ client_saltr›r„rœrŸrZr`rfrlrrrŒrr•r$r¡r§r¨r©rªrrrrrVïs4 D 3D( rVcCs0t ¡D] }|j|kr|Sqt d |¡¡‚)a.Return authentication class based on plugin name This function returns the class for the authentication plugin plugin_name. The returned class is a subclass of BaseAuthPlugin. Raises errors.NotSupportedError when plugin_name is not supported. Returns subclass of BaseAuthPlugin. z,Authentication plugin '{0}' is not supported)r Ú__subclasses__r#r ZNotSupportedErrorr")r#Z authclassrrrÚget_auth_plugins ÿÿr¬)!r(Úbase64rrÚhashlibrrr\Úloggingr9Ú urllib.parserÚuuidrrxr r Úutilsr rgr rhÚ getLoggerr%rvÚobjectr r*rCrLrMrVr¬rrrrÚs2     2$=