ó
°‹EYc@s~
dZd
dl
Z
d
dlmZ
d
dlmZmZmZ
d
dlm	Z	
d
dl
mZ
d
dlm
Z
mZmZ
d
dlmZ
ed	d
ƒ\ZZZZZeddƒ\ZZged	d
ƒD]Ze
eƒ
^qÍ\ZZZZZgeddƒD]Ze
eƒ
^q
\Z Z!d
e"f
d„ƒYZ#de#f
d„ƒYZ$de"f
d„ƒYZ%de"f
d„ƒYZ&dS(sõ

This module provides GSS-API / SSPI Key Exchange as defined in :rfc:`4462`.

.. note:: Credential delegation is not supported in server mode.

.. note::
    `RFC 4462 Section 2.2
    <https://tools.ietf.org/html/rfc4462.html#section-2.2>`_ says we are not
    required to implement GSS-API error messages. Thus, in many methods within
    this module, if an error occurs an exception will be thrown and the
    connection will be terminated.

.. seealso:: :doc:`/api/ssh_gss`

.. versionadded:: 1.15
iÿÿÿÿN(
tsha1(tDEBUGtmax_bytet	zero_byte(
tutil(
tMessage(tbyte_chrt	byte_masktbyte_ord(
tSSHExceptionii#i(i*tKexGSSGroup1cBseZ
dZd
ZdZedƒ
edZedZ	dZ
d„Zd„Zd	„Z
d
„Zd„Zd„Zd
„Zd„Zd„ZRS(sŸ
    GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange as defined in `RFC
    4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    lEÿÿÿÿ8Ê{3If?ñE yéZô3¢Vý58nÛoP·eõ?a-û
ÓtBLè
ûy3W[<‘p¨6m5ÂÝPøß&aÌF!Í33*¾w& ãAR‘M;L}. c|&A“@”h\
Š&&#-D¨v‡dÿÿÿÿiiiis(gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==cCs@|
|_|jj
|_d|_d
|_d
|_d
|_dS(Ni(t	transporttkexgss_ctxttkexgsstNonetgss_hostt
xt
et
f(tselfR((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyt__init__Js
	

	
	
	
c
Csót|j
_|jƒ
|j
jrTt|j|j|jƒ|_	|j
j
tƒ

d
St|j|j|jƒ|_|j
j
|_
tƒ}
|
jtƒ

|
j|jjd|j
ƒ
ƒ

|
j|jƒ

|j
j|
ƒ

|j
j
ttttƒ
d
S(sU
        Start the GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange.
        Nttarget(tTrueRtgss_kex_usedt_generate_xtserver_modetpowt
GRt
PRt_expect_packettMSG_KEXGSS_INITRRRtadd_bytetc_MSG_KEXGSS_INITt
add_stringR
tssh_init_sec_contextt	add_mpintt
_send_messagetMSG_KEXGSS_HOSTKEYtMSG_KEXGSS_CONTINUEtMSG_KEXGSS_COMPLETEtMSG_KEXGSS_ERROR(Rt
m((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyt	start_kexRs"





	








cCsÃ|jj
r%|
tkr%|j|ƒ
S|jj
rK|
tkrK|j|ƒ
S|jj
rp|
tkrp|j|ƒ
S|jj
r–|
tkr–|j	|ƒ
S|
t
kr¯|j|ƒ
Std
|
ƒ
‚
dS(s—
        Parse the next packet.

        :param ptype: The (string) type of the incoming packet
        :param `.Message` m: The paket content
        s,GSS KexGroup1 asked to handle packet type %dN(
RRRt_parse_kexgss_initR%t_parse_kexgss_hostkeyR&t_parse_kexgss_continueR't_parse_kexgss_completeR(t_parse_kexgss_errorR	(RtptypeR)((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyt
parse_nextks















c
CslxStj
d
ƒ
}
t|
ddƒ|
d}
|
d }||j|jfkrPqqtj|
ƒ
|_dS(sp

        generate an "x" (1 < x < q), where q is (p-1)/2.
        p is a 128-byte (1024-bit) number, where the first 64 bits are 1.
        therefore q can be approximated as a 2^1023.  we drop the subset of
        potential x where the first 63 bits are 1, because some of those will
        be larger than q (but this is a tiny tiny subset of potential x).
        i€iii
iN(tosturandomRtb7ffffffffffffffftb0000000000000000Rtinflate_longR(Rtx_bytestfirst((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRs






cCsN|
jƒ}||j
_|
jƒ}|j
j||ƒ
|j
jttƒ
d
S(s›
        Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
        N(t
get_stringRthost_keyt_verify_keyRR&R'(RR)R:tsig((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR,‘s




cCs€|jj
s||
jƒ}tƒ}
|
jtƒ

|
j|jjd
|j	d|ƒƒ

|jj
|
ƒ

|jjtt
tƒ
ndS(s›
        Parse the SSH2_MSG_KEXGSS_CONTINUE message.

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE
            message
        Rt
recv_tokenN(RRR9RRtc_MSG_KEXGSS_CONTINUER!R
R"Rtsend_messageRR&R'R((RR)t	srv_token((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR-Ÿs

	





	



cCsÅ
|jj
dkr$tƒ|j_
n|
jƒ|_|jd
ksX|j|jd
krgtdƒ
‚
n|
jƒ}|
j	ƒ}d}|rš|
jƒ}nt
|j|j|jƒ}tƒ}|j
|jj|jj|jj|jjƒ
|j|jj
jƒƒ

|j|jƒ

|j|jƒ

|j|ƒ

|jj|tt|ƒ
ƒ
jƒƒ
|dk	r›
|jjd|jd|ƒ
|jj||jjƒ
n|jj||jjƒ
|jjƒ
dS(s©
        Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

        :param `.Message` m: The content of the
            SSH2_MSG_KEXGSS_COMPLETE message
        i
sServer kex "f" is out of rangeRR=N( RR:RtNullHostKeyt	get_mpintRRR	R9tget_booleanRRRtaddt
local_versiontremote_versiontlocal_kex_inittremote_kex_initR!t__str__R#Rt_set_K_HRtstrtdigestR
R"Rt
ssh_check_mict
session_idt_activate_outbound(RR)t	mic_tokentboolR@t
Kthm((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR.µs6


%





	







%







c	Cs6|
jƒ}|
j
ƒ|_|jd
ks@|j|jd
krOtdƒ
‚
nt|j|j|jƒ}tƒ|j_	|jj	j
ƒ}tƒ}|j|jj
|jj|jj|jjƒ
|j|ƒ

|j|jƒ

|j|jƒ

|j|ƒ

t|jƒƒ
jƒ}|jj||ƒ
|jj|j|ƒ}tƒ}
|jjrò
|jj|jjdtƒ

}|
jt ƒ

|
j|jƒ

|
j|ƒ

|dk	rÅ
|
j"tƒ

|
j|ƒ

n
|
j"t#ƒ

|jj$|
ƒ

|jj%ƒ
n@|
jt&ƒ

|
j|ƒ

|jj$|
ƒ

|jj't(t)t*ƒ
dS(s•
        Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
        i
sClient kex "e" is out of rangetgss_kexN(+R9RBRRR	RRRARR:RIRRDRFRERHRGR!R#RRtasbytesRLRJR
tssh_accept_sec_contextRt_gss_srv_ctxt_statustssh_get_micRNRRtc_MSG_KEXGSS_COMPLETERtadd_booleantFalseR$ROR>RR&R'R((	RR)tclient_tokenRRtkeyRSt
HR@RP((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR+ÝsJ

%



	











	
	


	


















cCsW|
jƒ}|
jƒ}|
j
ƒ}|
j
ƒ
td
ƒ
t|ƒ
t|ƒ
|f‚
dS(sÝ

        Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
        The server may send a GSS-API error message. if it does, we display
        the error by throwing an exception (client mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_ERROR message
        :raise SSHException: Contains GSS-API major and minor status as well as
                             the error message and the language tag of the
                             message
        s_GSS-API Error:
Major Status: %s
Minor Status: %s                            
Error Message: %s
N(tget_intR9R	RK(RR)t
maj_statust
min_statusterr_msg((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR/
s






	
(t__name__t
__module__t__doc__RRRRR4RR5tNAMERR*R1RR,R-R.R+R/(((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR
>s




							(	1t
KexGSSGroup14c
Bs eZ
dZd
ZdZdZRS(s«
    GSS-API / SSPI Authenticated Diffie-Hellman Group14 Key Exchange as defined
    in `RFC 4462 Section 2
    <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    l‰ÿÿÿÿ&•U¢G9
tcb0]Q\-¥:¾$•90.`U´_¼b;YS7x]EkŠ`:xds€!,w<Gï8¶qbdR_ÊØhÅÀd«d©ÃY6K–pRT{ÜUÄj¼K­#¹Gt|õL¤ê‹4šS«8Ø ÒFYpw,(.>Â=¶H³G2C’düc_Ÿ.K?&jÚ_†c½}­
z[\Vµ_1M.D‰^±/1v5I	ŽjÖV&|Ó
Š/òmVÀlRÓ<6#å{n4ó(EY91ÇTï
:Ìg8	H	ÍAp¢cb4BÑBˆj~Hüÿÿÿÿis)gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==(RcRdReRRRf(((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRg#
s


t	KexGSSGexc
Bs‰eZ
dZd
ZdZdZdZd„Zd„Zd„Z	d„Z
d	„Zd
„Zd„Z
d„Zd
„Zd„Zd„ZRS(s¡
    GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange as defined in
    `RFC 4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    s%gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==ii icCsd|
|_|jj
|_d|_d|_d|_d|_d|_d|_	d|_
t|_dS(
N(
RRR
RRt
pt
qt
gRRRR[t	old_style(RR((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR8
s
	

	
	
	
	
	
	
	
c
Cs¥t|j
_|j
jr,|j
jtƒ

d
S|j
j|_tƒ}
|
jt	ƒ

|
j
|jƒ

|
j
|jƒ

|
j
|j
ƒ

|j
j|
ƒ

|j
jtƒ

d
S(sV
        Start the GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange
        N(RRRRRtMSG_KEXGSS_GROUPREQRRRtc_MSG_KEXGSS_GROUPREQtadd_inttmin_bitstpreferred_bitstmax_bitsR$tMSG_KEXGSS_GROUP(RR)((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR*D
s



	






cCsÃ|
tkr|j
|ƒ
S|
tkr2|j|ƒ
S|
tkrK|j|ƒ
S|
tkrd|j|ƒ
S|
tkr}|j	|ƒ
S|
t
kr–|j|ƒ
S|
tkr¯|j
|ƒ
Std
|
ƒ
‚
dS(s—
        Parse the next packet.

        :param ptype: The (string) type of the incoming packet
        :param `.Message` m: The paket content
        s%KexGex asked to handle packet type %dN(Rmt_parse_kexgss_groupreqRst_parse_kexgss_groupRt_parse_kexgss_gex_initR%R,R&R-R'R.R(R/R	(RR0R)((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR1X
s




















c
CsÜ|jd
d}
t
j|
dƒ}t|dƒ
}t|ƒ
}d}x"|d@si|d
K}|d
L}qHWxbtrÎtj|ƒ
}t|d|ƒ|d
}t
j	|d
ƒ}|d
krm||
krmPqmqmW||_
dS(Ni
iiiÿi€(RiRtdeflate_longRtlenRR2R3RR6R(RRjtqnormtqhbytet
byte_counttqmaskR7R((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRq
s









	





cCsd
|
jƒ}|
jƒ}|
jƒ}||j
kr?|j
}n||jkrZ|j}n||kro|}n||kr„|}n||_||_||_
|jjƒ}|dkrÉtd
ƒ
‚
n|jjt	d|||fƒ
|j
|||ƒ\|_|_t
ƒ}
|
jtƒ

|
j|jƒ

|
j|jƒ

|jj|
ƒ

|jjtƒ

dS(s©
        Parse the SSH2_MSG_KEXGSS_GROUPREQ message (server mode).

        :param `.Message` m: The content of the
            SSH2_MSG_KEXGSS_GROUPREQ message
        s-Can't do server-side gex with no modulus packsPicking p (%d <= %d <= %d bits)N(R_RrRpRqRt_get_modulus_packRR	t_logR
tget_modulusRkRiRRtc_MSG_KEXGSS_GROUPR#R$RR(RR)tminbitst
preferredbitstmaxbitstpack((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRtƒ
s:





	

		
	
	



	



!
	





cCs
|
jƒ|_
|
jƒ|_tj|j
ƒ
}|d
ksH|dkr[td|ƒ
‚
n|jjtd|ƒ
|j	ƒ
t
|j|j|j
ƒ|_t
ƒ}
|
jtƒ

|
j|jjd|jƒ
ƒ

|
j|jƒ

|jj|
ƒ

|jjttttƒ
dS(s–
        Parse the SSH2_MSG_KEXGSS_GROUP message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_GROUP message
        ii s<Server-generated gex p (don't ask) is out of range (%d bits)sGot server p (%d bits)RN(RBRiRkRt
bit_lengthR	RR~R
RRRRRRR R!R
R"RR#R$RR%R&R'R((RR)tbitlen((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRu®
s&









	








c	Cs¤|
jƒ}|
j
ƒ|_|jd
ks@|j|jd
krOtdƒ
‚
n|jƒ
t|j|j|jƒ|_	t|j|j|jƒ}t
ƒ|j_|jjj
ƒ}tƒ}|j|jj|jj|jj|jj|ƒ
|j|jƒ

|j|jƒ

|j|jƒ

|j|jƒ

|j|jƒ

|j|jƒ

|j|j	ƒ

|j|ƒ

t|jƒƒ
jƒ}|jj||ƒ
|jj|j|ƒ}tƒ}
|jj r`|jj!|jj"dt#ƒ

}|
j$t%ƒ

|
j|j	ƒ

|
j&|ƒ

|dk	r3|
j(t#ƒ

|
j&|ƒ

n
|
j(t)ƒ

|jj*|
ƒ

|jj+ƒ
n@|
j$t,ƒ

|
j&|ƒ

|jj*|
ƒ

|jj-t.t/t0ƒ
dS(s”
        Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
        i
sClient kex "e" is out of rangeRTN(1R9RBRRiR	RRRkRRRARR:RIRRDRFRERHRGRoRpRqRrR#RRURLRJR
RVRRWRXRNRRRYR!RRZR[R$ROR>RR&R'R((	RR)R\RRR]RSR^R@RP((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRvÊ
sX

%






	















	
	


	


















cCsN|
jƒ}||j
_|
jƒ}|j
j||ƒ
|j
jttƒ
d
S(sš
        Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
        N(R9RR:R;RR&R'(RR)R:R<((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR,
s




cCs€|jj
s||
jƒ}tƒ}
|
jtƒ

|
j|jjd
|j	d|ƒƒ

|jj
|
ƒ

|jjtt
tƒ
ndS(sŽ
        Parse the SSH2_MSG_KEXGSS_CONTINUE message.

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE message
        RR=N(RRR9RRR>R!R
R"RR?RR&R'R((RR)R@((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR-s

	









cCs)|jj
dkr$tƒ|j_
n|
jƒ|_|
jƒ}|
jƒ}d}|rf|
jƒ}n|jd
ks‹|j|jd
kršt	dƒ
‚
nt
|j|j|jƒ}tƒ}|j
|jj|jj|jj|jj|jj
jƒƒ
|js
|j|jƒ

n|j|jƒ

|jsC
|j|jƒ

n|j|jƒ

|j|jƒ

|j|jƒ

|j|jƒ

|j|ƒ

t|jƒƒ
jƒ}|jj||ƒ
|dk	rÿ
|jj d|j!d|ƒ
|jj"||jj#ƒ
n|jj"||jj#ƒ
|jj$ƒ
dS(sœ
        Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_COMPLETE message
        i
sServer kex "f" is out of rangeRR=N(%RR:RRARBRR9RCRiR	RRRRDRERFRGRHRIRlRoRpRqRrR#RkRRRURLRJR
R"RRMRNRO(RR)RPRQR@RRRSR^((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR."sF






%

	



	


	
















cCsW|
jƒ}|
jƒ}|
j
ƒ}|
j
ƒ
td
ƒ
t|ƒ
t|ƒ
|f‚
dS(sÝ

        Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
        The server may send a GSS-API error message. if it does, we display
        the error by throwing an exception (client mode).

        :param `Message` m:  The content of the SSH2_MSG_KEXGSS_ERROR message
        :raise SSHException: Contains GSS-API major and minor status as well as
                             the error message and the language tag of the
                             message
        s_GSS-API Error:
Major Status: %s
Minor Status: %s                            
Error Message: %s
N(R_R9R	RK(RR)R`RaRb((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyR/Ps






	
(RcRdReRfRpRrRqRR*R1RRtRuRvR,R-R.R/(((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRh.
s 



					+		7			.RAc
Bs)eZ
dZd
„Zd„Zd„ZRS(s«
    This class represents the Null Host Key for GSS-API Key Exchange as defined
    in `RFC 4462 Section 5
    <https://tools.ietf.org/html/rfc4462.html#section-5>`_
    c

Cs
d
|_dS(Nt(
R](
R((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRks
c


Cs|jS(
N(
R](
R((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRIns
c


Cs|jS(
N(
R](
R((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pytget_nameqs
(RcRdReRRIRˆ(((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyRAes
		('ReR2thashlibRtparamiko.commonR
RRtparamikoRtparamiko.messageRtparamiko.py3compatRRRtparamiko.ssh_exceptionR	trangeRR&R'R%R(RmRst
cR R>RYtc_MSG_KEXGSS_HOSTKEYtc_MSG_KEXGSS_ERRORRnR€tobjectR
RgRhRA(((sE/home/tvault/.virtenv/lib/python2.7/site-packages/paramiko/kex_gss.pyt<module>&s 





7.åÿ8