�
=OXc@sr
dZd
dl
Z
d
dlmZ
d
dlTd
dlmZ
d
dlmZ
d
dl	m
Z
mZmZm
Z

d
dlmZ
ed	d
�\ZZZZZedd�\ZZged	d
�D]Ze
e�
^q�\ZZZZZgedd�D]Ze
e�
^q�\ZZd
e f
d��YZ!de!f
d��YZ"de f
d��YZ#de f
d��YZ$dS(s�

This module provides GSS-API / SSPI Key Exchange as defined in :rfc:`4462`.

.. note:: Credential delegation is not supported in server mode.

.. note::
    `RFC 4462 Section 2.2
    <https://tools.ietf.org/html/rfc4462.html#section-2.2>`_ says we are not
    required to implement GSS-API error messages. Thus, in many methods within
    this module, if an error occurs an exception will be thrown and the
    connection will be terminated.

.. seealso:: :doc:`/api/ssh_gss`

.. versionadded:: 1.15
i����N(
tsha1(
t
*(
tutil(
tMessage(tbyte_chrtlongt	byte_masktbyte_ord(
tSSHExceptionii#i(i*tKexGSSGroup1cBs�eZ
dZd
ZdZed�
edZedZ	dZ
d�Zd�Zd	�Z
d
�Zd�Zd�Zd
�Zd�Zd�ZRS(s�
    GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange as defined in `RFC
    4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    lE����8�{3If?�E y�Z�3�V�58n�oP�e�?a-�
�tBL�
�y3W[�<�p�6m5��P��&a�F!�33*�w& �AR�M;L}.�c|&A�@�h\
�&&#-D�v�d����iiiis(gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==cCs@|
|_|jj
|_d|_d
|_d
|_d
|_dS(Ni(t	transporttkexgss_ctxttkexgsstNonetgss_hostt
xt
et
f(tselfR
((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyt__init__Fs
	

	
	
	
c
Cs�t|j
_|j�
|j
jrTt|j|j|j�|_	|j
j
t�

d
St|j|j|j�|_|j
j
|_
t�}
|
jt�

|
j|jjd|j
�
�

|
j|j�

|j
j|
�

|j
j
tttt�
d
S(sU
        Start the GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange.
        Nttarget(tTrueR
tgss_kex_usedt_generate_xtserver_modetpowt
GRt
PRt_expect_packettMSG_KEXGSS_INITRRRtadd_bytetc_MSG_KEXGSS_INITt
add_stringRtssh_init_sec_contextt	add_mpintt
_send_messagetMSG_KEXGSS_HOSTKEYtMSG_KEXGSS_CONTINUEtMSG_KEXGSS_COMPLETEtMSG_KEXGSS_ERROR(Rt
m((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyt	start_kexNs"





	








cCs�|jj
r%|
tkr%|j|�
S|jj
rK|
tkrK|j|�
S|jj
rp|
tkrp|j|�
S|jj
r�|
tkr�|j	|�
S|
t
kr�|j|�
Std
|
�
�
dS(s�
        Parse the next packet.

        :param char ptype: The type of the incomming packet
        :param `.Message` m: The paket content
        s,GSS KexGroup1 asked to handle packet type %dN(
R
RRt_parse_kexgss_initR$t_parse_kexgss_hostkeyR%t_parse_kexgss_continueR&t_parse_kexgss_completeR't_parse_kexgss_errorR(RtptypeR(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyt
parse_nextgs















c
CspxWtj
d
�
}
t|
dd�|
d}
|
d |jkr|
d |jkrPqqtj|
�
|_dS(sp

        generate an "x" (1 < x < q), where q is (p-1)/2.
        p is a 128-byte (1024-bit) number, where the first 64 bits are 1.
        therefore q can be approximated as a 2^1023.  we drop the subset of
        potential x where the first 63 bits are 1, because some of those will be
        larger than q (but this is a tiny tiny subset of potential x).
        i�iii
iN(tosturandomRtb7ffffffffffffffftb0000000000000000Rtinflate_longR(Rtx_bytes((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR}s





cCsN|
j�}||j
_|
j�}|j
j||�
|j
jtt�
d
S(s�
        Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
        N(t
get_stringR
thost_keyt_verify_keyRR%R&(RR(R8tsig((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR+�s




cCs�|jj
s||
j�}t�}
|
jt�

|
j|jjd
|j	d|��

|jj
|
�

|jjtt
t�
ndS(s�
        Parse the SSH2_MSG_KEXGSS_CONTINUE message.

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE message
        Rt
recv_tokenN(R
RR7RRtc_MSG_KEXGSS_CONTINUER RR!Rtsend_messageRR%R&R'(RR(t	srv_token((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR,�s

	









cCs�
|jj
dkr$t�|j_
n|
j�|_|jd
ksX|j|jd
krgtd�
�
n|
j�}|
j	�}d}|r�|
j�}nt
|j|j|j�}t�}|j
|jj|jj|jj|jj�
|j|jj
j��

|j|j�

|j|j�

|j|�

|jj|tt|�
�
j��
|dk	r�
|jjd|jd|�
|jj||jj�
n|jj||jj�
|jj�
dS(s�
        Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_COMPLETE message
        i
sServer kex "f" is out of rangeRR;N( R
R8R
tNullHostKeyt	get_mpintRRRR7tget_booleanRRRtaddt
local_versiontremote_versiontlocal_kex_inittremote_kex_initR t__str__R"Rt_set_K_HRtstrtdigestRR!Rt
ssh_check_mict
session_idt_activate_outbound(RR(t	mic_tokentboolR>t
Kthm((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR-�s6


%





	







%







c	Cs6|
j�}|
j
�|_|jd
ks@|j|jd
krOtd�
�
nt|j|j|j�}t�|j_	|jj	j
�}t�}|j|jj
|jj|jj|jj�
|j|�

|j|j�

|j|j�

|j|�

t|j��
j�}|jj||�
|jj|j|�}t�}
|jjr�
|jj|jjdt�

}|
jt �

|
j|j�

|
j|�

|dk	r�
|
j"t�

|
j|�

n
|
j"t#�

|jj$|
�

|jj%�
n@|
jt&�

|
j|�

|jj$|
�

|jj't(t)t*�
dS(s�
        Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
        i
sClient kex "e" is out of rangetgss_kexN(+R7R@RRRRRR?R
R8RGRRBRDRCRFRER R"RRtasbytesRJRHRtssh_accept_sec_contextRt_gss_srv_ctxt_statustssh_get_micRLRRtc_MSG_KEXGSS_COMPLETER
tadd_booleantFalseR#RMR<RR%R&R'(	RR(tclient_tokenRPtkeyRQt
HR>RN((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR*�sJ

%



	











	
	


	


















cCsY|
j�}|
j�}|
j
�}|
j
�}td
�
t|�
t|�
|f�
dS(s�

        Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
        The server may send a GSS-API error message. if it does, we display
        the error by throwing an exception (client mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_ERROR message
        :raise SSHException: Contains GSS-API major and minor status as well as
                             the error message and the language tag of the
                             message
        s_GSS-API Error:
Major Status: %s
Minor Status: %s                            
Error Message: %s
N(tget_intR7RRI(RR(t
maj_statust
min_statusterr_msgtlang_tag((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR.
s





	
(t__name__t
__module__t__doc__RRRtmax_byteR3t	zero_byteR4tNAMERR)R0RR+R,R-R*R.(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR	:s




							&	0t
KexGSSGroup14c
Bs eZ
dZd
ZdZdZRS(s�
    GSS-API / SSPI Authenticated Diffie-Hellman Group14 Key Exchange as defined
    in `RFC 4462 Section 2
    <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    l������&�U�G9
tcb0]Q\-�:�$�90.`U�_�b;YS7x]Ek�`:xds�!,w<G�8�qbdR_��h��d�d��Y6K�pRT{�U�j�K�#�Gt|�L���4�S�8� �FYpw,(.>�=�H�G2C�d�c_�.K?&j�_�c�}�
z[\V�_1M.D�^�/1v5I	�j�V&|�
�/�mV�lR�<6#�{n4�(EY91�T�
:�g8	H	�Ap�cb4B�B�j~H�����is)gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==(RbRcRdRRRg(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRh
s


t	KexGSSGexc
Bs�eZ
dZd
ZdZdZdZd�Zd�Zd�Z	d�Z
d	�Zd
�Zd�Z
d�Zd
�Zd�Zd�ZRS(s�
    GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange as defined in
    `RFC 4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
    s%gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==ii icCsd|
|_|jj
|_d|_d|_d|_d|_d|_d|_	d|_
t|_dS(
N(
R
RRR
Rt
pt
qt
gRRRRYt	old_style(RR
((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR.
s
	

	
	
	
	
	
	
	
c
Cs�t|j
_|j
jr,|j
jt�

d
S|j
j|_t�}
|
jt	�

|
j
|j�

|
j
|j�

|
j
|j
�

|j
j|
�

|j
jt�

d
S(sV
        Start the GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange
        N(RR
RRRtMSG_KEXGSS_GROUPREQRRRtc_MSG_KEXGSS_GROUPREQtadd_inttmin_bitstpreferred_bitstmax_bitsR#tMSG_KEXGSS_GROUP(RR(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR):
s



	






cCs�|
tkr|j
|�
S|
tkr2|j|�
S|
tkrK|j|�
S|
tkrd|j|�
S|
tkr}|j	|�
S|
t
kr�|j|�
S|
tkr�|j
|�
Std
|
�
�
dS(s�
        Parse the next packet.

        :param char ptype: The type of the incomming packet
        :param `.Message` m: The paket content
        s%KexGex asked to handle packet type %dN(Rnt_parse_kexgss_groupreqRtt_parse_kexgss_groupRt_parse_kexgss_gex_initR$R+R%R,R&R-R'R.R(RR/R(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR0N
s




















c
Cs�|jd
d}
t
j|
d�}t|d�
}t|�
}d}x"|d@si|d
K}|d
L}qHWxbtr�tj|�
}t|d|�|d
}t
j	|d
�}|d
krm||
krmPqmqmW||_
dS(Ni
iii�i�(RjRtdeflate_longRtlenRR1R2RR5R(RRktqnormtqhbytet
byte_counttqmaskR6R((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRg
s









	





cCsd
|
j�}|
j�}|
j�}||j
kr?|j
}n||jkrZ|j}n||kro|}n||kr�|}n||_||_||_
|jj�}|dkr�td
�
�
n|jjt	d|||f�
|j
|||�\|_|_t
�}
|
jt�

|
j|j�

|
j|j�

|jj|
�

|jjt�

dS(s�
        Parse the SSH2_MSG_KEXGSS_GROUPREQ message (server mode).

        :param `.Message` m: The content of the SSH2_MSG_KEXGSS_GROUPREQ message
        s-Can't do server-side gex with no modulus packsPicking p (%d <= %d <= %d bits)N(R]RsRqRrR
t_get_modulus_packR
Rt_logtDEBUGtget_modulusRlRjRRtc_MSG_KEXGSS_GROUPR"R#RR(RR(tminbitst
preferredbitstmaxbitstpack((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRuy
s2





	

		
	
	


 
!
	





cCs
|
j�|_
|
j�|_tj|j
�
}|d
ksH|dkr[td|�
�
n|jjtd|�
|j	�
t
|j|j|j
�|_t
�}
|
jt�

|
j|jjd|j�
�

|
j|j�

|jj|
�

|jjtttt�
dS(s�
        Parse the SSH2_MSG_KEXGSS_GROUP message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_GROUP message
        ii s<Server-generated gex p (don't ask) is out of range (%d bits)sGot server p (%d bits)RN(R@RjRlRt
bit_lengthRR
RR�RRRRRRRR RR!RR"R#RR$R%R&R'(RR(tbitlen((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRv�
s"






	








c	Cs�|
j�}|
j
�|_|jd
ks@|j|jd
krOtd�
�
n|j�
t|j|j|j�|_	t|j|j|j�}t
�|j_|jjj
�}t�}|j|jj|jj|jj|jj|�
|j|j�

|j|j�

|j|j�

|j|j�

|j|j�

|j|j�

|j|j	�

|j|�

t|j��
j�}|jj||�
|jj|j|�}t�}
|jj r`|jj!|jj"dt#�

}|
j$t%�

|
j|j	�

|
j&|�

|dk	r3|
j(t#�

|
j&|�

n
|
j(t)�

|jj*|
�

|jj+�
n@|
j$t,�

|
j&|�

|jj*|
�

|jj-t.t/t0�
dS(s�
        Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
        i
sClient kex "e" is out of rangeRRN(1R7R@RRjRRRRlRRR?R
R8RGRRBRDRCRFRERpRqRrRsR"RRSRJRHRRTRRURVRLRRRWR R
RXRYR#RMR<RR%R&R'(	RR(RZRPR[RQR\R>RN((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRw�
sX

%






	















	
	


	


















cCsN|
j�}||j
_|
j�}|j
j||�
|j
jtt�
d
S(s�
        Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
        N(R7R
R8R9RR%R&(RR(R8R:((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR+�
s




cCs�|jj
s||
j�}t�}
|
jt�

|
j|jjd
|j	d|��

|jj
|
�

|jjtt
t�
ndS(s�
        Parse the SSH2_MSG_KEXGSS_CONTINUE message.

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE message
        RR;N(R
RR7RRR<R RR!RR=RR%R&R'(RR(R>((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR,�
s

	









cCs)|jj
dkr$t�|j_
n|
j�|_|
j�}|
j�}d}|rf|
j�}n|jd
ks�|j|jd
kr�t	d�
�
nt
|j|j|j�}t�}|j
|jj|jj|jj|jj|jj
j��
|js
|j|j�

n|j|j�

|jsC
|j|j�

n|j|j�

|j|j�

|j|j�

|j|j�

|j|�

t|j��
j�}|jj||�
|dk	r�
|jj d|j!d|�
|jj"||jj#�
n|jj"||jj#�
|jj$�
dS(s�
        Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

        :param `Message` m: The content of the SSH2_MSG_KEXGSS_COMPLETE message
        i
sServer kex "f" is out of rangeRR;N(%R
R8R
R?R@RR7RARjRRRRRBRCRDRERFRGRmRpRqRrRsR"RlRRRSRJRHRR!RRKRLRM(RR(RNROR>RPRQR\((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR-sF






%

	



	


	
















cCsY|
j�}|
j�}|
j
�}|
j
�}td
�
t|�
t|�
|f�
dS(s�

        Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
        The server may send a GSS-API error message. if it does, we display
        the error by throwing an exception (client mode).

        :param `Message` m:  The content of the SSH2_MSG_KEXGSS_ERROR message
        :raise SSHException: Contains GSS-API major and minor status as well as
                             the error message and the language tag of the
                             message
        s_GSS-API Error:
Major Status: %s
Minor Status: %s                            
Error Message: %s
N(R]R7RRI(RR(R^R_R`Ra((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR.=s





	
(RbRcRdRgRqRsRrRR)R0RRuRvRwR+R,R-R.(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRi$
s 



					&		6			-R?c
Bs)eZ
dZd
�Zd�Zd�ZRS(s�
    This class represents the Null Host Key for GSS-API Key Exchange as defined
    in `RFC 4462 Section 5
    <https://tools.ietf.org/html/rfc4462.html#section-5>`_
    c

Cs
d
|_dS(Nt(
R[(
R((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRXs
c


Cs|jS(
N(
R[(
R((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyRG[s
c


Cs|jS(
N(
R[(
R((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pytget_name^s
(RbRcRdRRGR�(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyR?Rs
		(%RdR1thashlibRtparamiko.commontparamikoRtparamiko.messageRtparamiko.py3compatRRRRtparamiko.ssh_exceptionRtrangeRR%R&R$R'RnRtt
cRR<RWtc_MSG_KEXGSS_HOSTKEYtc_MSG_KEXGSS_ERRORRoR�tobjectR	RhRiR?(((s4/usr/lib/python2.7/site-packages/paramiko/kex_gss.pyt<module>&s 




"

7
.��/