
    Ii_                        S r SSKrSSKJr  SSKJrJrJrJrJ	r	J
r
  SSKJr  SSKJr  SSKJr  \" SS	5      u  rrrrr\" S
S5      u  rr\" SS	5       V s/ s H  n \" U 5      PM     sn u  rrrrr\" S
S5       V s/ s H  n \" U 5      PM     sn u  rr " S S5      r  " S S\ 5      r! " S S5      r" " S S5      r#gs  sn f s  sn f )a  
This module provides GSS-API / SSPI Key Exchange as defined in :rfc:`4462`.

.. note:: Credential delegation is not supported in server mode.

.. note::
    `RFC 4462 Section 2.2
    <https://tools.ietf.org/html/rfc4462.html#section-2.2>`_ says we are not
    required to implement GSS-API error messages. Thus, in many methods within
    this module, if an error occurs an exception will be thrown and the
    connection will be terminated.

.. seealso:: :doc:`/api/ssh_gss`

.. versionadded:: 1.15
    N)sha1)DEBUGmax_byte	zero_bytebyte_chr	byte_maskbyte_ord)util)Message)SSHException   #   (   *   c                       \ rS rSrSrSrSr\" S5      \S-  -   r	\
S-  rSrS	 rS
 rS rS rS rS rS rS rS rSrg)KexGSSGroup1L   z
GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange as defined in `RFC
4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
lE   8{3If?E yZ3V58noPe?a-tBLy3W[<p6m5P&aF!33*w& ARM;L}.c|&A@h\&&#-Dvd             z(gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==c                 ~    Xl         U R                   R                  U l        S U l        SU l        SU l        SU l        g )Nr   )	transportkexgss_ctxtkexgssgss_hostxefselfr   s     6/venv/lib/python3.13/site-packages/paramiko/kex_gss.py__init__KexGSSGroup1.__init__Y   s4    "nn00    c                    U R                  5         U R                  R                  (       aP  [        U R                  U R
                  U R                  5      U l        U R                  R                  [        5        g[        U R                  U R
                  U R                  5      U l
        U R                  R                  U l        [        5       nUR                  [        5        UR                  U R                   R#                  U R                  S95        UR%                  U R                  5        U R                  R'                  U5        U R                  R                  [(        [*        [,        [.        5        g)zE
Start the GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange.
Ntarget)_generate_xr   server_modepowGr   Pr   _expect_packetMSG_KEXGSS_INITr   r   r   add_bytec_MSG_KEXGSS_INIT
add_stringr   ssh_init_sec_context	add_mpint_send_messageMSG_KEXGSS_HOSTKEYMSG_KEXGSS_CONTINUEMSG_KEXGSS_COMPLETEMSG_KEXGSS_ERRORr!   ms     r"   	start_kexKexGSSGroup1.start_kexa   s     	>>%%0DFNN))/:TVVTVVTVV,//I	

$%	T[[55T]]5KL	DFF$$Q'%%		
r%   c                     U R                   R                  (       a  U[        :X  a  U R                  U5      $ U R                   R                  (       d  U[        :X  a  U R                  U5      $ U R                   R                  (       a  U[        :X  a  U R                  U5      $ U R                   R                  (       d  U[        :X  a  U R                  U5      $ U[        :X  a  U R                  U5      $ Sn[        UR                  U5      5      e)x
Parse the next packet.

:param ptype: The (string) type of the incoming packet
:param `.Message` m: The packet content
z.GSS KexGroup1 asked to handle packet type {:d})r   r*   r/   _parse_kexgss_initr6   _parse_kexgss_hostkeyr7   _parse_kexgss_continuer8   _parse_kexgss_completer9   _parse_kexgss_errorr   formatr!   ptyper;   msgs       r"   
parse_nextKexGSSGroup1.parse_next{   s     >>%%5O+C**1--++:L1L--a00^^''U6I-I..q11++:M1M..q11&&++A..>3::e,--r%   c                      [         R                  " S5      n[        US   S5      USS -   nUSS nX R                  U R                  4;  a  OMN  [
        R                  " U5      U l        g)a@  
generate an "x" (1 < x < q), where q is (p-1)/2.
p is a 128-byte (1024-bit) number, where the first 64 bits are 1.
therefore q can be approximated as a 2^1023.  we drop the subset of
potential x where the first 63 bits are 1, because some of those will
be larger than q (but this is a tiny tiny subset of potential x).
      r   r   Nr   )osurandomr   b7fffffffffffffffb0000000000000000r
   inflate_longr   )r!   x_bytesfirsts      r"   r)   KexGSSGroup1._generate_x   sm     jjoG
D1GABK?GBQKE33T5K5KLL  ""7+r%   c                     UR                  5       nX R                  l        UR                  5       nU R                  R                  X#5        U R                  R	                  [
        [        5        g)z
Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

:param `.Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
N
get_stringr   host_key_verify_keyr.   r7   r8   r!   r;   rY   sigs       r"   rA   "KexGSSGroup1._parse_kexgss_hostkey   L     <<>"*lln""81%%&9;NOr%   c                    U R                   R                  (       d  UR                  5       n[        5       nUR	                  [
        5        UR                  U R                  R                  U R                  US95        U R                   R                  U5        U R                   R                  [        [        [        5        gg)z{
Parse the SSH2_MSG_KEXGSS_CONTINUE message.

:param `.Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE
    message
r(   
recv_tokenNr   r*   rX   r   r0   c_MSG_KEXGSS_CONTINUEr2   r   r3   r   send_messager.   r7   r8   r9   r!   r;   	srv_tokens      r"   rB   #KexGSSGroup1._parse_kexgss_continue   s     ~~))I	AJJ,-LL00==Y 1 
 NN''*NN))#%8:J r%   c                 "   U R                   R                  c  [        5       U R                   l        UR                  5       U l        U R                  S:  d  U R                  U R
                  S-
  :  a  [        S5      eUR                  5       nUR                  5       nSnU(       a  UR                  5       n[        U R                  U R                  U R
                  5      n[        5       nUR                  U R                   R                  U R                   R                  U R                   R                  U R                   R                   5        UR#                  U R                   R                  R%                  5       5        UR'                  U R(                  5        UR'                  U R                  5        UR'                  U5        [+        [-        U5      5      R/                  5       nU R                   R1                  XW5        Ub@  U R2                  R5                  U R6                  US9  U R2                  R9                  X'5        OU R2                  R9                  X'5        SU R                   l        U R                   R=                  5         g)z
Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

:param `.Message` m: The content of the
    SSH2_MSG_KEXGSS_COMPLETE message
NrL   Server kex "f" is out of ranger`   T)r   rY   NullHostKey	get_mpintr   r-   r   rX   get_booleanr+   r   r   addlocal_versionremote_versionlocal_kex_initremote_kex_initr2   __str__r4   r   r   strdigest_set_K_Hr   r3   r   ssh_check_micgss_kex_used_activate_outboundr!   r;   	mic_tokenboolrf   KhmHs           r"   rC   #KexGSSGroup1._parse_kexgss_complete   s    >>""*&1mDNN#FFQJDFFTVVaZ/?@@LLN	}}	I' Y
NN((NN))NN))NN**		
 	dnn--5578
TVV
TVV
QRM  "% KK,,}} -  KK%%i3KK%%i3&*#))+r%   c                    UR                  5       nUR                  5       U l        U R                  S:  d  U R                  U R                  S-
  :  a  [	        S5      e[        U R                  U R                  U R                  5      n[        5       U R                  l	        U R                  R                  R                  5       n[        5       nUR                  U R                  R                  U R                  R                  U R                  R                  U R                  R                   5        UR#                  U5        UR%                  U R                  5        UR%                  U R&                  5        UR%                  U5        [)        UR+                  5       5      R-                  5       nU R                  R/                  X65        U R0                  R3                  U R4                  U5      n[        5       nU R0                  R6                  (       a  U R0                  R9                  U R                  R:                  SS9nUR=                  [>        5        UR%                  U R&                  5        UR#                  U5        Ub#  URA                  S5        UR#                  U5        OURA                  S5        U R                  RC                  U5        SU R                  l"        U R                  RG                  5         gUR=                  [H        5        UR#                  U5        U R                  RC                  U5        U R                  RK                  [L        [N        [P        5        g)z}
Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

:param `.Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
rL   Client kex "e" is out of rangeTgss_kexNF))rX   rk   r   r-   r   r+   r   rj   r   rY   rr   r   rm   ro   rn   rq   rp   r2   r4   r   r   asbytesrt   ru   r   ssh_accept_sec_contextr   _gss_srv_ctxt_statusssh_get_mic
session_idr0   c_MSG_KEXGSS_COMPLETEadd_booleanr5   rw   rx   rc   r.   r7   r8   r9   	r!   r;   client_tokenr|   keyr}   r~   rf   rz   s	            r"   r@   KexGSSGroup1._parse_kexgss_init   sW    ||~FFQJDFFTVVaZ/?@@'"--nn%%--/ Y
NN))NN((NN**NN))		
 	c
TVV
TVV
Q%%'%KK66MM<
	 I;;++//))4 0 I JJ,-KKLL#$d#Y'e$NN((+*.DNN'NN--/JJ,-LL#NN((+NN))#%8:Jr%   c                     UR                  5       nUR                  5       nUR                  5       nUR                  5         [        SR                  X#U5      5      e)a  
Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
The server may send a GSS-API error message. if it does, we display
the error by throwing an exception (client mode).

:param `.Message` m: The content of the SSH2_MSG_KEXGSS_ERROR message
:raise SSHException: Contains GSS-API major and minor status as well as
                     the error message and the language tag of the
                     message
CGSS-API Error:
Major Status: {}
Minor Status: {}
Error Message: {}
get_intrX   r   rE   r!   r;   
maj_status
min_statuserr_msgs        r"   rD    KexGSSGroup1._parse_kexgss_error*  Q     YY[
YY[
,,.	 F
 	
r%   )r   r   r   r   r   r   N)__name__
__module____qualname____firstlineno____doc__r-   r,   r   r   rP   r   rQ   NAMEr#   r<   rI   r)   rA   rB   rC   r@   rD   __static_attributes__ r%   r"   r   r   L   sf     	KA	A A5!A5D
4.,, P.+,Z6p
r%   r   c                   $    \ rS rSrSrSrSrSrSrg)KexGSSGroup14iD  z
GSS-API / SSPI Authenticated Diffie-Hellman Group14 Key Exchange as defined
in `RFC 4462 Section 2
<https://tools.ietf.org/html/rfc4462.html#section-2>`_
l   &UG9
tcb0]Q\-:$90.`U_b;YS7x]Ek`:xds!,w<G8qbdR_hddY6KpRT{UjK#Gt|L4S8 FYpw,(.> =HG2Cdc_.K?&j_c}z[\V_1M.D^/1v5I	jV&|/mVlR<6#{n4(EY91T:g8	H	Apcb4BBj~H r   z)gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==r   N)	r   r   r   r   r   r-   r,   r   r   r   r%   r"   r   r   D  s     	KA	A6Dr%   r   c                   j    \ rS rSrSrSrSrSrSrS r	S r
S	 rS
 rS rS rS rS rS rS rS rSrg)	KexGSSGexiP  z
GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange as defined in
`RFC 4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
z%gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==       i   c                     Xl         U R                   R                  U l        S U l        S U l        S U l        S U l        S U l        S U l        S U l	        SU l
        g )NF)r   r   r   r   pqgr   r   r   	old_styler    s     r"   r#   KexGSSGex.__init__[  sP    "nn00r%   c                    U R                   R                  (       a   U R                   R                  [        5        gU R                   R                  U l        [        5       nUR                  [        5        UR                  U R                  5        UR                  U R                  5        UR                  U R                  5        U R                   R                  U5        U R                   R                  [        5        g)zF
Start the GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange
N)r   r*   r.   MSG_KEXGSS_GROUPREQr   r   r0   c_MSG_KEXGSS_GROUPREQadd_intmin_bitspreferred_bitsmax_bitsr5   MSG_KEXGSS_GROUPr:   s     r"   r<   KexGSSGex.start_kexg  s     >>%%NN))*=> //I	

()			$-- 			$%%&			$-- $$Q'%%&67r%   c                    U[         :X  a  U R                  U5      $ U[        :X  a  U R                  U5      $ U[        :X  a  U R                  U5      $ U[        :X  a  U R                  U5      $ U[        :X  a  U R                  U5      $ U[        :X  a  U R                  U5      $ U[        :X  a  U R                  U5      $ Sn[        UR                  U5      5      e)r?   z'KexGex asked to handle packet type {:d})r   _parse_kexgss_groupreqr   _parse_kexgss_groupr/   _parse_kexgss_gex_initr6   rA   r7   rB   r8   rC   r9   rD   r   rE   rF   s       r"   rI   KexGSSGex.parse_nextz  s     ''..q11&&++A..o%..q11((--a00))..q11))..q11&&++A..73::e,--r%   c                 z   U R                   S-
  S-  n[        R                  " US5      n[        US   5      n[	        U5      nSnUS-  (       d  US-  nUS-  nUS-  (       d  M   [
        R                  " U5      n[        US   U5      USS  -   n[        R                  " US5      nUS:  a  Xq:  a  OMP  Xpl	        g )NrL   r   r      rM   )
r   r
   deflate_longr	   lenrN   rO   r   rR   r   )r!   r   qnormqhbyte
byte_countqmaskrS   r   s           r"   r)   KexGSSGex._generate_x  s    VVaZA!!!Q'%(#Z
D=qLFaKE D== jj,G
E2WQR[@G!!'1-AAAE  r%   c                    UR                  5       nUR                  5       nUR                  5       nX0R                  :  a  U R                  nX0R                  :  a  U R                  nX#:  a  UnXC:  a  UnX l        X0l        X@l        U R                  R                  5       nUc  [        S5      eU R                  R                  [        SR                  X#U5      5        UR                  X#U5      u  U l        U l        [        5       nUR                  [        5        UR!                  U R                  5        UR!                  U R                  5        U R                  R#                  U5        U R                  R%                  [&        5        g)z
Parse the SSH2_MSG_KEXGSS_GROUPREQ message (server mode).

:param `.Message` m: The content of the
    SSH2_MSG_KEXGSS_GROUPREQ message
Nz-Can't do server-side gex with no modulus packzPicking p ({} <= {} <= {} bits))r   r   r   r   r   _get_modulus_packr   _logr   rE   get_modulusr   r   r   r0   c_MSG_KEXGSS_GROUPr4   r5   r.   r/   )r!   r;   minbitspreferredbitsmaxbitspacks         r"   r    KexGSSGex._parse_kexgss_groupreq  s2    ))+		))+==( MMM==( MMM "#G"#G+~~//1<NOO-44	
 ))''JI	

%&	DFF	DFF$$Q'%%o6r%   c                 ,   UR                  5       U l        UR                  5       U l        [        R                  " U R                  5      nUS:  d  US:  a  [        SR                  U5      5      eU R                  R                  [        SR                  U5      5        U R                  5         [        U R                  U R                  U R                  5      U l        [        5       nUR                  [         5        UR#                  U R$                  R'                  U R(                  S95        UR+                  U R                  5        U R                  R-                  U5        U R                  R/                  [0        [2        [4        [6        5        g)z~
Parse the SSH2_MSG_KEXGSS_GROUP message (client mode).

:param `Message` m: The content of the SSH2_MSG_KEXGSS_GROUP message
r   r   z<Server-generated gex p (don't ask) is out of range ({} bits)zGot server p ({} bits)r'   N)rk   r   r   r
   
bit_lengthr   rE   r   r   r   r)   r+   r   r   r   r0   r1   r2   r   r3   r   r4   r5   r.   r6   r7   r8   r9   )r!   r;   bitlens      r"   r   KexGSSGex._parse_kexgss_group  s    (TMv}"F6N  	+226:	
 	TVVTVVTVV,I	

$%	T[[55T]]5KL	DFF$$Q'%%		
r%   c                 P   UR                  5       nUR                  5       U l        U R                  S:  d  U R                  U R                  S-
  :  a  [	        S5      eU R                  5         [        U R                  U R                  U R                  5      U l	        [        U R                  U R                  U R                  5      n[        5       U R                  l        U R                  R                  R                  5       n[        5       nUR                  U R                  R                   U R                  R"                  U R                  R$                  U R                  R&                  U5        UR)                  U R*                  5        UR)                  U R,                  5        UR)                  U R.                  5        UR1                  U R                  5        UR1                  U R                  5        UR1                  U R                  5        UR1                  U R                  5        UR1                  U5        [3        UR5                  5       5      R7                  5       nU R                  R9                  X65        U R:                  R=                  U R>                  U5      n[        5       nU R:                  R@                  (       a  U R:                  RC                  U R                  RD                  SS9nURG                  [H        5        UR1                  U R                  5        URK                  U5        Ub#  URM                  S5        URK                  U5        OURM                  S5        U R                  RO                  U5        SU R                  l(        U R                  RS                  5         gURG                  [T        5        URK                  U5        U R                  RO                  U5        U R                  RW                  [X        [Z        [\        5        g)z|
Parse the SSH2_MSG_KEXGSS_INIT message (server mode).

:param `Message` m: The content of the SSH2_MSG_KEXGSS_INIT message
rL   r   Tr   NF)/rX   rk   r   r   r   r)   r+   r   r   r   rj   r   rY   rr   r   rm   ro   rn   rq   rp   r   r   r   r   r4   r   r   rt   ru   r   r   r   r   r   r   r0   r   r2   r   r5   rw   rx   rc   r.   r7   r8   r9   r   s	            r"   r    KexGSSGex._parse_kexgss_gex_init  s    ||~FFQJDFFTVVaZ/?@@TVVTVVTVV,'"--nn%%--/ Y
NN))NN((NN**NN))	
 	

4==!


4&&'


4==!
TVV
TVV
TVV
TVV
Q%%'%KK66MM<
	 I;;++//))4 0 I JJ,-KKLL#$d#Y'e$NN((+*.DNN'NN--/JJ,-LL#NN((+NN))#%8:Jr%   c                     UR                  5       nX R                  l        UR                  5       nU R                  R                  X#5        U R                  R	                  [
        [        5        g)z
Parse the SSH2_MSG_KEXGSS_HOSTKEY message (client mode).

:param `Message` m: The content of the SSH2_MSG_KEXGSS_HOSTKEY message
NrW   r[   s       r"   rA   KexGSSGex._parse_kexgss_hostkey1  r^   r%   c                    U R                   R                  (       d  UR                  5       n[        5       nUR	                  [
        5        UR                  U R                  R                  U R                  US95        U R                   R                  U5        U R                   R                  [        [        [        5        gg)zv
Parse the SSH2_MSG_KEXGSS_CONTINUE message.

:param `Message` m: The content of the SSH2_MSG_KEXGSS_CONTINUE message
r`   Nrb   re   s      r"   rB    KexGSSGex._parse_kexgss_continue>  s     ~~))I	AJJ,-LL00==Y 1 
 NN''*NN))#%8:J r%   c                 ^   U R                   R                  c  [        5       U R                   l        UR                  5       U l        UR                  5       nUR                  5       nSnU(       a  UR                  5       nU R                  S:  d  U R                  U R                  S-
  :  a  [        S5      e[        U R                  U R                  U R                  5      n[        5       nUR                  U R                   R                  U R                   R                  U R                   R                  U R                   R                   U R                   R                  R#                  5       5        U R$                  (       d  UR'                  U R(                  5        UR'                  U R*                  5        U R$                  (       d  UR'                  U R,                  5        UR/                  U R                  5        UR/                  U R0                  5        UR/                  U R2                  5        UR/                  U R                  5        UR/                  U5        [5        UR7                  5       5      R9                  5       nU R                   R;                  XW5        Ub@  U R<                  R?                  U R@                  US9  U R<                  RC                  X'5        OU R<                  RC                  X'5        SU R                   l"        U R                   RG                  5         g)z
Parse the SSH2_MSG_KEXGSS_COMPLETE message (client mode).

:param `Message` m: The content of the SSH2_MSG_KEXGSS_COMPLETE message
NrL   ri   r`   T)$r   rY   rj   rk   r   rX   rl   r   r   r+   r   r   rm   rn   ro   rp   rq   rr   r   r   r   r   r   r4   r   r   r   r   rt   ru   r   r3   r   rv   rw   rx   ry   s           r"   rC    KexGSSGex._parse_kexgss_completeT  s    >>""*&1mDNN#LLN	}}	IFFQJDFFTVVaZ/?@@' Y
NN((NN))NN))NN**NN##++-	
 ~~JJt}}%


4&&'~~JJt}}%
TVV
TVV
TVV
TVV
Q%%'% KK,,}} -  KK%%i3KK%%i3&*#))+r%   c                     UR                  5       nUR                  5       nUR                  5       nUR                  5         [        SR                  X#U5      5      e)a  
Parse the SSH2_MSG_KEXGSS_ERROR message (client mode).
The server may send a GSS-API error message. if it does, we display
the error by throwing an exception (client mode).

:param `Message` m:  The content of the SSH2_MSG_KEXGSS_ERROR message
:raise SSHException: Contains GSS-API major and minor status as well as
                     the error message and the language tag of the
                     message
r   r   r   s        r"   rD   KexGSSGex._parse_kexgss_error  r   r%   )r   r   r   r   r   r   r   r   r   r   r   r   r   N)r   r   r   r   r   r   r   r   r   r#   r<   rI   r)   r   r   r   rA   rB   rC   rD   r   r   r%   r"   r   r   P  sY    
 3DHHN
8&.4$*7X
B<|P,0,d
r%   r   c                   *    \ rS rSrSrS rS rS rSrg)rj   i  z
This class represents the Null Host Key for GSS-API Key Exchange as defined
in `RFC 4462 Section 5
<https://tools.ietf.org/html/rfc4462.html#section-5>`_
c                     SU l         g )N r   r!   s    r"   r#   NullHostKey.__init__  s	    r%   c                     U R                   $ Nr   r   s    r"   rr   NullHostKey.__str__      xxr%   c                     U R                   $ r   r   r   s    r"   get_nameNullHostKey.get_name  r   r%   r   N)	r   r   r   r   r   r#   rr   r   r   r   r%   r"   rj   rj     s    r%   rj   )$r   rN   hashlibr   paramiko.commonr   r   r   r   r   r	   paramikor
   paramiko.messager   paramiko.ssh_exceptionr   ranger/   r7   r8   r6   r9   r   r   r1   rc   r   c_MSG_KEXGSS_HOSTKEYc_MSG_KEXGSS_ERRORr   r   r   r   r   rj   )cs   0r"   <module>r      s   ." 
    $ / 
"bM*/B- '&  B-(-QXa[-( r2/&AHQK/ +*
u
 u
p	7L 	7M
 M
`
 u )/s   B=;C