o
    j                     @   sj   d dl mZmZ d dlmZmZmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ G dd dZdS )	    )AP_REQAP_REP)EnctypeKey_enctype_table)WinSSPISSPIPackage)ISC_REQ)
get_gssapic                   @   s^   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZdddZdd Z	de
jddddfddZdS )KerberosClientSSPIc                 C   s:   d| _ || _ttj| _d | _d | _d | _d | _	d | _
d S )Nr   )
iterations
credentialr   r   KERBEROSksspigssapietypeactual_ctx_flags
seq_numbersession_key)selfr    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/kerberos/client/sspi.py__init__
   s   
zKerberosClientSSPI.__init__c                 C   s   | j du r| j | _ | j S )ax  
		Fetches the starting sequence number. This is either zero or can be found in the authenticator field of the 
		AP_REQ structure. As windows uses a random seq number AND a subkey as well, we can't obtain it by decrypting the 
		AP_REQ structure. Insead under the hood we perform an encryption operation via EncryptMessage API which will 
		yield the start sequence number
		N)r   r   get_seq_numberr   r   r   r   r      s   
z!KerberosClientSSPI.get_seq_numberc                 C      t j| jv S N)r	   	INTEGRITYr   r   r   r   r   signing_needed       z!KerberosClientSSPI.signing_neededc                 C   r   r   )r	   CONFIDENTIALITYr   r   r   r   r   encryption_needed#   r   z$KerberosClientSSPI.encryption_neededc                    s   | j ||S r   )r   GSS_Wrap)r   data
message_nor   r   r   encrypt&   s   zKerberosClientSSPI.encryptinitNc                    s   | j j||||dS )N)	direction	auth_data)r   
GSS_Unwrap)r   r#   r$   r'   r(   r   r   r   decrypt)   s   zKerberosClientSSPI.decryptc                 C   s   | j d u r| j | _ | j S r   )r   r   get_session_keyr   r   r   r   r+   ,   s   
z"KerberosClientSSPI.get_session_keyr   c              
      s  zt j|v st j|v r| jdkrEt jt jB t jB t jB t jB t jB }| jj	|||||d\}| _
}	|	d ur8|	|  jd7  _|dd fW S | jdkrt j}| jj	|||||d\}| _
}	|	d urb|	t|j}
t|
d d |  }|   t|| _|  jd7  _|dd fW S td| jj	||||d	\}| _
}	|	d ur|	|  du s|  du r|   t|}t|jd
 d d |  }t|| _|dd fW S  ty } zd d|fW  Y d }~S d }~ww )Nr   )flags
token_datacb_dataclient_name   Tzenc-partr   FzFSSPI Kerberos -RPC - auth encountered too many calls for authenticate.)r,   r.   r/   ticket)r	   USE_DCE_STYLEMUTUAL_AUTHr   r    r   REPLAY_DETECTSEQUENCE_DETECTr   get_ticket_for_spnr   r   loadnativer   r+   r   
gssapi_smbr   	Exceptionr!   r   r   r
   )r   authDatar,   r   r/   spnr.   kwargstokenerraprepsubkeyapreqrawapreqskeyer   r   r   authenticate1   sZ   




zKerberosClientSSPI.authenticate)r&   N)__name__
__module____qualname__r   r   r   r!   r%   r*   r+   r	   
CONNECTIONrF   r   r   r   r   r   	   s    
r   N)"minikerberos.protocol.asn1_structsr   r    minikerberos.protocol.encryptionr   r   r   asyauth.common.winapi.winsspir   r   asyauth.common.winapi.constantsr	   !asyauth.protocols.kerberos.gssapir
   $asyauth.protocols.kerberos.gssapismbr9   r   r   r   r   r   <module>   s    