
    	h>                        S r SSKrSSKr\R                  r " S S5      r " S S\5      r " S S\5      r\S	:X  Ga  S
r\R                  \R                  -  \R                  -  \R                  -  \R                  -  r\R                  " S\\R                   SS5      u  rr\R'                  \R(                  5      r\" S\5        \" \\\S9r\" \\S9r\" SR3                  \R4                  S   \R4                  S   5      5        SrSrSr\R<                  (       a!  \(       a  \" \S   R@                  5      (       a  \S-  r\RC                  \5      u  r"r\" S\-  5        \R<                  (       a  \" \S   R@                  5      S:X  a  OZ\S-  r\RC                  \5      u  r"r\" S\-  5        \R<                  (       d  M  \(       a  \" \S   R@                  5      (       a  M  \" S\RF                  5        \" S\RH                  5        Sr%\RM                  \%5      r'\RQ                  \%\'5        \RS                  \%5      u  r*r'\RW                  \*\'5      r,\,\%:X  d   e\R[                  \%5      r.\R_                  \.5      u  r0r1\" S\15        \%\0:X  d   e\R[                  \%SS9r.\R_                  \.5      u  r0r1\" S\15        \%\0:X  d   e\" S5        gg)a6  
Helper classes for SSPI authentication via the win32security module.

SSPI authentication involves a token-exchange "dance", the exact details
of which depends on the authentication provider used.  There are also
a number of complex flags and constants that need to be used - in most
cases, there are reasonable defaults.

These classes attempt to hide these details from you until you really need
to know.  They are not designed to handle all cases, just the common ones.
If you need finer control than offered here, just use the win32security
functions directly.
    Nc                   T    \ rS rSrS rS rS rS rS rS r	S r
S	 rSS
 jrS rSrg)	_BaseAuth   c                 $    U R                  5         g )N)resetselfs    aC:\Users\julio\OneDrive\Documentos\Trabajo\Ideas Frescas\venv\Lib\site-packages\win32/lib/sspi.py__init___BaseAuth.__init__   s    

    c                 J    SU l         SU l        SU l        SU l        SU l        g)z)Reset everything to an unauthorized stateNFr   )ctxtauthenticatedinitiator_nameservice_namenext_seq_numr   s    r
   r   _BaseAuth.reset   s+    ;?	""  r   c                 H    U R                   nU =R                   S-  sl         U$ )zcGet the next sequence number for a transmission.  Default
implementation is to increment a counter
   )r   )r	   rets     r
   _get_next_seq_num_BaseAuth._get_next_seq_num%   s%     Q
r   c                    U R                   R                  [        R                  5      nUS   n[        R
                  " 5       nUR                  [        R                  " [        U5      [        R                  5      5        UR                  [        R                  " U[        R                  5      5        XS   l        U R                   R                  SX@R                  5       5        US   R                  US   R                  4$ )zEncrypt a string, returning a tuple of (encrypted_data, trailer).
These can be passed to decrypt to get back the original string.
SecurityTrailerr   r   )r   QueryContextAttributessspiconSECPKG_ATTR_SIZESwin32securityPySecBufferDescTypeappendPySecBufferTypelenSECBUFFER_DATASECBUFFER_TOKENBufferEncryptMessager   )r	   datapkg_size_infotrailersizeencbufs        r
   encrypt_BaseAuth.encrypt-   s     		889R9RS#$56224m33CIw?U?UVW))+w7N7NO	
  q			  F,B,B,DEay!1!111r   c                    [         R                  " 5       nUR                  [         R                  " [	        U5      [
        R                  5      5        UR                  [         R                  " [	        U5      [
        R                  5      5        XS   l        X#S   l        U R                  R                  X0R                  5       5        US   R                  $ )zADecrypt a previously encrypted string, returning the orignal datar   r   )r   r    r!   r"   r#   r   r$   r%   r&   r   DecryptMessager   )r	   r(   trailerr+   s       r
   decrypt_BaseAuth.decrypt=   s    224m33CIw?U?UVW))#g,8O8OP	
  q	"q			  )?)?)ABayr   c                    U R                   R                  [        R                  5      nUS   n[        R
                  " 5       nUR                  [        R                  " [        U5      [        R                  5      5        UR                  [        R                  " U[        R                  5      5        XS   l        U R                   R                  SX@R                  5       5        US   R                  $ )zsign a string suitable for transmission, returning the signature.
Passing the data and signature to verify will determine if the data
is unchanged.
MaxSignaturer   r   )r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   MakeSignaturer   )r	   r(   r)   sigsizesigbufs        r
   sign_BaseAuth.signI   s    
 		889R9RS/224m33CIw?U?UVWm33GW=T=TUVq			6+A+A+CDayr   c                    [         R                  " 5       nUR                  [         R                  " [	        U5      [
        R                  5      5        UR                  [         R                  " [	        U5      [
        R                  5      5        XS   l        X#S   l        U R                  R                  X0R                  5       5        g)zWVerifies data and its signature.  If verification fails, an sspi.error
will be raised.
r   r   N)r   r    r!   r"   r#   r   r$   r%   r&   r   VerifySignaturer   )r	   r(   sigr7   s       r
   verify_BaseAuth.verifyX   s     224m33CIw?U?UVWm33CHg>U>UVWq	q			!!&*@*@*BCr   c                    [         R                  " 5       nUR                  [         R                  " [	        U5      [
        R                  5      5        XS   l        UR                  [         R                  " S[
        R                  5      5        U R                  R                  X R                  5       5      nUS   R                  nXC[
        R                  :X  + 4$ )a  
GSSAPI's unwrap with SSPI.
https://learn.microsoft.com/en-us/windows/win32/secauthn/sspi-kerberos-interoperability-with-gssapi

Usable mainly with Kerberos SSPI package, but this is not enforced.

Return the clear text, and a boolean that is True if the token was encrypted.
r   r   )r   r    r!   r"   r#   r   SECBUFFER_STREAMr&   r$   r   r/   r   SECQOP_WRAP_NO_ENCRYPT)r	   tokenbufferpfQOPrs        r
   unwrap_BaseAuth.unwrapd   s     224))#e*g6N6NO	
 !q	 	m33Aw7M7MNO		((1G1G1IJ1I > >???r   c                    U R                   R                  [        R                  5      nUS   nUS   n[        R
                  " 5       nUR                  [        R                  " [        U5      [        R                  5      5        XS   l
        UR                  [        R                  " U[        R                  5      5        UR                  [        R                  " U[        R                  5      5        U(       a  SO[        R                  nU R                   R                  XvU R                  5       5        US   R                  US   R                  -   US   R                  -   nU$ )a  
GSSAPI's wrap with SSPI.
https://learn.microsoft.com/en-us/windows/win32/secauthn/sspi-kerberos-interoperability-with-gssapi

Usable mainly with Kerberos SSPI package, but this is not enforced.

Wrap a message to be sent to the other side. Encrypted if encrypt is True.
r   	BlockSizer   r      )r   r   r   r   r   r    r!   r"   r#   r$   r&   r%   SECBUFFER_PADDINGrA   r'   r   )	r	   msgr,   	size_infotrailer_size
block_sizerC   fQOPrE   s	            r
   wrap_BaseAuth.wrap}   s    II44W5N5NO	 !23{+
224 	m33CHg>T>TUVq	 	)),8O8OP	

 	))*g6O6OP	
 q!?!?		  t/E/E/GH 1Ivay///&)2B2BBr   c                     U R                   (       d  [        S5      e U R                  R                  [        R
                  5      nUu  U l        U l        g! [         a     gf = f)zHAdds initiator and service names in the security context for ease of usez+Sec context is not completely authenticatedN)	r   
ValueErrorr   r   r   SECPKG_ATTR_NATIVE_NAMESr   r   error)r	   namess     r
   _amend_ctx_name_BaseAuth._amend_ctx_name   s\    !!JKK	;II44W5U5UVE
 6;2D!2	  		s   )A 
A$#A$)r   r   r   r   r   N)F)__name__
__module____qualname____firstlineno__r   r   r   r,   r1   r8   r=   rF   rQ   rX   __static_attributes__ r   r
   r   r      s7    2 
  
D@2#J;r   r   c                   F    \ rS rSrSrSSSS\R                  4S jrS rSr	g)
ClientAuth   z;Manages the client side of an SSPI authentication handshakeNc                    UcC  [         R                  [         R                  -  [         R                  -  [         R                  -  nXPl        X`l        X@l        [        R                  " U5      U l
        [        R                  " UU R                  S   [         R                  S U5      u  U l        U l        [        R!                  U 5        g NName)r   ISC_REQ_INTEGRITYISC_REQ_SEQUENCE_DETECTISC_REQ_REPLAY_DETECTISC_REQ_CONFIDENTIALITYscflagsdatarep	targetspnr   QuerySecurityPackageInfopkg_infoAcquireCredentialsHandleSECPKG_CRED_OUTBOUNDcredentialscredentials_expiryr   r   )r	   pkg_nameclient_name	auth_inforl   rj   rk   s          r
   r   ClientAuth.__init__   s     ?))112//0 112  "%>>xH 22MM&!((
	
# 	4 r   c           
         Ub  [        U[        R                  5      (       d`  [        R                  " 5       n[        R                  " U R                  S   [
        R                  5      nXl        UR                  U5        Un[        R                  " 5       n[        R                  " U R                  S   [
        R                  5      nUR                  U5        U R                  nU R                  c  [        R                  " 5       U l	        [        R                  " U R                  UU R                  U R                  U R                  UU R                  U5      u  pgnXpl        Xl        U[
        R$                  [
        R&                  4;   a  U R                  R)                  U5        US:H  U l        U R*                  (       a  U R-                  5         Xd4$ )zVPerform *one* step of the client authentication process. Pass None for the first roundMaxTokenr   )
isinstancer   r    r"   rn   r   r%   r&   r!   r   PyCtxtHandleTypeInitializeSecurityContextrq   rl   rj   rk   	ctxt_attrctxt_expirySEC_I_COMPLETE_NEEDEDSEC_I_COMPLETE_AND_CONTINUECompleteAuthTokenr   rX   	r	   sec_buffer_insec_buffer_newtokenbufsec_buffer_outctxtinerrattrexps	            r
   	authorizeClientAuth.authorize   sv   $Z=<<.
 .
 +>>@N$44j)7+B+BH ,O!!(+*M&::< 00MM*%w'>'>
 	h'99%668DI&@@NNLLLLII	
3 700'2U2UVVII''7 AX  """r   )
r   rq   rr   r   r|   r}   rk   rn   rj   rl   
rZ   r[   r\   r]   __doc__r   SECURITY_NETWORK_DREPr   r   r^   r_   r   r
   ra   ra      s'    E
 --!@,#r   ra   c                   B    \ rS rSrSrSS\R                  4S jrS rSr	g)
ServerAuthi  z;Manages the server side of an SSPI authentication handshakeNc                    X l         X@l        UcC  [        R                  [        R                  -  [        R
                  -  [        R                  -  nX0l        [        R                  " U5      U l
        [        R                  " X R                  S   [        R                  S S 5      u  U l        U l        [        R!                  U 5        g rd   )spnrk   r   ASC_REQ_INTEGRITYASC_REQ_SEQUENCE_DETECTASC_REQ_REPLAY_DETECTASC_REQ_CONFIDENTIALITYrj   r   rm   rn   ro   SECPKG_CRED_INBOUNDrq   rr   r   r   )r	   rs   r   rj   rk   s        r
   r   ServerAuth.__init__  s     ?))112//0 112  %>>xH
 22v&(C(CT4
	
# 	4 r   c           	         Ub  [        U[        R                  5      (       d`  [        R                  " 5       n[        R                  " U R                  S   [
        R                  5      nXl        UR                  U5        Un[        R                  " 5       n[        R                  " U R                  S   [
        R                  5      nUR                  U5        U R                  nU R                  c  [        R                  " 5       U l	        [        R                  " U R                  UUU R                  U R                  U R                  U5      u  pgnXpl        Xl        U[
        R"                  [
        R$                  4;   a  U R                  R'                  U5        US:H  U l        U R(                  (       a  U R+                  5         Xd4$ )z8Perform *one* step of the server authentication process.rx   r   )ry   r   r    r"   rn   r   r%   r&   r!   r   rz   AcceptSecurityContextrq   rj   rk   r|   r}   r~   r   r   r   rX   r   s	            r
   r   ServerAuth.authorize   so   $Z=<<.
 .
 +>>@N$44j)7+B+BH ,O!!(+*M&::< 00MM*%w'>'>
 	h'99%668DI&<<LLLLII
3 700'2U2UVVII''7 AX  """r   )
r   rq   rr   r   r|   r}   rk   rn   rj   r   r   r_   r   r
   r   r     s    E !$8U8U!6-#r   r   __main__KerberoszWe are:)rj   rl   )rj   zSSP : {} ({})re   Commentr   zClient step %szServer step %sz%Initiator name from the service side:z%Service name from the client side:   s   hellozencrypted ?T)r,   zcool!)2r   r   r   rV   r   ra   r   rZ   sspISC_REQ_MUTUAL_AUTHrf   rg   ri   rh   flagsro   r   cred_handler   QueryCredentialsAttributesSECPKG_CRED_ATTR_NAMEScredprint
sspiclient
sspiserverformatrn   
sec_bufferclient_stepserver_stepr   r#   r&   r   r   r   r   r(   r8   r<   r=   r,   	encryptedr1   	decryptedrQ   wrappedrF   	unwrappedwas_encryptedr_   r   r
   <module>r      s     V; V;rO# O#dK# K#\ z C 	##

#
#	$

)
)	* 
)
)	* 
'
'		( 
 %==c7..dK 11'2P2PQD	)T C$?JC/J	')<)<Y)G	
 JKK&&:#jm>R>R:S:Sq$..z:Z,-##JqM,@,@(AQ(Fq$..z:Z,- &&&:#jm>R>R:S:S 

1:3L3LM	
1:3J3JKD //$
CdC   ''-NIs""9c2I ood#G)009I}	-'9 oodDo1G)009I}	-'9	'N[ r   