o
    Åîï]CP  ã                   @   sô  d Z ddlZddlZddlZddlZddlZzddlmZ W n ey-   ddl	mZ Y nw dZ
dZzddlZeeeej d¡dd… ƒƒdkrJdZW n eyf   zddlZW n eyc   dZ
Y nw Y nw dd	lmZmZ dd
lmZ ddlmZ ddlmZmZmZ ddlmZ ddl m!Z!m"Z" ddl#m$Z$ e%g d¢ƒZ&	 G dd„ de'ƒZ(edg d¢ƒZ)	 edg d¢ƒZ*	 dd„ Z+erÉdd„ Z,ej-Z.ej/Z0nddl1m2Z3m4Z5 dd„ Z,ee3fdd„Z.e5fdd „Z0zdd!l6m7Z8 W n! e�y   zdd!lm7Z8 W n e�y   d"d#„ Z8Y nw Y nw zdd$lm9Z9 W n e�y2   e�r$d%d&„ Z:ne;fd'd&„Z:e:fd(d)„Z9Y nw d*d+„ Z<d,d-„ Z=d.d/„ Z>d0d1„ Z?d2d3„ Z@d4d5„ ZAd6d7„ ZBd8d9„ ZCd:d;„ ZDd<d=„ ZEeBe@eDeCeAejFe=d>d?�ejFe=d@d?�eEdAœZGdBdC„ ZHdDdE„ ZIdS )FzAuthentication helpers.é    N)ÚquoteTFÚ.é   )r   é   )Ústandard_b64decodeÚstandard_b64encode)Ú
namedtuple)ÚBinary)Ústring_typeÚ_unicodeÚPY3)ÚSON)ÚConfigurationErrorÚOperationFailure)Úsaslprep)ÚGSSAPIú
MONGODB-CRúMONGODB-X509ÚPLAINúSCRAM-SHA-1úSCRAM-SHA-256ÚDEFAULTc                   @   s8   e Zd ZdZed ƒZdd„ Zdd„ Zdd„ Zdd	„ Z	d
S )Ú_Cache©Údatac                 C   s
   d | _ d S ©Nr   ©Úself© r   ú>/var/www/html/env/lib/python3.10/site-packages/pymongo/auth.pyÚ__init__B   s   
z_Cache.__init__c                 C   ó   t |tƒrdS tS )NT©Ú
isinstancer   ÚNotImplemented©r   Úotherr   r   r   Ú__eq__E   s   
z_Cache.__eq__c                 C   r!   )NFr"   r%   r   r   r   Ú__ne__K   s   
z_Cache.__ne__c                 C   s   | j S r   )Ú	_hash_valr   r   r   r   Ú__hash__P   s   z_Cache.__hash__N)
Ú__name__Ú
__module__Ú__qualname__Ú	__slots__Úhashr)   r    r'   r(   r*   r   r   r   r   r   =   s    r   ÚMongoCredential)Ú	mechanismÚsourceÚusernameÚpasswordÚmechanism_propertiesÚcacheÚGSSAPIProperties©Úservice_nameÚcanonicalize_host_nameÚservice_realmc                 C   s$  | dkr|du rt d| f ƒ‚| dkrF|dur|dkrtdƒ‚| di ¡}| dd	¡}| d
d¡}| d¡}	t|||	d�}
t| d|||
dƒS | dkrg|durRt dƒ‚|dur^|dkr^tdƒ‚t| d|dddƒS | dkrz|pp|ppd}t| |||ddƒS |p|pd}|du rˆt dƒ‚t| |||dtƒ ƒS )z=Build and return a mechanism specific credentials tuple.
    r   Nz%s requires a username.r   ú	$externalz:authentication source must be $external or None for GSSAPIÚauthmechanismpropertiesÚSERVICE_NAMEÚmongodbÚCANONICALIZE_HOST_NAMEFÚSERVICE_REALMr8   z+Passwords are not supported by MONGODB-X509z@authentication source must be $external or None for MONGODB-X509r   ÚadminzA password is required.)r   Ú
ValueErrorÚgetr7   r0   r   )Úmechr2   ÚuserÚpasswdÚextraÚdatabaseÚ
propertiesr9   Úcanonicalizer;   ÚpropsÚsource_databaser   r   r   Ú_build_credentials_tupleg   sF   ÿ
þÿÿÿrN   c                 C   ó   d  dd„ t| |ƒD ƒ¡S )z+XOR two byte strings together (python 3.x).ó    c                 S   s   g | ]\}}t ||A gƒ‘qS r   )Úbytes©Ú.0ÚxÚyr   r   r   Ú
<listcomp>‘   s    ú_xor.<locals>.<listcomp>©ÚjoinÚzip©ÚfirÚsecr   r   r   Ú_xor�   ó   r^   )ÚhexlifyÚ	unhexlifyc                 C   rO   )z+XOR two byte strings together (python 2.x).rP   c                 S   s$   g | ]\}}t t|ƒt|ƒA ƒ‘qS r   )ÚchrÚordrR   r   r   r   rV   �   s   $ rW   rX   r[   r   r   r   r^   ›   r_   c                 C   s   ||| ƒdƒS )z3An implementation of int.from_bytes for python 2.x.é   r   )ÚvalueÚdummyÚ_intÚ_hexlifyr   r   r   Ú_from_bytes    s   ri   c                 C   s   dd| f }|||  ƒS )z1An implementation of int.to_bytes for python 2.x.z%%0%dxr   r   )re   Úlengthrf   Ú
_unhexlifyÚfmtr   r   r   Ú	_to_bytes¥   s   rm   )Úpbkdf2_hmacc                 C   st   t  |dtt| ƒ¡}|fdd„}t}t}||d ƒ}||dƒ}	t|d ƒD ]}
||ƒ}|	||dƒN }	q%||	|jdƒS )z'A simple implementation of PBKDF2-HMAC.Nc                 S   s   |  ¡ }| | ¡ | ¡ S )zGet a digest for msg.)ÚcopyÚupdateÚdigest)ÚmsgÚmacÚ_macr   r   r   Ú_digest¸   s   
z_hi.<locals>._digests      Úbigé   )ÚhmacÚHMACÚgetattrÚhashlibri   rm   ÚrangeÚdigest_size)Ú	hash_namer   ÚsaltÚ
iterationsrs   ru   Ú
from_bytesÚto_bytesÚ_u1Ú_uiÚ_r   r   r   Ú_hi´   s   
r†   )Úcompare_digestc                 C   s   | |A S r   r   )ÚaÚbr   r   r   Ú
_xor_bytesÌ   s   rŠ   c                 C   s   || ƒ||ƒA S r   r   )rˆ   r‰   Ú_ordr   r   r   rŠ   Ï   s   c                 C   sb   d }|}t | ƒt |ƒkr| }d}t | ƒt |ƒkr|}d}t||ƒD ]\}}||||ƒO }q!|dkS )Nr   rw   )ÚlenrZ   )rˆ   r‰   rŠ   ÚleftÚrightÚresultrT   rU   r   r   r   r‡   Ù   s   r‡   c                 C   s   t dd„ |  d¡D ƒƒS )z-Split a scram response into key, value pairs.c                 s   s   � | ]	}|  d d¡V  qdS )ó   =rw   N)Úsplit)rS   Úitemr   r   r   Ú	<genexpr>ê   s   € z(_parse_scram_response.<locals>.<genexpr>ó   ,)Údictr‘   )Úresponser   r   r   Ú_parse_scram_responseè   s   r—   c                  C   s„  | j }|dkrd}tj}t| jƒ d¡}nd}tj}t|| jƒ d¡}| j}| j	}t
j}	| d¡ dd¡ dd¡}
tt d	¡ƒ}d
|
 d | }tdd|fdtd| ƒfdgƒ}| ||¡}|d }t|ƒ}t|d ƒ}|dk rttdƒ‚|d }|d }| |¡s…tdƒ‚d| }|jr”|j\}}}}nd\}}}}|r¤||ks¤||krÄt||t|ƒ|ƒ}|	|d|ƒ ¡ }|	|d|ƒ ¡ }||||f|_||ƒ ¡ }d |||f¡}|	|||ƒ ¡ }dtt||ƒƒ }d ||f¡}t|	|||ƒ ¡ ƒ}tdd|d fdt|ƒfgƒ}| ||¡}t|d ƒ}t|d |ƒ�stdƒ‚|d  �s>tdd|d fdtd!ƒfgƒ}| ||¡}|d  �s@td"ƒ‚d#S d#S )$zAuthenticate using SCRAM.r   Úsha256úutf-8Úsha1r�   s   =3Dr”   s   =2Cé    s   n=s   ,r=©Ú	saslStartrw   r1   Úpayloads   n,,©ÚautoAuthorizerw   ó   ii   z+Server returned an invalid iteration count.ó   só   rz!Server returned an invalid nonce.s	   c=biws,r=)NNNNs
   Client Keys
   Server Keys   p=©ÚsaslContinuerw   ÚconversationIdó   vz%Server returned an invalid signature.ÚdonerP   z%SASL conversation failed to complete.N)r3   r{   r˜   r   r4   Úencoderš   Ú_password_digestr2   r6   rx   ry   Úreplacer   ÚosÚurandomr   r	   Úcommandr—   Úintr   Ú
startswithr   r†   r   rq   rY   r^   r‡   ) ÚcredentialsÚ	sock_infor1   r3   rq   Ú	digestmodr   r2   r6   Ú_hmacrF   ÚnonceÚ
first_bareÚcmdÚresÚserver_firstÚparsedr€   r   ÚrnonceÚwithout_proofÚ
client_keyÚ
server_keyÚcsaltÚciterationsÚsalted_passÚ
stored_keyÚauth_msgÚ
client_sigÚclient_proofÚclient_finalÚ
server_sigr   r   r   Ú_authenticate_scramí   s„   ý
ÿÿ

þ


þ
úrÈ   c                 C   sx   t |tƒstdtjf ƒ‚t|ƒdkrtdƒ‚t | tƒs$tdtjf ƒ‚t ¡ }d| |f }| | 	d¡¡ t
| ¡ ƒS )z5Get a password digest to use for authentication.
    z"password must be an instance of %sr   zpassword can't be emptyz#password must be an instance of  %sz%s:mongo:%sr™   )r#   r
   Ú	TypeErrorr+   rŒ   rC   r{   Úmd5rp   r©   r   Ú	hexdigest)r3   r4   Úmd5hashr   r   r   r   rª   >  s   
ÿ
ÿrª   c                 C   s<   t ||ƒ}t ¡ }d| ||f }| | d¡¡ t| ¡ ƒS )z/Get an auth key to use for authentication.
    z%s%s%sr™   )rª   r{   rÊ   rp   r©   r   rË   )rµ   r3   r4   rq   rÌ   r   r   r   r   Ú	_auth_keyP  s
   
rÍ   c              
   C   sz  t stdƒ‚�z!| j}| j}| j}|jd }|jrt |¡}|j	d | }|j
dur1|d |j
 }|durntrNd t|ƒt|ƒf¡}tj||tjd�\}}	n*d|v r[| dd¡\}
}n|d}
}tj|tj|
||d�\}}	n
tj|tjd�\}}	|tjkr�td	ƒ‚z¡t |	d
¡dkrŽtdƒ‚t |	¡}tddd|fdgƒ}| d|¡}tdƒD ]5}t |	t|d ƒ¡}|dkr»tdƒ‚t |	¡pÁd
}tdd|d fd|fgƒ}| d|¡}|tjkrÜ nq§tdƒ‚t |	t|d ƒ¡dkrñtdƒ‚t |	t |	¡|¡dk�rtdƒ‚t |	¡}tdd|d fd|fgƒ}| d|¡ W t |	¡ W dS t |	¡ w  tj�y< } ztt|ƒƒ‚d}~ww )zAuthenticate using GSSAPI.
    zEThe "kerberos" module must be installed to use GSSAPI authentication.r   ú@Nú:)Úgssflagsrw   )rÐ   rF   Údomainr4   z&Kerberos context failed to initialize.Ú z*Unknown kerberos failure in step function.rœ   )r1   r   rž   rŸ   r<   é
   éÿÿÿÿr¤   r¦   z+Kerberos authentication failed to complete.z0Unknown kerberos failure during GSS_Unwrap step.z.Unknown kerberos failure during GSS_Wrap step.)ÚHAVE_KERBEROSr   r3   r4   r5   Úaddressr:   ÚsocketÚgetfqdnr9   r;   Ú_USE_PRINCIPALrY   r   ÚkerberosÚauthGSSClientInitÚGSS_C_MUTUAL_FLAGr‘   ÚAUTH_GSS_COMPLETEr   ÚauthGSSClientStepÚauthGSSClientResponser   r®   r|   ÚstrÚauthGSSClientUnwrapÚauthGSSClientWrapÚauthGSSClientCleanÚKrbError)r±   r²   r3   r4   rL   ÚhostÚserviceÚ	principalr�   ÚctxrF   rÑ   rž   r·   r–   r…   Úexcr   r   r   Ú_authenticate_gssapiZ  s    


ÿ
þ
ÿ

ý
ÿ
þ
ÿ
ÿÿþþ

þ€ÿrê   c                 C   sL   | j }| j}| j}d||f  d¡}tdddt|ƒfdgƒ}| ||¡ dS )z-Authenticate using SASL PLAIN (RFC 4616)
    z %s %sr™   rœ   )r1   r   rž   rŸ   N)r2   r3   r4   r©   r   r	   r®   )r±   r²   r2   r3   r4   rž   r·   r   r   r   Ú_authenticate_plainÈ  s   
ýrë   c           
      C   s®   | j }| j}| j}t||ƒ}tdddtdƒfdgƒ}| ||¡}tj| 	d¡t
jd�}| |d ¡ | 	d¡d | ¡  	d¡ }	td	d
|d
 fdt|	ƒfgƒ}| ||¡ dS )z+Authenticate using CRAM-MD5 (RFC 2195)
    rœ   )r1   úCRAM-MD5rž   rP   rŸ   r™   )Úkeyr³   ó    r¤   r¦   N)r2   r3   r4   rª   r   r	   r®   rx   ry   r©   r{   rÊ   rp   rË   )
r±   r²   r2   r3   r4   rG   r·   r–   rs   Ú	challenger   r   r   Ú_authenticate_cram_md5Ö  s$   

ý

þrð   c                 C   sD   t ddgƒ}| jdur| j|d< n	|jdk rtdƒ‚| d|¡ dS )z%Authenticate using MONGODB-X509.
    ©Úauthenticaterw   )r1   r   NrF   r   ziA username is required for MONGODB-X509 authentication when connected to MongoDB versions older than 3.4.r<   )r   r3   Úmax_wire_versionr   r®   )r±   r²   Úqueryr   r   r   Ú_authenticate_x509ï  s   ÿ

ÿrõ   c           	      C   sb   | j }| j}| j}| |ddi¡}|d }t|||ƒ}tdd|fd|fd|fgƒ}| ||¡ dS )z#Authenticate using MONGODB-CR.
    Úgetnoncerw   rµ   rñ   rF   rí   N)r2   r3   r4   r®   rÍ   r   )	r±   r²   r2   r3   r4   r–   rµ   rí   rô   r   r   r   Ú_authenticate_mongo_crý  s   ýr÷   c                 C   s‚   |j dkr1| j}tdd|d | j fgƒ}|j||dd� dg ¡}d|v r+t| |dƒS t| |dƒS |j d	kr<t| |dƒS t| |ƒS )
Né   )Úismasterrw   ÚsaslSupportedMechsr   F)Úpublish_eventsr   r   é   )ró   r2   r   r3   r®   rD   rÈ   r÷   )r±   r²   r2   r·   Úmechsr   r   r   Ú_authenticate_default  s"   
þÿÿ

rþ   r   )r1   r   )rì   r   r   r   r   r   r   r   c                 C   s   | j }t |¡}|| |ƒ dS )zAuthenticate sock_info.N)r1   Ú	_AUTH_MAPrD   )r±   r²   r1   Ú	auth_funcr   r   r   rò   0  s   
rò   c                 C   s   |  | ddi¡ dS )zLog out from a database.Úlogoutrw   N)r®   )r2   r²   r   r   r   r  7  s   r  )JÚ__doc__Ú	functoolsr{   rx   r¬   r×   Úurllibr   ÚImportErrorÚurllib.parserÕ   rÙ   ÚwinkerberosrÚ   ÚtupleÚmapr¯   Ú__version__r‘   Úbase64r   r   Úcollectionsr   Úbson.binaryr	   Úbson.py3compatr
   r   r   Úbson.sonr   Úpymongo.errorsr   r   Úpymongo.saslprepr   Ú	frozensetÚ
MECHANISMSÚobjectr   r0   r7   rN   r^   r�   ri   r‚   rm   Úbinasciir`   rh   ra   rk   Úbackports.pbkdf2rn   r†   r‡   rŠ   rc   r—   rÈ   rª   rÍ   rê   rë   rð   rõ   r÷   rþ   Úpartialrÿ   rò   r  r   r   r   r   Ú<module>   sÆ   ÿ"€ÿ€ýÿþÿ'þ€ü

ñQ
nÿÿö