3
O6b`              7   @   s  d Z ddlZddlZddlZddlZddlZyddlmZ W n  ek
r\   ddl	mZ Y nX dZ
dZy2ddlZeeeejjddd d`krdZW n: ek
r   yddlZW n ek
r   dZ
Y nX Y nX dd	lmZmZ dd
lmZ ddlmZ ddlmZmZmZ ddlmZ ddl m!Z! ddl"m#Z#m$Z$ ddl%m&Z& e'ddddddddgZ(G dd de)Z*edddddd d!gZ+ed"d#d$d%gZ,ed&d'gZ-d(d) Z.erd*d+ Z/ej0Z1ej2Z3n2dd,l4m5Z6m7Z8 d-d+ Z/ee6fd.d/Z1e8fd0d1Z3ydd2l9m:Z; W nF ek
rJ   ydd2lm:Z; W n ek
rD   d3d4 Z;Y nX Y nX ydd5lm<Z< W n> ek
r   er~d6d7 Z=ne>fd8d7Z=e=fd9d:Z<Y nX d;d< Z?d=d> Z@d?d@ ZAdAdB ZBdCdD ZCdEdF ZDdGdH ZEdIdJ ZFdKdL ZGdMdN ZHdOdP ZIdQdR ZJeGeEeIeHe!eFejKeAddSejKeAddSeJdT	ZLG dUdV dVe)ZMG dWdX dXeMZNG dYdZ dZeMZOeOejKeNddSejKeNddSejKeNddSd[ZPd\d] ZQd^d_ ZRdS )azAuthentication helpers.    N)quoteTF.      )standard_b64decodestandard_b64encode)
namedtuple)Binary)string_type_unicodePY3)SON)_authenticate_aws)ConfigurationErrorOperationFailure)saslprepGSSAPIz
MONGODB-CRzMONGODB-X509zMONGODB-AWSPLAINzSCRAM-SHA-1zSCRAM-SHA-256DEFAULTc               @   s8   e Zd ZdZed Zdd Zdd Zdd Zdd	 Z	d
S )_Cachedatac             C   s
   d | _ d S )N)r   )self r   K/var/www/html/sandeepIITI/myenv/lib/python3.6/site-packages/pymongo/auth.py__init__D   s    z_Cache.__init__c             C   s   t |trdS tS )NT)
isinstancer   NotImplemented)r   otherr   r   r   __eq__G   s    
z_Cache.__eq__c             C   s   t |trdS tS )NF)r   r   r   )r   r   r   r   r   __ne__M   s    
z_Cache.__ne__c             C   s   | j S )N)	_hash_val)r   r   r   r   __hash__R   s    z_Cache.__hash__N)r   )
__name__
__module____qualname__	__slots__hashr    r   r   r   r!   r   r   r   r   r   ?   s   r   MongoCredential	mechanismsourceusernamepasswordmechanism_propertiescacheGSSAPIPropertiesservice_namecanonicalize_host_nameservice_realmZAWSPropertiesaws_session_tokenc             C   s  | dkr|dkrt d| f | dkr|dk	r>|dkr>td|jdi }|jd	d
}|jdd}|jd}	t|||	d}
t| d|||
dS | dkr|dk	rt d|dk	r|dkrtdt| d|dddS | dkr>|dk	r|dkrt d|dk	r|dkrt d|jdi }|jd}t|d}
t| d|||
dS | dkrj|pV|pVd}t| |||ddS |px|pxd}|dkrt dt| |||dt S dS )z=Build and return a mechanism specific credentials tuple.
    MONGODB-X509MONGODB-AWSNz%s requires a username.r   z	$externalz:authentication source must be $external or None for GSSAPIZauthmechanismpropertiesZSERVICE_NAMEZmongodbZCANONICALIZE_HOST_NAMEFZSERVICE_REALM)r/   r0   r1   z+Passwords are not supported by MONGODB-X509z@authentication source must be $external or None for MONGODB-X509z;username without a password is not supported by MONGODB-AWSz?authentication source must be $external or None for MONGODB-AWSZAWS_SESSION_TOKEN)r2   r   ZadminzA password is required.)r3   r4   )r   
ValueErrorgetr.   r'   _AWSPropertiesr   )Zmechr)   userpasswdextraZdatabaseZ
propertiesr/   Zcanonicalizer1   propsr2   Zsource_databaser   r   r   _build_credentials_tuplem   sR    





r<   c             C   s   dj dd t| |D S )z+XOR two byte strings together (python 3.x).    c             S   s   g | ]\}}t ||A gqS r   )bytes).0xyr   r   r   
<listcomp>   s    z_xor.<locals>.<listcomp>)joinzip)firsecr   r   r   _xor   s    rG   )hexlify	unhexlifyc             C   s   dj dd t| |D S )z+XOR two byte strings together (python 2.x).r=   c             S   s$   g | ]\}}t t|t|A qS r   )chrord)r?   r@   rA   r   r   r   rB      s    z_xor.<locals>.<listcomp>)rC   rD   )rE   rF   r   r   r   rG      s    c             C   s   ||| dS )z3An implementation of int.from_bytes for python 2.x.   r   )valuedummy_int_hexlifyr   r   r   _from_bytes   s    rQ   c             C   s   dd| f }|||  S )z1An implementation of int.to_bytes for python 2.x.z%%0%dxr   r   )rM   lengthrN   
_unhexlifyfmtr   r   r   	_to_bytes   s    rU   )pbkdf2_hmacc             C   sx   t j|dtt| }|fdd}t}t}||d }||d}	x*t|d D ]}
||}|	||dN }	qLW ||	|jdS )z'A simple implementation of PBKDF2-HMAC.Nc             S   s   |j  }|j|  |j S )zGet a digest for msg.)copyupdatedigest)msgmacZ_macr   r   r   _digest   s    
z_hi.<locals>._digests      big   )hmacHMACgetattrhashlibrQ   rU   rangedigest_size)	hash_namer   salt
iterationsr[   r\   
from_bytesto_bytesZ_u1Z_ui_r   r   r   _hi   s    
rk   )compare_digestc             C   s   | |A S )Nr   )abr   r   r   
_xor_bytes   s    ro   c             C   s   || ||A S )Nr   )rm   rn   _ordr   r   r   ro      s    c             C   sf   d }|}t | t |kr | }d}t | t |kr8|}d}x$t||D ]\}}||||O }qDW |dkS )Nr   r^   )lenrD   )rm   rn   ro   leftrightresultr@   rA   r   r   r   rl      s    rl   c             C   s   t dd | jdD S )z-Split a scram response into key, value pairs.c             s   s   | ]}|j d dV  qdS )   =r^   N)split)r?   itemr   r   r   	<genexpr>   s    z(_parse_scram_response.<locals>.<genexpr>   ,)dictrv   )responser   r   r   _parse_scram_response   s    r|   c             C   sr   | j }|jdjddjdd}ttjd}d| d | }tdd|fdtd| fddddifg}|||fS )Nzutf-8ru   s   =3Dry   s   =2C    s   n=s   ,r=	saslStartr^   r(   payloads   n,,autoAuthorizeoptionsZskipEmptyExchangeT)r~   r^   )r   r^   )r*   encodereplacer   osurandomr   r	   )credentialsr(   r*   r8   nonce
first_barecmdr   r   r   _authenticate_scram_start  s    r   c              C   sl  | j }|dkr*d}tj}t| jjd}nd}tj}t|| jjd}| j}| j	}t
j}	|jj| }
|
r|
j r|
j\}}|
j}nt| |\}}}|j||}|d }t|}t|d }|dk rtd|d	 }|d
 }|j|stdd| }|jr|j\}}}}nd\}}}}| s4||ks4||krtt||t||}|	|d|j }|	|d|j }||||f|_||j }dj|||f}|	|||j }dtt|| }dj||f}t|	|||j }tdd|d fdt|fg}|j||}t|d }t |d |s"td|d shtdd|d fdtdfg}|j||}|d shtddS )zAuthenticate using SCRAM.zSCRAM-SHA-256sha256zutf-8sha1r      ii   z+Server returned an invalid iteration count.   s   rz!Server returned an invalid nonce.s	   c=biws,r=Ns
   Client Keys
   Server Keyry   s   p=saslContinuer^   conversationId   vz%Server returned an invalid signature.doner=   z%SASL conversation failed to complete.)NNNN)r   r^   )r   r^   )!r*   rb   r   r   r+   r   r   _password_digestr)   r-   r_   r`   auth_ctxr6   speculate_succeeded
scram_dataspeculative_authenticater   commandr|   intr   
startswithr   rk   r   rY   rC   r   rG   r   r	   rl   ) r   	sock_infor(   r*   rY   	digestmodr   r)   r-   Z_hmacctxr   r   resr   Zserver_firstparsedrg   rf   ZrnonceZwithout_proofZ
client_keyZ
server_keyZcsaltZciterationsZsalted_passZ
stored_keyZauth_msgZ
client_sigZclient_proofZclient_finalZ
server_sigr   r   r   _authenticate_scram  st    





r   c             C   sx   t |tstdtjf t|dkr.tdt | tsHtdtjf tj }d| |f }|j|j	d t
|j S )z5Get a password digest to use for authentication.
    z"password must be an instance of %sr   zpassword can't be emptyz#password must be an instance of  %sz%s:mongo:%szutf-8)r   r
   	TypeErrorr"   rq   r5   rb   md5rX   r   r   	hexdigest)r*   r+   md5hashr   r   r   r   r   ^  s    

r   c             C   s<   t ||}tj }d| ||f }|j|jd t|j S )z/Get an auth key to use for authentication.
    z%s%s%szutf-8)r   rb   r   rX   r   r   r   )r   r*   r+   rY   r   r   r   r   r   	_auth_keyp  s
    
r   c             C   s`   t j| dddt jt jd \}}}}}yt j|t j}W n t jk
rR   |j S X |d j S )z2Canonicalize hostname following MIT-krb5 behavior.Nr   )socketgetaddrinfoIPPROTO_TCPAI_CANONNAMEgetnameinfoNI_NAMEREQDgaierrorlower)hostnameafsocktypeproto	canonnamesockaddrnamer   r   r   _canonicalize_hostnamez  s    "
r   c             C   s  t stdyH| j}| j}| j}|jd }|jr:t|}|jd | }|j	dk	r`|d |j	 }|dk	rt
rdjt|t|f}tj||tjd\}}	qd|kr|jdd\}
}n
|d }
}tj|tj|
||d\}}	ntj|tjd\}}	|tjkrtd	zBtj|	d
dkr tdtj|	}tddd|fdg}|jd|}xtdD ]p}tj|	t|d }|dkr~tdtj|	pd
}tdd|d fd|fg}|jd|}|tjkrTP qTW tdtj|	t|d dkrtdtj|	tj|	|dkrtdtj|	}tdd|d fd|fg}|jd| W dtj|	 X W n2 tjk
r } ztt|W Y dd}~X nX dS )zAuthenticate using GSSAPI.
    zEThe "kerberos" module must be installed to use GSSAPI authentication.r   @N:)gssflagsr^   )r   r8   domainr+   z&Kerberos context failed to initialize. z*Unknown kerberos failure in step function.r~   r(   r   r   r   z	$external
   r   r   z+Kerberos authentication failed to complete.z0Unknown kerberos failure during GSS_Unwrap step.z.Unknown kerberos failure during GSS_Wrap step.)r~   r^   )r(   r   )r   r^   )r   r^   )r   r^   )HAVE_KERBEROSr   r*   r+   r,   addressr0   r   r/   r1   _USE_PRINCIPALrC   r   kerberosZauthGSSClientInitZGSS_C_MUTUAL_FLAGrv   ZAUTH_GSS_COMPLETEr   ZauthGSSClientStepZauthGSSClientResponser   r   rc   strZauthGSSClientUnwrapZauthGSSClientWrapZauthGSSClientCleanZKrbError)r   r   r*   r+   r;   hostZserviceZ	principalrt   r   r8   r   r   r   r{   rj   excr   r   r   _authenticate_gssapi  s    







r   c             C   sL   | j }| j}| j}d||f jd}td
ddt|fdg}|j|| d	S )z-Authenticate using SASL PLAIN (RFC 4616)
    z %s %szutf-8r~   r^   r(   r   r   r   N)r~   r^   )r(   r   )r   r^   )r)   r*   r+   r   r   r	   r   )r   r   r)   r*   r+   r   r   r   r   r   _authenticate_plain  s    
r   c       
      C   s   | j }| j}| j}t||}tdddtdfdg}|j||}tj|j	dt
jd	}|j|d  |j	dd
 |j j	d }	tdd|d fdt|	fg}|j|| dS )z+Authenticate using CRAM-MD5 (RFC 2195)
    r~   r^   r(   CRAM-MD5r   r=   r   zutf-8)keyr       r   r   N)r~   r^   )r(   r   )r   r^   )r   r^   )r)   r*   r+   r   r   r	   r   r_   r`   r   rb   r   rX   r   )
r   r   r)   r*   r+   r9   r   r{   r[   	challenger   r   r   _authenticate_cram_md5  s     


r   c             C   sT   |j j| }|r|j rdS t| j }| jdkrD|jdk rDtd|jd| dS )z%Authenticate using MONGODB-X509.
    Nr   ziA username is required for MONGODB-X509 authentication when connected to MongoDB versions older than 3.4.z	$external)	r   r6   r   _X509Contextspeculate_commandr*   max_wire_versionr   r   )r   r   r   r   r   r   r   _authenticate_x509  s    r   c       	      C   sb   | j }| j}| j}|j|ddi}|d }t|||}tdd|fd|fd|fg}|j|| dS )	z#Authenticate using MONGODB-CR.
    Zgetnoncer^   r   authenticater8   r   N)r   r^   )r)   r*   r+   r   r   r   )	r   r   r)   r*   r+   r{   r   r   queryr   r   r   _authenticate_mongo_cr-  s    r   c             C   s   |j dkrz| |jkr |j|  }n8| j}|j }|d | j |d< |j||ddjdg }d|krlt| |dS t| |dS n |j dkrt| |dS t| |S d S )	N   r   ZsaslSupportedMechsF)Zpublish_eventszSCRAM-SHA-256zSCRAM-SHA-1   )	r   Znegotiated_mechanismsr)   Z	hello_cmdr*   r   r6   r   r   )r   r   Zmechsr)   r   r   r   r   _authenticate_default@  s    


r   )r(   )	zCRAM-MD5r   z
MONGODB-CRzMONGODB-X509zMONGODB-AWSr   zSCRAM-SHA-1zSCRAM-SHA-256r   c               @   s8   e Zd Zdd Zedd Zdd Zdd Zd	d
 ZdS )_AuthContextc             C   s   || _ d | _d S )N)r   r   )r   r   r   r   r   r   e  s    z_AuthContext.__init__c             C   s   t j| j}|r|| S d S )N)_SPECULATIVE_AUTH_MAPr6   r(   )credsZspec_clsr   r   r   from_credentialsi  s    z_AuthContext.from_credentialsc             C   s   t d S )N)NotImplementedError)r   r   r   r   r   p  s    z_AuthContext.speculate_commandc             C   s   |j | _ d S )N)r   )r   Zhellor   r   r   parse_responses  s    z_AuthContext.parse_responsec             C   s
   t | jS )N)boolr   )r   r   r   r   r   v  s    z _AuthContext.speculate_succeededN)	r"   r#   r$   r   staticmethodr   r   r   r   r   r   r   r   r   d  s
   r   c                   s$   e Zd Z fddZdd Z  ZS )_ScramContextc                s    t t| j| d | _|| _d S )N)superr   r   r   r(   )r   r   r(   )	__class__r   r   r   {  s    z_ScramContext.__init__c             C   s.   t | j| j\}}}| jj|d< ||f| _|S )Ndb)r   r   r(   r)   r   )r   r   r   r   r   r   r   r     s
    
z_ScramContext.speculate_command)r"   r#   r$   r   r   __classcell__r   r   )r   r   r   z  s   r   c               @   s   e Zd Zdd ZdS )r   c             C   s(   t ddg}| jjd k	r$| jj|d< |S )Nr   r^   r(   MONGODB-X509r8   )r   r^   )r(   r   )r   r   r*   )r   r   r   r   r   r     s
    z_X509Context.speculate_commandN)r"   r#   r$   r   r   r   r   r   r     s   r   )zMONGODB-X509zSCRAM-SHA-1zSCRAM-SHA-256r   c             C   s   | j }tj|}|| | dS )zAuthenticate sock_info.N)r(   	_AUTH_MAPr6   )r   r   r(   Z	auth_funcr   r   r   r     s    
r   c             C   s   |j | ddi dS )zLog out from a database.logoutr^   N)r   )r)   r   r   r   r   r     s    r   )r   r   )S__doc__	functoolsrb   r_   r   r   urllibr   ImportErrorurllib.parser   r   Zwinkerberosr   tuplemapr   __version__rv   base64r   r   collectionsr   Zbson.binaryr	   Zbson.py3compatr
   r   r   Zbson.sonr   Zpymongo.auth_awsr   Zpymongo.errorsr   r   Zpymongo.saslprepr   	frozensetZ
MECHANISMSobjectr   r'   r.   r7   r<   rG   rh   rQ   ri   rU   binasciirH   rP   rI   rS   Zbackports.pbkdf2rV   rk   rl   ro   rK   r|   r   r   r   r   r   r   r   r   r   r   r   partialr   r   r   r   r   r   r   r   r   r   r   <module>   s   "5

O
n
