U uc#Y@s<ddlZddlZddlZddlZddlZddlZddlZddlZddlm Z m Z ddl m Z ddl m ZddlmZddlmZddlmZddlmZz,dd lmZdd lmZdd lmZd ZWnek rd ZYnXdZddZ Gddde!Z"e#e"Gddde"Z$e#e$Gddde!Z%e#e%Gddde!Z&e#e&Gddde&Z'e#e'ddZ(ddZ)Gdd d e!Z*e#e*Gd!d"d"e!Z+e#e+e d;d$d%Z,e dd0d1Z1d2Z2e d?d4d5Z3e d6d7Z4d@e5e5e e6e d8d9d:Z7dS)AN)OptionalDict)public)xor)IAuthenticator) PBKDF2HMAC)hashes)default_backend hash_secretType)saslprepTF) AuthAnonymous AuthScramAuthCryptoSign AuthWampCra AuthTicketcreate_authenticatorpbkdf2generate_totp_secret compute_totp check_totpqrcode_from_totp derive_key generate_wcs compute_wcsderive_scram_credentialcKshz6tjttjttjttjttjttjttjti|}Wn"tk rXt d |YnX|f|}|S)a Accepts various keys and values to configure an authenticator. The valid keys depend on the kind of authenticator but all can understand: `authextra`, `authid` and `authrole` :return: an instance implementing IAuthenticator with the given configuration. zUnknown authenticator '{}') rnamerAuthCryptoSignProxyrrAuthAnonymousProxyrKeyError ValueErrorformat)rkwargsklassZ authenticatorr&U/var/www/html/BOARDBOSS/school/venv/lib/python3.8/site-packages/autobahn/wamp/auth.pyrKs0    rc@s4eZdZdZddZeddZddZdd Zd S) r anonymouscKs ||_dSN)_argsselfkwr&r&r'__init__kszAuthAnonymous.__init__cCs|jdtSN authextrar*getdictr,r&r&r'r0nszAuthAnonymous.authextracCs tddS)Nz/on_challenge called on anonymous authentication) RuntimeErrorr,session challenger&r&r' on_challengerszAuthAnonymous.on_challengecCsdSr)r&r,msgr0r&r&r' on_welcomewszAuthAnonymous.on_welcomeN __name__ __module__ __qualname__rr.propertyr0r9r<r&r&r&r'rhs  rc@seZdZdZdS)r zanonymous-proxyNr>r?r@rr&r&r&r'r ~sr c@s4eZdZdZddZeddZddZdd Zd S) rticketcKs:||_z|jd|_Wntk r4tdYnXdS)NrCz.ticket authentication requires 'ticket=' kwarg)r*pop_ticketr!r"r+r&r&r'r.szAuthTicket.__init__cCs|jdtSr/r1r4r&r&r'r0szAuthTicket.authextracCs|jdkst|jS)NrC)methodAssertionErrorrEr6r&r&r'r9szAuthTicket.on_challengecCsdSr)r&r:r&r&r'r<szAuthTicket.on_welcomeNr=r&r&r&r'rs   rc@s4eZdZdZddZeddZddZdd Zd S) rZ cryptosigncKs|D] }|dkrtd||jjqdD]}||kr.td|q.ddlm}|t |d|_ d| d t kr|d d}||j krtd n$| d t |d <|j |d d<| d t  d d|_||_dS) N)r0authidauthroleprivkeyUnexpected key '{}' for {})rJz Must provide '{}' for cryptosignr) CryptosignKeyrJpubkeyr0z,Public key doesn't correspond to private keychannel_binding)keysr"r# __class__r>Zautobahn.wamp.cryptosignrL from_bytesbinasciia2b_hex_privkeyr2r3Z public_key_channel_bindingr*)r,r-keyrLrMr&r&r'r.s0    zAuthCryptoSign.__init__cCs|jdtSr/r1r4r&r&r'r0szAuthCryptoSign.authextracCs(|jjj|jd}|jj|||jdS)N) channel_idZchannel_id_type) _transportZtransport_detailsrWr2rUrTZsign_challenge)r,r7r8rWr&r&r'r9s zAuthCryptoSign.on_challengecCsdSr)r&r:r&r&r'r<szAuthCryptoSign.on_welcomeNr=r&r&r&r'rs  rc@seZdZdZdS)rzcryptosign-proxyNrBr&r&r&r'rsrc Cs:t|t|||ddtjdd}|d\}}}}} } | S)z Internal helper. Returns the salted/hashed password using the argon2id-13 algorithm. The return value is base64-encoded.  secretsaltZ time_costZ memory_costZ parallelismZhash_lentypeversion$)r base64 b64decoder IDsplit) passwordr^ iterationsmemoryZrawhash_tagveroptionsZ salt_data hash_datar&r&r'_hash_argon2id13_secrets rncCst|||ddS)z2 Internal helper for SCRAM authentication rZ)keylen)r)rfr^rgr&r&r'_hash_pbkdf2_secretsrpc@s8eZdZdZdZddZeddZddZd d Z d S) rz Implements "wamp-scram" authentication for components. NOTE: This is a prototype of a draft spec; see https://github.com/wamp-proto/wamp-proto/issues/135 scramcKsts td||_d|_dS)Nz^Cannot support WAMP-SCRAM without argon2_cffi and passlib libraries; install autobahn['scram']) HAS_ARGONr5r* _client_noncer+r&r&r'r.s zAuthScram.__init__cCs,|jdkr"ttdd|_d|jiS)Nasciinonce)rsrb b64encodeosurandomdecoder4r&r&r'r0 s  zAuthScram.authextracCs|jdkst|jdk stddddg}ddg}|D]}||jkr4td|q4|jD]}|||krXtd |qX|jdd }|jd}|jd}t|jd} t|jdd } |jd  d } t |jd} |jd} |j}djd| |d||| d||d d|_ | dkrH| d kr6t dt | || | |_n(| dkrbt| || |_ntd| t|jdtj}td|}t||j tj}t||}t|S)Nrqrvkdfr^rgrhrNz?WAMP-SCRAM challenge option '{}' is required but not specifiedz/WAMP-SCRAM challenge has unknown attribute '{}'rfutf8rHz:{client_first_bare},{server_first},{client_final_no_proof}z n={},r={}zr={},s={},i={}z c={},r={})Zclient_first_bareZ server_firstZclient_final_no_proofru argon2id-13z>WAMP-SCRAM 'argon2id-13' challenge requires 'memory' parameterrz%WAMP-SCRAM specified unknown KDF '{}' Client Keysha256)rFrGrsextrar5r#r2intr*encoder _auth_messager"rn_salted_passwordrphmacnewhashlibrdigest xor_arrayrbrw)r,r7r8Z required_argsZ optional_argskrNZ server_noncer^rgrhrfrH algorithmZ client_nonce client_key stored_keyZclient_signatureZ client_proofr&r&r'r9sb              zAuthScram.on_challengecCsft|d}t|jdtj}t||jtj}t ||sV|j ddS|j ddS)a When the server is satisfied, it sends a 'WELCOME' message. This hook allows us an opportunity to deny the session right before it gets set up -- we check the server-signature thus authorizing the server and if it fails we drop the connection. Zscram_server_signature Server Keyz-Verification of server SCRAM signature failedz1Verification of server SCRAM signature successfulN) rbrcrrrrrrrZcompare_digestlogerrorinfo)r,r7r0Zalleged_server_sig server_keyZserver_signaturer&r&r'r<Js  zAuthScram.on_welcomeN) r>r?r@__doc__rr.rAr0r9r<r&r&r&r'rs  8rc@s4eZdZdZddZeddZddZdd Zd S) rZwampcracKsz|D] }|dkrtd||jjqdD]}||kr.td|q.||_|d|_t|jt sv|j d|_dS)N)r0rHrIr]rK)r]rHzMust provide '{}' for wampcrar]r~) rOr"r#rPr>r*rD_secret isinstancestrrz)r,r-rVr&r&r'r.ds   zAuthWampCra.__init__cCs|jdtSr/r1r4r&r&r'r0vszAuthWampCra.authextracCsV|jd}d|jkr6t||jd|jd|jd}t||jdd}|dS)Nr~r^rgror8ru)rrrrrrz)r,r7r8rV signaturer&r&r'r9zs  zAuthWampCra.on_challengecCsdSr)r&r:r&r&r'r<szAuthWampCra.on_welcomeNr=r&r&r&r'ras  r cCs&t|tksttt|dS)a Generates a new Base32 encoded, random secret. .. seealso:: http://en.wikipedia.org/wiki/Base32 :param length: The length of the entropy used to generate the secret. :type length: int :returns: The generated secret in Base32 (letters ``A-Z`` and digits ``2-7``). The length of the generated secret is ``length * 8 / 5`` octets. :rtype: unicode ru)r_rrGrb b32encoderxryrzlengthr&r&r'rsrcCst|tkstt|tks tzt|}Wntk rJtdYnX|ttd}t d|}t ||t j}d|d@}t d|||ddd @d }d |S) aF Computes the current TOTP code. :param secret: Base32 encoded secret. :type secret: unicode :param offset: Time offset (in steps, use eg -1, 0, +1 for compliance with RFC6238) for which to compute TOTP. :type offset: int :returns: TOTP for current time (+/- offset). :rtype: unicode zinvalid secretz>Qr[z>Irii@Bz{0:06d})r_rrGrrb b32decode TypeError ExceptiontimestructpackrrrZsha1runpackr#)r]offsetrVintervalr;rotokenr&r&r'rs  $rcCs"dD]}|t||krdSqdS)a Check a TOTP value received from a principal trying to authenticate against the expected value computed from the secret shared between the principal and the authenticating entity. The Internet can be slow, and clocks might not match exactly, so some leniency is allowed. RFC6238 recommends looking an extra time step in either direction, which essentially opens the window from 30 seconds to 90 seconds. :param secret: The secret shared between the principal (eg a client) that is authenticating, and the authenticating entity (eg a server). :type secret: unicode :param ticket: The TOTP value to be checked. :type ticket: unicode :returns: ``True`` if the TOTP value is correct, else ``False``. :rtype: bool )rrYr}TF)r)r]rCrr&r&r'rsrcCst|tkrtdt|t|tkrABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789cCs.t|tkstdddt|DdS)aw Generates a new random secret for use with WAMP-CRA. The secret generated is a random character sequence drawn from - upper and lower case latin letters - digits - :param length: The length of the secret to generate. :type length: int :return: The generated secret. The length of the generated is ``length`` octets. :rtype: bytes r|css|]}ttVqdSr))randomchoiceWCS_SECRET_CHARSET).0rir&r&r' Zszgenerate_wcs..ru)r_rrGjoinrangerrr&r&r'rHsrcCsvt|ttfkstt|ttfks(tt|tkr>|d}t|tkrT|d}t||tj }t | S)aY Compute an WAMP-CRA authentication signature from an authentication challenge and a (derived) key. :param key: The key derived (via PBKDF2) from the secret. :type key: bytes :param challenge: The authentication challenge to sign. :type challenge: bytes :return: The authentication signature. :rtype: bytes r~) r_rrrGrrrrrrrRrr)rVr8sigr&r&r'r]s    r)emailrfr^returnc Cs^ts tdddlm}ddlm}|sPt}||d| dd}t |dks`t||d|dd d d |j d d }| d d\}}} } }} |dkst| dkstdddd| dDD} | d} t| dtj } td|  } t| dtj }dt| dt| dt| dt|  dt| dd}|S)a? Derive WAMP-SCRAM credentials from user email and password. The SCRAM parameters used are the following (these are also contained in the returned credentials): * kdf ``argon2id-13`` * time cost ``4096`` * memory cost ``512`` * parallelism ``1`` See `draft-irtf-cfrg-argon2 `__ and `argon2-cffi `__. :param email: User email. :param password: User password. :param salt: Optional salt to use (must be 16 bytes long). If none is given, compute salt from email as ``salt = SHA256(email)[:16]``. :return: WAMP-SCRAM credentials. When serialized, the returned credentials can be copy-pasted into the ``config.json`` node configuration for a Crossbar.io node. zmissing dependency argon2rr r r~NrtiirYrZr[r\ru$Zargon2idzv=19cSsi|]\}}||qSr&r&)rrvr&r&r' sz+derive_scram_credential..cSsg|]}|dqS)=)re)rxr&r&r' sz+derive_scram_credential..,rrrrmt)r{rhrgr^z stored-keyz server-key)rrrGargon2.low_levelr r rrupdaterrlenrdrzrerrrrRb2a_hex)rrfr^r r rrmrirjrparamsZsalted_passwordrrrZ credentialr&r&r'rusH         r)r)r)rrZN)rrZ)r)N)8rxrbrrrRrrrtypingrrZ autobahn.utilrrrZautobahn.wamp.interfacesrZ)cryptography.hazmat.primitives.kdf.pbkdf2rZcryptography.hazmat.primitivesrZcryptography.hazmat.backendsr rr Zargon2r Z passlib.utilsrrrr__all__robjectrregisterr rrrrnrprrrrrrrrrrrrrrr&r&r&r'sr             0  g -      1 "