관리-도구
편집 파일: scram.cpython-39.pyc
a f�Wc X � @ s� d Z ddlZe�e�ZddlmZmZmZm Z ddl m Z m Z ddl mZmZmZmZ ddlmZmZ ddlm mZ dgZG dd� dejejej ej �Z dS ) z:passlib.handlers.scram - hash for SCRAM credential storage� N)�consteq�saslprep� to_native_str� splitcomma)� ab64_decode� ab64_encode)� bascii_to_str� iteritems�u�native_string_types)� pbkdf2_hmac�norm_hash_name�scramc s� e Zd ZdZd ZdZed�ZdZdZ dZ dZ dZ d Z g d �Zg d �Zd Zed d� �Zed'dd��Zedd� �Zedd� �Zdd� Zed(� fdd� �Zd)� fdd� Zd*d d �Zed d � �Z� fd!d"�Zd+d#d$�Z ed,d%d&��Z � Z S )-r aZ This class provides a format for storing SCRAM passwords, and follows the :ref:`password-hash-api`. It supports a variable-length salt, and a variable number of rounds. The :meth:`~passlib.ifc.PasswordHash.using` method accepts the following optional keywords: :type salt: bytes :param salt: Optional salt bytes. If specified, the length must be between 0-1024 bytes. If not specified, a 12 byte salt will be autogenerated (this is recommended). :type salt_size: int :param salt_size: Optional number of bytes to use when autogenerating new salts. Defaults to 12 bytes, but can be any value between 0 and 1024. :type rounds: int :param rounds: Optional number of rounds to use. Defaults to 100000, but must be within ``range(1,1<<32)``. :type algs: list of strings :param algs: Specify list of digest algorithms to use. By default each scram hash will contain digests for SHA-1, SHA-256, and SHA-512. This can be overridden by specify either be a list such as ``["sha-1", "sha-256"]``, or a comma-separated string such as ``"sha-1, sha-256"``. Names are case insensitive, and may use :mod:`!hashlib` or `IANA <http://www.iana.org/assignments/hash-function-text-names>`_ hash names. :type relaxed: bool :param relaxed: By default, providing an invalid value for one of the other keywords will result in a :exc:`ValueError`. If ``relaxed=True``, and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning` will be issued instead. Correctable errors include ``rounds`` that are too small or too large, and ``salt`` strings that are too long. .. versionadded:: 1.6 In addition to the standard :ref:`password-hash-api` methods, this class also provides the following methods for manipulating Passlib scram hashes in ways useful for pluging into a SCRAM protocol stack: .. automethod:: extract_digest_info .. automethod:: extract_digest_algs .. automethod:: derive_digest )�saltZ salt_size�rounds�algs�$scram$� i i�� � l �� Zlinear)�sha-1�sha-256�sha-512)r r zsha-224zsha-384r Nc C s8 t |d�}| �|�}|j}|s&td��|j|j|| fS )a� return (salt, rounds, digest) for specific hash algorithm. :type hash: str :arg hash: :class:`!scram` hash stored for desired user :type alg: str :arg alg: Name of digest algorithm (e.g. ``"sha-1"``) requested by client. This value is run through :func:`~passlib.crypto.digest.norm_hash_name`, so it is case-insensitive, and can be the raw SCRAM mechanism name (e.g. ``"SCRAM-SHA-1"``), the IANA name, or the hashlib name. :raises KeyError: If the hash does not contain an entry for the requested digest algorithm. :returns: A tuple containing ``(salt, rounds, digest)``, where *digest* matches the raw bytes returned by SCRAM's :func:`Hi` function for the stored password, the provided *salt*, and the iteration count (*rounds*). *salt* and *digest* are both raw (unencoded) bytes. �ianaz scram hash contains no digests)r � from_string�checksum� ValueErrorr r )�cls�hash�alg�self�chkmap� r! �:/usr/lib/python3.9/site-packages/passlib/handlers/scram.py�extract_digest_info| s zscram.extract_digest_infor c s. | � |�j}� dkr|S � fdd�|D �S dS )a� Return names of all algorithms stored in a given hash. :type hash: str :arg hash: The :class:`!scram` hash to parse :type format: str :param format: This changes the naming convention used by the returned algorithm names. By default the names are IANA-compatible; possible values are ``"iana"`` or ``"hashlib"``. :returns: Returns a list of digest algorithms; e.g. ``["sha-1"]`` r c s g | ]}t |� ��qS r! �r ��.0r ��formatr! r" � <listcomp>� � z-scram.extract_digest_algs.<locals>.<listcomp>N)r r )r r r( r r! r' r" �extract_digest_algs� s zscram.extract_digest_algsc C s& t |t�r|�d�}t|t|�||�S )a; helper to create SaltedPassword digest for SCRAM. This performs the step in the SCRAM protocol described as:: SaltedPassword := Hi(Normalize(password), salt, i) :type password: unicode or utf-8 bytes :arg password: password to run through digest :type salt: bytes :arg salt: raw salt data :type rounds: int :arg rounds: number of iterations. :type alg: str :arg alg: name of digest to use (e.g. ``"sha-1"``). :returns: raw bytes of ``SaltedPassword`` zutf-8)� isinstance�bytes�decoder r )r �passwordr r r r! r! r" � derive_digest� s zscram.derive_digestc C s< t |dd�}|�d�s"tj�| ��|dd � �d�}t|�dkrLtj�| ��|\}}}t|�}|t |�krvtj�| ��zt |� d��}W n t y� tj�| ��Y n0 |s�tj�| ��nrd|v �r$d }i } |�d�D ]J} | �d�\} } zt | � d��| | < W q� t �y tj�| ��Y q�0 q�n|}d } | ||| |d �S ) N�asciir r � �$� �=�,)r r r r ) r � startswith�uh�excZInvalidHashError�split�lenZMalformedHashError�int�strr �encode� TypeError) r r �partsZ rounds_strZsalt_str�chk_strr r r r Zpairr �digestr! r! r" r � sB �zscram.from_stringc s> t t| j��}| j� d�� fdd�| jD ��}d| j||f S )Nr6 c 3 s& | ] }d |t t� | ��f V qdS )z%s=%sN)r r r% �r r! r" � <genexpr> s �z"scram.to_string.<locals>.<genexpr>z$scram$%d$%s$%s)r r r r �joinr r )r r rA r! rC r" � to_string s �zscram.to_stringc sF |d ur|d u sJ �|}t t| �jf i |��}|d urB| �|�|_|S �N)�superr �using� _norm_algs� default_algs)r rK r �kwds�subcls�� __class__r! r" rI s z scram.usingc s� t t| �jf i |�� | j}|d ur@|d ur4td��| �|�}nN|d urX| �|�� �}n6| jr�t| j �}| �|�|ks�J d|f ��nt d��|| _ d S )Nz+checksum & algs kwds are mutually exclusivezinvalid default algs: %rzno algs list specified) rH r �__init__r � RuntimeErrorrJ �keysZ use_defaults�listrK r? r )r r rL Z digest_maprN r! r" rP + s zscram.__init__Fc C s� t |t�stj�|dd��t|�D ]X\}}|t|d�krFtd|f ��t|�dkr`td|f ��t |t �s"tj�|dd��q"d |vr�td ��|S ) N�dictr r z*malformed algorithm name in scram hash: %r� z0SCRAM limits algorithm names to 9 characters: %rz raw bytesZdigestsr �-sha-1 must be in algorithm list of scram hash) r, rT r8 r9 ZExpectedTypeErrorr r r r; r- )r r Zrelaxedr rB r! r! r" �_norm_checksum> s � � zscram._norm_checksumc C sR t |t�rt|�}tdd� |D ��}tdd� |D ��r>td��d|vrNtd��|S )znormalize algs parameterc s s | ]}t |d �V qdS )r Nr$ r% r! r! r" rD U r* z#scram._norm_algs.<locals>.<genexpr>c s s | ]}t |�d kV qdS )rU N)r; r% r! r! r" rD V r* z-SCRAM limits alg names to max of 9 charactersr rV )r, r r �sorted�anyr )r r r! r! r" rJ P s zscram._norm_algsc s, t | j��| j�sdS tt| �jf i |��S )NT)�setr � issupersetrK rH r �_calc_needs_update)r rL rN r! r" r\ ` s zscram._calc_needs_updatec sF | j �| j�| j� |r$� ���|�S t� ���fdd�| jD ��S d S )Nc 3 s | ]}|� ���|�fV qd S rG r! r% �r r r �secretr! r" rD v s �z'scram._calc_checksum.<locals>.<genexpr>)r r r0 rT r )r r^ r r! r] r" �_calc_checksumm s �zscram._calc_checksumc C s� t �|� | �|�}|j}|s2td| j| jf ��|r�d }}t|�D ]R\}} |�||�} t| �t| �kr�td|t| �t| �f ��t | | �r�d}qFd}qF|r�|r�td��q�|S n:|j D ]*}||v r�|�||�} t | || � S q�t d��d S )Nz.expected %s hash, got %s config string insteadFz+mis-sized %s digest in scram hash: %r != %rTz4scram hash verified inconsistently, may be corruptedzsha-1 digest not found!) r8 Zvalidate_secretr r r �namer r_ r; r � _verify_algs�AssertionError) r r^ r Zfullr r ZcorrectZfailedr rB �otherr! r! r" �verify{ s4 � � z scram.verify)r )NN)N)F)N)F) �__name__� __module__� __qualname__�__doc__r` Z setting_kwdsr �identZdefault_salt_sizeZ max_salt_sizeZdefault_roundsZ min_roundsZ max_roundsZ rounds_costrK ra r � classmethodr# r+ r0 r rF rI rP rW rJ r\ r_ rd � __classcell__r! r! rN r" r s@ A % / ) rh ZloggingZ getLoggerre �logZ passlib.utilsr r r r Zpasslib.utils.binaryr r Zpasslib.utils.compatr r r r Zpasslib.crypto.digestr r Zpasslib.utils.handlersZutils�handlersr8 �__all__Z HasRoundsZ HasRawSaltZHasRawChecksumZGenericHandlerr r! r! r! r" �<module> s �