o
    j^;                     @   s  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	 d dlm
Z
 d dlmZ d dlmZ d d	lmZmZ d d
lmZmZmZ d dlmZmZmZmZ d dlmZ d dlmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8 d dl9m:Z: d dl;m<Z<m=Z=m>Z> d dl?m@Z@ dd ZAG dd dZBG dd dZCdS )    N)hashlib)cms)algos)core)x509)keys)parse_pkcs12)rsa_pkcs1v15_signload_private_key)	NAME_TYPEMESSAGE_TYPE
PaDataType)Enctype_checksum_table_enctype_tableKey)AuthenticatorChecksum)KDC_REQ_BODYPrincipalNameHostAddress
KDCOptionsEncASRepPartAP_REQAuthorizationDataChecksum	krb5_pvnoRealmEncryptionKeyAuthenticatorTicket	APOptionsEncryptedDataAS_REQAP_REP)
PKAuthenticatorAuthPackDunno1Dunno2MetaDataInfo
CertIssuerCertIssuersPA_PK_AS_REPKDCDHKeyInfo)KRB_FINISHED)LSAP_TOKEN_INFO_INTEGRITYKERB_AD_RESTRICTION_ENTRYKERB_AD_RESTRICTION_ENTRYS)GSSAPIFlagsc                 C   sP   | dkr| j ddddS |  |  d d d}dt|B j dddd}|| S )	N      bigFsigned         )to_bytes
bit_lengthlen)xlbt rA   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/pkinit.pylength_encode$   s
   rC   c                   @   sH   e Zd Zdd Zedd Zedd Zedd Zd	d
 Zdd Z	dS )DirtyDHc                 C   sF   d | _ d | _d | _d | _td| _t| j d| _	td| _
d S )N       )pg
shared_keyshared_key_intosurandomprivate_keyinthexprivate_key_intdh_nonceselfrA   rA   rB   __init__.   s   zDirtyDH.__init__c                 C   s   t  }| |_||_|S NrD   rG   rH   )rG   rH   ddrA   rA   rB   from_params7   s   zDirtyDH.from_paramsc                 C   s   t  }| d |_| d |_|S )NrG   rH   rV   )dhprW   rA   rA   rB   	from_dict>   s   

zDirtyDH.from_dictc                 C   s   t j| j}t|S rU   )r   DHParametersloadnativerD   rZ   )
asn1_bytesrY   rA   rA   rB   	from_asn1E   s   
zDirtyDH.from_asn1c                 C   s   t | j| j| jS rU   )powrH   rP   rG   rR   rA   rA   rB   get_public_keyK   s   zDirtyDH.get_public_keyc                 C   sN   t || j| j| _t| jdd  }t|d dkrd| }t|| _| jS )N   r   0)	r`   rP   rG   rJ   rO   r=   bytesfromhexrI   )rS   bob_intr>   rA   rA   rB   exchangeO   s   zDirtyDH.exchangeN)
__name__
__module____qualname__rT   staticmethodrX   rZ   r_   ra   rg   rA   rA   rA   rB   rD   -   s    	


rD   c                   @   s   e Zd Zdd ZdddZedddZedd	d
ZdddZddg dfddZ	e
je
jB e
jB fddZdddZdddZdd ZdddZdS )PKINITc                 C   s:   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d S rU   )	privkeyinfocertificateextra_certsuser_sid	user_nameissuercnamediffie_PKINIT__hcertrR   rA   rA   rB   rT   Y   s   
zPKINIT.__init__MYNc                 C   s"   ddl m} |||\| _| _d S )Nr   )find_cert_by_cn)#minikerberos.common.windows.crypt32rw   rn   ru   )rS   usernamecertstore_namecert_serialrw   rA   rA   rB   init_windows_certe   s   zPKINIT.init_windows_certc                 C   s&   t  }|j| ||d |j|d |S )N)rz   r{   	dh_params)rl   r|   setup)ry   rz   r{   r~   pkinitrA   rA   rB   from_windows_certstorej   s   zPKINIT.from_windows_certstorec                 C   sz   t  }t|tr| }t| d}t| |d\|_|_|_	t
|j|_W d    n1 s0w   Y  |j|d |S )Nrb)passwordr}   )rl   
isinstancestrencodeopenr   readrm   rn   ro   r
   privkeyr   )pfxfilepfxpassr~   r   frA   rA   rB   from_pfxr   s   
zPKINIT.from_pfxc                 C   s   | j jjd D ]}|dr|| _q|ddkr|| _q| j jjd | _dd| j| jg| _	|d u rGt
d ttdj| _t
d	 d S t|trTt|| _d S t|trat|| _d S t|trk|| _d S td
)Ncommon_namezS-1-12@\AzureADzGenerating DH params...i   zDH params generated.z.DH params must be either a bytearray or a dict)rn   subjectr]   
startswithrp   findrq   rr   joinrs   printrD   rZ   generate_dh_parametersrt   r   dictrd   r_   	Exception)rS   r~   r>   rA   rA   rB   r      s&   




zPKINIT.setup)forwardable	renewable	proxiablecanonicalizec                 C   st  t |tr	t|}|d urt |tr|g}n| jg}|d ur't |tr&|g}ndg}tjtjj}i }t	||d< t
tjj|d|d< d|d< t
tjj|d|d< |tjdd	 jd
d|d< |tjdd	 jd
d|d< td|d< ddg|d< tdddg|d< t|}t|  }i }|j|d< |jd
d|d< td|d< ||d< i }	| jj|	d< | jj|	d< d
|	d< i }
d|
d< t|	|
d< i }t|
|d< | j |d < i }t ||d!< t!||d"< | jj"|d#< t#|}| j$| d$d%}t%t&|| }d&| }d't%t&| | }i }t'j(j|d(< ||d)< i }d*|d+< d,|d-< |g|d.< ||d/< t)| S )0N	127.0.0.1zkdc-optionsz	name-typezname-stringrs   WELLKNOWN:PKU2Urealmsnamer4   )daysr   microsecondtillrtime   nonce      etype   s	   127.0.0.1)z	addr-typeaddress	addressescusecctime
paChecksumrG   rH   qz1.2.840.10046.2.1	algorithm
parameters
public_keypkAuthenticatorclientPublicValueclientDHNonceF)wrap_signed      0padata-typepadata-value   pvno
   msg-typepadatazreq-body)*r   listsetr   rs   datetimenowtimezoneutcr   r   r   MS_PRINCIPALvalue	timedeltareplacesecretsrandbitsr   r   r   sha1dumpdigestr   rt   rG   rH   r   DomainParametersPublicKeyAlgorithmra   r$   PublicKeyInforQ   r%   sign_authpackrC   r=   r   	PK_AS_REQr"   )rS   targetrs   kdcoptsr   kdc_req_body_datakdc_req_bodychecksumauthenticatordppkaspkiauthpacksigned_authpackpayload	pa_data_1asreqrA   rA   rB   build_asreq   st   




zPKINIT.build_asreqc                 C   s  t |d  }t|j|d }td }	i }
d|
d< |	|d||
d< i }t|
|d< t| }d}|jd	d
ddt	|jd	d
dd | }t
 }||_d|_i }d|d< | | |d< t }d|_d|_td|_i }d|d< | |d< t|}t|g }td|dg }tjtjj}i }t|d< t|d |d< |d |d< |j|d< |jdd|d< t||d< d|d< td|dg|d < t||d!< ||d"t | d }d#g}i }t|d$< t!j"j#|d%< t$|d& |d&< t%t&||d'< t'|j|d(|d)< t(| S )*NkeytypekeyvaluerF   	cksumtype)   r   zgss-micrb      r5   T)	byteorderr7   s                   i  r4   i    @7e303fffe6bff25146addca4fbddf1b94f1634178eb4528fb2731c669ca23cder   zrestriction-typerestriction   )zad-typezad-datazauthenticator-vnocrealmrs   r   r   r   subkeyin,(z
seq-numberzauthorization-datacksum   zmutual-requiredr   r   ticketz
ap-options)r   cipherr   ))r   r   enctyper   r   r   r.   r   r;   r=   r   flagschannel_bindingr/   FlagsTokenILrd   re   	MachineIDr0   r1   r   r   r   r   r   r   r   r   r   r   encryptr   r   
KRB_AP_REQr   r   r    r   r!   r   )rS   asrepsession_keyr   subkey_datakrb_finished_datar   subkey_cipher
subkey_keysubkey_checksumkrb_finished_checksum_datakrb_finishedaextensions_dataacchksumtiirestriction_datar>   restrictionsr   authenticator_dataauthenticator_data_encap_optsap_reqrA   rA   rB   build_apreq   s^   (
zPKINIT.build_apreqFc                 C   s0   | j d urddlm} || j |S | | ||S )Nr   )
pkcs7_sign)ru   rx   r  sign_authpack_native)rS   datar   r  rA   rA   rB   r   >  s   
zPKINIT.sign_authpackc                 C   sJ  i }t d|d< i }d|d< t| jj| jjd|d< t ||d< tdd	gd
tdt	
| gd
g|d< t ddi|d< t| jt|d  d|d< i }d	|d< ||d< i }d|d< t |g|d< t||d< | jg|d< tt|g|d< |du ri }d|d< t||d< t| S t| S )a  
		Creating PKCS7 blob which contains the following things:

		1. 'data' blob which is an ASN1 encoded "AuthPack" structure
		2. the certificate used to sign the data blob
		3. the singed 'signed_attrs' structure (ASN1) which points to the "data" structure (in point 1)
		z1.3.14.3.2.26r   v1version)rr   serial_numbersiddigest_algorithmcontent_typez1.3.6.1.5.2.3.1)typevaluesmessage_digestsigned_attrsz1.2.840.113549.1.1.1signature_algorithmr   	signaturecontentv3digest_algorithmsencap_content_infocertificatessigner_infosTz1.2.840.113549.1.7.2)r   DigestAlgorithmIdr   IssuerAndSerialNumberrn   rr   r  DigestAlgorithmCMSAttributer   r   r   SignedDigestAlgorithmr	   r   CMSAttributesr   EncapsulatedContentInfoSignerInfos
SignerInfo
SignedDataContentInfo)rS   r  r   dasiecsdcirA   rA   rB   r  E  s:   	 zPKINIT.sign_authpack_nativec                 C   s  dd }|d D ]}|d dkrt |d j} nqtdtj|d j}|d	 }|d
 dkr6tdt|d j}tddgdd |d D  d}tj	t
|d  dd  ddd}| j|}	|d }
|	| jj |
 }|d d }t| }|tjkr||d}n|tjkr||d}n	|tjkrtdt|j|}|d d }||d|}t|j}tt|d  d!  }t|j|d  d" }|||fS )#Nc                 S   s~   d}d}t ||k r=tt|g|   }t |t | |kr/||d |t |  7 }	 |S ||7 }|d7 }t ||k s
|S )N    r   r4   )r=   r   r   rd   r   )r   keysizeoutput
currentNumcurrentDigestrA   rA   rB   truncate_key|  s   z*PKINIT.decrypt_asrep.<locals>.truncate_keyr   r   r   r   zPA_PK_AS_REP not found!dhSignedDatar&  r  z1.3.6.1.5.2.3.2z%Keyinfo content type unexpected valuer#   1c                 S   s   g | ]}t |qS rA   )r   ).0r>   rA   rA   rB   
<listcomp>  s    z(PKINIT.decrypt_asrep.<locals>.<listcomp>subjectPublicKeyrb   r8   r5   Fr6   serverDHNoncezenc-partr   rE   rF   zBRC4 key truncation documentation missing. it is different from AESr      keyr   r   )r,   r\   r]   r   r   r2  r-   rN   r   
from_bytesr   	BitStringr   rt   rg   rQ   r   r   AES256AES128RC4NotImplementedErrorr   r   decryptr   )rS   as_repr>  papkasrepr7  keyinfoauthdatapubkeyrI   server_noncefullKeyr   r   t_keyrG  enc_datadec_dataencasrepr   rA   rA   rB   decrypt_asrepx  s@   $&



zPKINIT.decrypt_asrepc                 C   s   |d urt |tr|g}ndg}i }d|d< | j|d< t|g}t|g}i }d|d< ttjj|d|d< i }t	||d	< t
d
| ig|d< t| S )Nr   z2.5.4.3r  r   r   pku2ur   
clientInfor)   r  rA  )r   r   rr   r&   r'   r   r   r   r   r)   r*   r   r(   )rS   r   r8  r  infomdrA   rA   rB   get_metadata  s"   



zPKINIT.get_metadata)rv   N)rv   NNrU   )F)rh   ri   rj   rT   r|   rk   r   r   r   r   r2   GSS_C_MUTUAL_FLAGGSS_C_INTEG_FLAGGSS_C_EXTENDED_ERROR_FLAGr  r   r  r[  r`  rA   rA   rA   rB   rl   X   s    

!N
P
39rl   )DrK   r   r   platform	unicryptor   
asn1cryptor   r   r   r   r   oscrypto.keysr   oscrypto.asymmetricr	   r
   minikerberos.protocol.constantsr   r   r    minikerberos.protocol.encryptionr   r   r   r    minikerberos.protocol.structuresr   "minikerberos.protocol.asn1_structsr   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   minikerberos.protocol.rfc4556r$   r%   r&   r'   r(   r)   r*   r+   r,   r-    minikerberos.protocol.rfc_iakerbr.   minikerberos.protocol.mskiler/   r0   r1   minikerberos.gssapi.gssapir2   rC   rD   rl   rA   rA   rA   rB   <module>   s.   	L0	+